binaryninja-api
binaryninja-api copied to clipboard
Convert switch-case with two cases {0, 1} to an if-else branch
I have a binary that obfuscates a regular if-else statement to a switch-case with two cases. It would be good if we can automatically concert such a case to an if-else branch, thus defeating the obfuscation, with minimal user-interaction:
Here is what it now looks like in HLIL:
We can see it is checking if the start of the buffer is 0x5a4d, a typical check for PE file.
Repro steps:
- Download the binary from https://malshare.com/sample.php?action=detail&hash=0cf55c7e1a19a0631b0248fb0e699bbec1d321240208f2862e37f6c9e75894e7 and open it
- Go to function 0x434a60
- Set the type of the data variable at
0x44284ctoconst int32_t - Set the type of the data variable at
0x442844toconst int32_t[2] - View the function code in HLIL
I came across this while looking at https://github.com/Vector35/binaryninja-api/discussions/5629.
P.S. some other switch-case conversion related issues: https://github.com/Vector35/binaryninja-api/issues/4670, https://github.com/Vector35/binaryninja-api/issues/1723