You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I wanted to help out and started digging into the cause of #36.
Although I was unable to locate the core issue ( I believe the deobfuscation would actually finish, although allowing a deobfuscation parameter to limit the time spent on reversing any particular function would be nice), I stumbled upon something:
Deobfuscating example A leads to vastly different results in comparison to deobfuscating example B
This feels somewhat ackward and I wonder whether there's a bug or how this happens.
@ben-sb It'd be nice if you could throw in a guess
It's likely due to repeatedly replacing nested proxy function calls in example A, resulting in larger and larger code each time. Whereas in example B Pe isn't detected as a proxy function, due to now having statements other than just a simple return, so this issue doesn't occur.
For something like example A the best option is to disable the proxy function removal setting.
I wanted to help out and started digging into the cause of #36.
Although I was unable to locate the core issue ( I believe the deobfuscation would actually finish, although allowing a deobfuscation parameter to limit the time spent on reversing any particular function would be nice), I stumbled upon something:
Deobfuscating example A leads to vastly different results in comparison to deobfuscating example B
This feels somewhat ackward and I wonder whether there's a bug or how this happens.
@ben-sb It'd be nice if you could throw in a guess
Example A
Example B
Note: Differs only in this part, where the return statement with the comma expression in
Pe
is refactored into two statements:The text was updated successfully, but these errors were encountered: