Simple Deobfuscation of Code Transformation

Recently I had to deal with an annoying piece of malware. It used  compression and an obfuscation technique called code transformation.  The packer is known as Win32.Krap, trust me the name is justified. Most of the packer code can be by passed by setting hardware execute breakpoints on the first dword of the allocated memory heaps returned by VirtualAlloc.  Three heaps later, and we will have the above code block. Besides for pretty graphs code transformation makes the assembly look ugly. The transformation of the assembly is simple. For every four or five instructions we will add a JMP to the next instruction.

Example assembly of code transformation
Trying to view this code in IDA is very painful due to all the added JMP instructions along with the junk data. A good example can be seen above. If we want to view the un-obfuscated code all we have to do is view the code minus the JMPs.This sounds kind of simple but I have to admit this was a good learning experience. The algorithm is similar to recursive traversal disassembler except we aren't disassembling anything, we are skipping the JMPs and getting the instruction and address of where the JMP goes. A good example of the algorithm can be found here PDF.   What would the code look like without the JMPs?

Below is my code that I used to create the viewer and remove the JMPs. Word of caution. Use at your own risk. Odds are there are some bugs, bad logic or unused variables. Hopefully this will be a helpful POC for others. If you have any tips or ideas please leave a comment or shoot me an email.

# Python code to remove JMPs from obfuscated code in IDA
# created by alexander dot hanel at gmail dot come
# # Note you will need to have your cursor at what is the start
# of the function or at least in the path.

from idaapi import * 
import idautils
import idc
import sys 

class JMPJMP:
    def __init__(self):
        self.ea = ScreenEA()
        self.errorStatus = 'Good'
        self.funcStartAddr = GetFunctionAttr(self.ea, FUNCATTR_START)
        self.buffer = []
        self.count = 0
        self.condJmps = ['jo', 'jno', 'jb', 'jnae', 'jc', 'jnb', 'jae', 'jnc', 'jz', \
                                'je', 'jnz', 'jne', 'jbe', 'jna', 'jnbe', 'ja', 'js', 'jns', \
                                'jp', 'jpe', 'jnp', 'jpo', 'jl', 'jnge', 'jnl', 'jge', 'jle', \
                                'jng', 'jnle', 'jg']
        self.condJmpsAddr = set([])
        self.retn = ['retn', 'ret', 'retf']
        self.callAddr = set([]) = 'call' 
        self.callByte = 0xe8 = 'jmp'
        self.visitedAddr = set([]) = set([])
    def getJmpAddress(self, addr):
        "returns the address the JMP instruction jumps to"
        return GetOperandValue(addr, 0)
    def checkFunctionStart(self):
        'checks if the address is valid'
        if self.funcStartAddr is BADADDR:
            print "Could not find find function start address"
            self.errorStatus = 'Bad!'
    def checkAddr(self,addr):
        'checks if the address is valid'
        if addr is BADADDR:
            print "Could not find find function start address"
            self.errorStatus = 'Bad!'

    def getNext(self, addr):
        "returns the next address and instructions"
        next = NextHead(addr)
        return next, GetDisasm(next), GetMnem(next), Byte(addr)
    def getCur(self, addr):
        "returns address, dissasembly, the mnemoic and byte"
        return addr, GetDisasm(addr), GetMnem(addr), Byte(addr)
    def formatLine(self,addr):
        'format the line to mimic IDA layout' 
        return   idaapi.COLSTR(SegName(addr) + ':' + '%08X' % addr, idaapi.SCOLOR_INSN) + '\t' + idaapi.COLSTR(GetDisasm(addr) , idaapi.SCOLOR_INSN)
    def printBuffer(self):
        'print the buffer that contains the instructions minus jmps'
        v = idaapi.simplecustviewer_t()
        if v.Create("JMP CleanUp Viewer"):
            for instru in self.buffer:
            print "Failed to create viewer, wa waa waaaaa"
    def simplify(self, addr, target = list([]) ):
        # check if valid addresss
        if addr in self.visitedAddr:
            current_addr, current_inst, current_mnem, byte = self.getCur(addr)
            temp = current_addr
            self.buffer.append('__start: %s' % hex(temp))
                if self.errorStatus != 'Good':
                if current_mnem in
                    # uncomment if you want to see the jmp instruction in the output 
                    jmpAddr = self.getJmpAddress(current_addr)
                    current_addr, current_inst, current_mnem, byte = self.getCur(jmpAddr)
                # check for conditonal jmps, if so add to the target aka come back to list
                elif current_mnem in self.condJmps:
                    jmpAddr = self.getJmpAddress(current_addr)
                # if call, we will need the call address
                elif current_mnem in and byte == self.callByte:
                if current_mnem in self.retn or current_addr in self.visitedAddr:
                current_addr, current_inst, current_mnem, byte = self.getNext(current_addr)
            self.buffer.append('__end: %s ' % hex(temp))
            for revisit in target:
                if revisit in self.visitedAddr:
                    self.simplify(revisit, target)

def main():
    simp = JMPJMP()
    simp.simplify(GetFunctionAttr(ScreenEA(), FUNCATTR_START))

if __name__ == "__main__":


  1. Hi Alex,

    First, thanks for sharing this. Second, a short question: "Do you ever sleep?!?!?" ;)

  2. Hi

    Great work.
    It is always good to see implementation material over some theoretical PDFs
    I was wondering if it is possible to get a version of the packer in order to investigate it ?
    from what I see the callgraph itself is pretty huge and removing the garbage is only the 1st stage
    to remove the whole obfuscation


    1. My email is in the code. Shoot me an email I can share the sample. Cheers.

  3. I don't have the sample, so I can't test it at the moment, but I think optimice ( will figure out this kind of obfuscation tricks and deobfuscate the code.

    It has some additional deobfuscation techniques, it is definitely worth a try:)