This Python script is designed to handle JMP deobfuscation.
It will sqash unneeded unconditional jmps and create new blocks, relocates blocks of code, adjusts relative addresses, and aligns blocks with padding.
Inspired by http://hooked-on-mnemonics.blogspot.com/2012/10/simple-deobfuscation-of-code.html
| #!/usr/bin/env python | |
| import socket, getopt, sys, os.path | |
| SMTP_PORT = 25 | |
| BUFFER_SIZE = 1024 | |
| OK_STATUS = 252 | |
| APP_NAME = "smtpenum" | |
| VERSION = "1.0.0" |
| DEFINE OBJECTS 204 | |
| DEFINE OBJECT (noname) | |
| DEFINE OBJECT DTN_STADDOORA // Object number -1 | |
| DEFINE OBJECT DTN_STADDOORB // Object number -2 | |
| DEFINE OBJECT DTHOTRING_A // Object number -3 | |
| DEFINE OBJECT BRIBE // Object number -4 | |
| DEFINE OBJECT CI_GATESCLOSED // Object number -5 | |
| DEFINE OBJECT CI_BACKGATECLOSE // Object number -6 | |
| DEFINE OBJECT INFO // Object number -7 |