\n\nThis page has been machine-translated from the original page.
\n
This article covers the deobfuscation technique for self-restoring binaries using Unicorn and Capstone, based on the Rev challenge “Singlestep” from Cyber Apocalypse CTF 2025.
\nReference: Cyber Apocalypse CTF 2025 Writeup
\nI had used Unicorn for emulating execution code once a long time ago, but had not touched it much since.
\nReference: Emulating x86_64 Architecture Shellcode with Unicorn
\nDuring the contest, I used gdb-python to forcibly extract the deobfuscated assembly from the execution code, but I ended up extracting an enormous amount of code due to failing to account for loop processing, and the extracted code could not be decompiled.
\nHowever, the Unicorn + Capstone method described here allows for a much cleaner deobfuscation of the binary, and also makes it possible to extract the deobfuscated code in a form that can be decompiled.
\n\nHooking and Dumping Execution Code with Unicorn and Capstone
\n\n\n\nSinglestep
\nMalakar has locked away a sacred artifact away in his dungeon. He has enchanted the locking mechanism to be self-protecting. Can you embark on a mission to free the artifact back to the people’s hands?
\n
Running the provided ELF binary prompts for some input.
\nEntering the correct value appears to yield the flag.
\nThis function is implemented as follows. It is clearly attempting to replace the code at 0x43ec via an XOR operation and then continue execution.
Analyzing this operation in gdb confirms that when the XOR at 0x43e1 is executed, the code at 0x43ec is replaced with what appears to be a function prologue.
Furthermore, looking at the code above, the XOR at 0x43f1 restores the code at 0x43ec to its original form, ensuring that the decrypted code does not persist in memory after execution.
Tracing through the rest of the code, it becomes clear that the binary repeatedly decodes, executes, and re-encodes the real execution code in blocks ranging from pushfq -> xor to xor -> popfq.
The following is an excerpt of the emulator initialization code. Both The code then allocates a stack region, initializes the RSP/RBP registers, and finally maps the executable file data directly into memory. To properly emulate an ELF, you would normally need to reproduce the ELF loader behavior (library loading, section alignment, etc.), but since we only need to emulate the XOR-based restoration of execution code, mapping the raw ELF file directly is sufficient. Reference: Programming with C & Python languages – Unicorn – The Ultimate CPU emulator The following code uses Unicorn supports hooking other operations too, such as specific memory accesses. Reference: alexander-hanel/unicorn-engine-notes In the hook function called at each instruction, Capstone is used to disassemble the execution code. When the hook function is invoked by Unicorn, the instruction address and its size are passed as arguments. The byte data obtained via Reference: Disassemble in iterartion style – Capstone – The Ultimate Disassembler Running this allows the disassembly results of the hooked execution code to be dumped as shown below. To deobfuscate the challenge binary, two main operations are needed: The following challenges arise for this binary: With the above in mind, the following solver was created. Running this code produces a Below is a summary of the key points. As confirmed earlier, the binary repeatedly decodes, executes, and re-encodes real execution code in blocks from Analyzing the restored binary shows that unnecessary parts have been replaced with NOPs, leaving only the deobfuscated execution code. The decompiler is also able to analyze the deobfuscated execution code. Looking at the code, it first initializes a 4×4 memory region to create the following 2D array: It also verifies that the input is 19 characters and matches a hyphen-delimited format like Emulator Initialization
\nUc(UC_ARCH_X86, UC_MODE_64) and Cs(CS_ARCH_X86, CS_MODE_64) initialize Unicorn and Capstone respectively, targeting x64.# Initialize Unicorn & Capstone\nmu = Uc(UC_ARCH_X86, UC_MODE_64) # mu is initialized as a virtual CPU\nmd = Cs(CS_ARCH_X86, CS_MODE_64) # md is initialized as an x64 disassembler\n\n\n# Initialize virtual memory, RSP/RBP\nstack_addr = 0x900000\nstack_size = 0x100000\nmu.mem_map(stack_addr, stack_size)\nmu.reg_write(UC_X86_REG_RSP, stack_addr + stack_size - 8 - 0x200)\nmu.reg_write(UC_X86_REG_RBP, stack_addr + stack_size - 8)\n\n\n# Read original binary\nwith open(\"singlestep\", \"rb\") as f:\n code = f.read()\n\n \n# Allocate 0x50000 bytes of virtual memory and map the execution code\ncode_addr = 0x0\nmu.mem_map(code_addr,0x50000)\nmu.mem_write(code_addr,code)Hooking Execution Code with Unicorn
