Delambert
An IDA plugin to deobfuscate strings from The Lamberts macOS malware sample
af7c395426649c57e44eac0bb6c6a109ac649763065ff5b2b23db71839bac655
24/08/2021
Pedro Vilaça - reverser@put.as - https://reverse.put.as
Public domain code, do whatever you want, just give credits if you use any of this :P
Build:
Change the Makefile
paths and build. It will install to ~/.idapro/plugins
folder.
Only macOS supported and tested with IDA 7.6 SP1.
Usage:
Installs a right click menu item on disassembly window.
You can execute the plugin on the LEA
instruction that loads the obfuscated string:
__text:000098DB 8D 93 43 85 02 00 lea edx, (byte_31500 - 8FBDh)[ebx] ; output_buf
__text:000098E1 8D 83 49 3E 02 00 lea eax, (unk_2CE06 - 8FBDh)[ebx] ; obfuscated string
__text:000098E7 E8 B2 F5 FF FF call fg_deobfuscate_string4
or just go to __cstring
section and execute it on the beginning of the encrypted string.
It will add a comment with the deobfuscated string.
Easy to tweak it to rename the variable for easier disassembly reference.
Have fun,
fG!