|
1 | 1 | # AntiOllvm |
2 | | -### Eliminate ollvm obfuscation and generate binary raw files. |
| 2 | +### Automatically deobfuscate binaries and generate new binaries. |
3 | 3 |
|
4 | 4 | ## Chinese Help |
5 | 5 | 中文帮助点击 [帮助](README_CN.md) |
6 | 6 |
|
7 | | -## 公众号 |
8 | | -**关注我的公众号可以第一时间收到我的最新原创技术文章分享** |
| 7 | +## Decriptor |
9 | 8 |
|
10 | | - |
| 9 | +Software obfuscation protection is very common these days. Although this protects the rights and interests of normal developers, it also provides convenience for the authors of malware and viruses. They can also use obfuscation to protect malware. This is a security analyst. A great hindrance, they have to spend a lot of time to analyze and sort out the logic, AntiOllvm provides automatic de-obfuscation function, which greatly reduces unnecessary analysis time, and it is not only de-obfuscation. |
11 | 10 |
|
| 11 | +This software uses [retdec](https://github.com/avast/retdec) to convert binary code to `LLVM IR` code, optimize and remove the obfuscated part, and use [LLVM](https://github.com/llvm/llvm-project) recompile it to generate a new binary file corresponding to the symbol address of the original binary file, and at the same time ensure the semantic correctness of the code, the original obfuscated function body must be larger than the unobfuscated function body, so after optimization Recompile writes code to original file location and fixes relocations using global variables. |
| 12 | + |
| 13 | + |
| 14 | +## Official website [https://antiollvm.com](https://antiollvm.com) (coming soon) |
| 15 | + |
| 16 | +## Software purchase |
| 17 | + |
| 18 | +| | China |Other Regions|Binding Device|Number of Bindings|Features Restrictions |Follow-up Feature Restrictions| Bonus |Windows x64| Linux x64 |macOS | |
| 19 | +|:--: |:----: |:------: |:------: |:------: |:------: |:----------: |:-------------:|:----: |:-----: |:----: | |
| 20 | +|Trial | \ | \ | \ | \ |Only Arm, does not support recompilation | \ | \ | Support |Subsequent opening|Subsequent opening| |
| 21 | +|Annual subscription|9600￥ | 1650\$ | 1 device | 1 time | None |Additional charges may apply | Now-01/18/2023| Support |Subsequent opening|Subsequent opening| |
| 22 | +|Permanent |38000￥| 6800\$ | 1 device | 10 times | None | None | Unlimited | Support |Subsequent opening|Subsequent opening| |
| 23 | + |
| 24 | +- Contact information |
| 25 | + - Telegram Group [t.me/antiollvm](https://t.me/antiollvm) |
| 26 | + |
| 27 | + - WeChat public account: sanfengAndroid逆向安全 |
| 28 | + - QQ group: [839141004](https://jq.qq.com/?_wv=1027&k=vNKrvgND) |
| 29 | +- At present, there may be some problems. The first purchase gift is valid until 01/18/2023. If you encounter any problems, you can report it through the contact information above. Please be patient and wait for the repair. |
| 30 | +- Trial version download [click](releases) |
| 31 | +- Download the official version, please contact me through the above contact information |
| 32 | + |
| 33 | +## Using help |
| 34 | +[Click](doc/README.md) |
| 35 | + |
| 36 | +## Development progress |
| 37 | + |
| 38 | +| Architecture | ELF | COFF | Mach-O | |
| 39 | +| :----: | :-: | :--: | :----: | |
| 40 | +| Arm | Yes | | Yes | |
| 41 | +| Arm64 | Yes | | Yes | |
| 42 | +| X86 | | | | |
| 43 | +| X86_64 | | | | |
| 44 | + |
| 45 | +## Instructions for use |
| 46 | + |
| 47 | +- This project is a paid project, and this repository will only store the source code and binary files of the description files and some test samples |
| 48 | +- Everyone is welcome to provide samples (the more complex the better) to my mailbox [[email protected]](https://mail.163.com/), you can also submit **issues ** in this warehouse with samples and instructions , please indicate **binary architecture and file format ** in the title when sending the sample The **obfuscation difficulty level (1-3) **, I will reply you with the deobfuscated binary after the deobfuscation passed |
| 49 | + |
| 50 | +## Disclaimer |
| 51 | +AntiOllvm is a software that automatically de-obfuscates binary files. It is suitable for software security researchers and software security enthusiasts to use security products for learning and research. Do not use it for unauthorized and illegal purposes. |
| 52 | + |
| 53 | +When you use this security product for research/testing, you should ensure that the behavior complies with local laws and regulations and has sufficient authorization. If you have any illegal behavior in the process of using this security product, you shall bear the corresponding consequences by yourself, and we will not bear any legal and joint responsibility. |
| 54 | + |
| 55 | +Before you use this security product, please read it carefully and fully understand the contents, limitations, disclaimers or other terms involving your significant rights and interests. Unless you have fully read, fully understood and accepted all the terms of this agreement, please do not use this security product. |
| 56 | + |
| 57 | +Your use behavior or your acceptance of this Agreement in any other express or implied manner shall be deemed that you have read and agreed to be bound by this Agreement. |
| 58 | + |
| 59 | +## directory description |
| 60 | + |
| 61 | +- Each test directory contains the corresponding test source code, and the preset static library (not obfuscated, obfuscated), the bin in the corresponding directory generates binary files related to the architecture and file format, binary files and static libraries Without `-obf` suffix is generated without obfuscation, with `-obf` suffix is generated after obfuscation, with `-anti` in the binary directory is the de-obfuscated binary output. |
| 62 | +- For the description of each test item, please refer to the `doc` directory document in the corresponding directory |
| 63 | +- [OpenSSL Test](OpenSSLTest/doc/README_CN.md) |
| 64 | +- [Arm64 Test](Arm64Test/README_CN.md) |
| 65 | + |
| 66 | + |
| 67 | +## [personal blog](https://sanfengandroid.github.io/blog) |
| 68 | + |
| 69 | +Including technical article sharing, software instructions, video demonstrations, etc. |
| 70 | + |
| 71 | +## Software Future |
| 72 | + |
| 73 | +- Open `X86`, `X86_64` deobfuscation support |
| 74 | +- IDA plugin, convenient de-obfuscation, better optimized de-obfuscation using IDA analysis results |
| 75 | +- Develop simulation execution to realize cross-platform binary file tracking operation on PC, such as algorithm analysis, etc. |
| 76 | +- IDA virtual debugging, built on simulated execution. |
| 77 | + |
| 78 | +## Quote |
| 79 | + |
| 80 | +### retdec [https://github.com/avast/retdec](https://github.com/avast/retdec) |
| 81 | + |
| 82 | +### LLVM [https://github.com/llvm/llvm-project](https://github.com/llvm/llvm-project/) |
12 | 83 |
|
0 commit comments