\nUC_HOOK_CODE to hook every instruction’s execution, configuring a hook for Unicorn code execution.# Add hook to Unicorn\n# UC_HOOK_CODE invokes the hook immediately before each instruction executes\n# hook_code(mu, address, size, user_data)\nmu.hook_add(UC_HOOK_CODE, hook_code)\n\n# Run program\nwhile len(call_addrs) > 0:\n try:\n current_call_addr = call_addrs.pop()\n mu.emu_start(current_call_addr,0x900D) # emu_start(begin,end)\n except Exception as e:\n print(\"Error: %s\" % e)\n print(\"at : %s\" % hex(mu.reg_read(UC_X86_REG_RIP)))\n breakDisassembling Execution Code with Capstone
\nuc.mem_read(address, size) is passed to md.disasm(instruction_bytes, address), which returns an iterator containing the disassembly result.# Hook function\ndef hook_code(uc, address, size, user_data):\n global current_call_addr\n global previous_call_addr\n previous_call_addr = current_call_addr\n \n instruction_bytes = uc.mem_read(address, size)\n for i,instruction in enumerate(md.disasm(instruction_bytes, address)):\n complete_instruction = f\"{i} 0x{instruction.address:x}:\\t{instruction.mnemonic}\\t{instruction.op_str}\"\n print(complete_instruction)\n \n if instruction.mnemonic == \"call\":\n addr = int(instruction.op_str,16)\n if addr < 0x1260:\n print(\"PLT function called.\")\n # uc.emu_stop()\n return\n\n elif instruction.mnemonic == \"ret\":\n # uc.emu_stop()\n returnDeobfuscating the Challenge Binary
\n\n
\n\n
\ndeobfuscated binary containing the deobfuscated execution code.from unicorn import *\nfrom unicorn.x86_const import *\nfrom capstone import *\nimport copy\n\n# ============================\n# Globals\n# ============================\n\n# Initialize Unicorn & Capstone\nmu = Uc(UC_ARCH_X86, UC_MODE_64) # mu is initialized as a virtual CPU\nmd = Cs(CS_ARCH_X86, CS_MODE_64) # md is initialized as an x64 disassembler\n\n# Initial values\nwith open('singlestep', 'rb') as f:\n code = f.read()\n\ncode = bytearray(code)\ndeobfuscated_code = copy.deepcopy(code)\n\ncall_addrs = [0x43E0]\ndeobfuscated_addrs = []\npopfq_flag = False\ncurrent_call_addr = 0\nprevious_call_addr = 0\n\n# Hook function\ndef hook_code(uc, address, size, user_data):\n global current_call_addr\n global previous_call_addr\n global popfq_flag\n global deobfuscated_code\n global deobfuscated_addrs\n previous_call_addr = current_call_addr\n \n instruction_bytes = uc.mem_read(address, size)\n\n for i,instruction in enumerate(md.disasm(instruction_bytes, address)):\n complete_instruction = f\"{i} 0x{instruction.address:x}:\\t{instruction.mnemonic}\\t{instruction.op_str}\"\n\n if instruction.mnemonic == \"popfq\":\n popfq_flag = True\n deobfuscated_code[address:address+size] = b\"\\x90\" * size\n \n elif instruction.mnemonic == \"pushfq\":\n popfq_flag = False\n deobfuscated_code[address:address+size] = b\"\\x90\" * size\n \n elif instruction.mnemonic == \"ret\":\n popfq_flag = False\n print(\"ret.\")\n # print(complete_instruction)\n uc.emu_stop()\n return\n \n else:\n if popfq_flag and address not in deobfuscated_addrs:\n popfq_flag = False\n\n # print(complete_instruction)\n deobfuscated_code[address:address+size] = instruction_bytes\n deobfuscated_addrs.append(address)\n\n # Skip de-deobfuscated instruction\n uc.reg_write(UC_X86_REG_RIP, address + size)\n \n if instruction.mnemonic == \"call\":\n addr = int(instruction.op_str,16)\n if addr < 0x1260:\n print(\"PLT function called.\")\n return\n else:\n call_addrs.append(addr)\n\n else:\n deobfuscated_code[address:address+size] = b\"\\x90\" * size\n\n return\n \n# ============================\n\n\n# Initialize virtual memory, RSP/RBP\nstack_addr = 0x900000\nstack_size = 0x100000\nmu.mem_map(stack_addr, stack_size)\nmu.reg_write(UC_X86_REG_RSP, stack_addr + stack_size - 8 - 0x200)\nmu.reg_write(UC_X86_REG_RBP, stack_addr + stack_size - 8)\n\n# Read original binary\nwith open(\"singlestep\", \"rb\") as f:\n code = f.read()\n\n# Allocate 0x50000 bytes of virtual memory and map the execution code\ncode_addr = 0x0\nmu.mem_map(code_addr,0x50000)\nmu.mem_write(code_addr,code)\n\n# Add hook to Unicorn\n# UC_HOOK_CODE invokes the hook immediately before each instruction executes\n# hook_code(mu, address, size, user_data)\nmu.hook_add(UC_HOOK_CODE, hook_code)\n\n# Run program\nwhile len(call_addrs) > 0:\n try:\n current_call_addr = call_addrs.pop()\n if current_call_addr not in deobfuscated_addrs:\n mu.emu_start(current_call_addr,0x900D) # emu_start(begin,end)\n deobfuscated_addrs.append(current_call_addr)\n except Exception as e:\n print(\"Error: %s\" % e)\n print(\"at : %s\" % hex(mu.reg_read(UC_X86_REG_RIP)))\n break\n\nwith open('deobfuscated', 'wb') as f:\n f.write(deobfuscated_code)Defining Conditions to Clearly Distinguish Deobfuscated Instructions from Others
\npushfq -> xor to xor -> popfq.var_278 = [[ 88, -17, 19, -57],\n [ 45, -9, 10, -29],\n [-56, 11, -12, 36],\n [-40, 8, -9, 26]]AAA-BBBB-CCCC-DDDD.