Practical MBA Deobfuscation with msynth
2021-11-12 03:43:59 Author: www.reddit.com(查看原文) 阅读量:22 收藏

Starting with the original expression, we evaluate it with (10, 20, 30) and obtain 70. Since (10, 20, 30) -> 70 is not in our database, we continue with the next subexpression, (x ^ y) + (2 * (x & y)). This time, it evaluates to 30, giving us (10, 20, 30) -> 30. This entry maps to x + y. Therefore, we replace the subexpression in the complex expression with x + y, which leads us to:

Why is there a concrete evaluation here? The expression might have 1000 side effects and special cases, the result x + y could be pure luck. Instead it seems the database-lookup might just as well be done on the unevaluated expression...or not?


文章来源: https://www.reddit.com/r/ReverseEngineering/comments/qrryly/practical_mba_deobfuscation_with_msynth/
如有侵权请联系:admin#unsafe.sh