avast / avast/retdec

Detection and decoding of Base64 strings

Open
#111 0 comments 0 reactions 0 assignees View on GitHub
C-llvmir2hll D-help-wanted enhancement P-output
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

There are Base64 strings in [sample](https://www.virustotal.com/en/file/5b7e3d214eca40b44969652db601d8b236501bc40c1caa8fa0840f354e897058/analysis/). We could detect and decode them just like Hex-Rays does:
```c
int sub_4029E3()
{
// Possible Base64 string "firefox.exe"
v0 = sub_4018F5("ZmlyZWZveC5leGU=");
result = sub_402867((char *)v0);
if ( !(_BYTE)result )
{
// Possible Base64 string "opera.exe"
v2 = sub_4018F5("b3BlcmEuZXhl");
result = sub_402867((char *)v2);
if ( !(_BYTE)result )
{
// Possible Base64 string "iexplore.exe"
v3 = sub_4018F5("aWV4cGxvcmUuZXhl");
result = sub_402867((char *)v3);
if ( !(_BYTE)result )
{
// Possible Base64 string "chrome.exe"
v4 = sub_4018F5("Y2hyb21lLmV4ZQ==");
result = sub_402867((char *)v4);
if ( !(_BYTE)result )
{
// Possible Base64 string "IEXPLORE.EXE"
v5 = sub_4018F5("SUVYUExPUkUuRVhF");
result = sub_402867((char *)v5);
}
}
}
}
}
```

This would be best implemented as dedicated analysis in `llvmir2hll`. We need to do a heuristic using the following:
- Encoded string length can be divided by 4.
- Encoded string contains only `[a-zA-Z0-9+/]` and can end with one or two `=`.
- Decoded string should contain only characters from some pre-determined range (e.g. ASCII).
- If there is one encoded string, it is likely there are more.

Problems:
- We can never be 100% sure.
- [Wiki](https://en.wikipedia.org/wiki/Base64#Implementations_and_history) says there are many Base64 variants.
- [Wiki](https://en.wikipedia.org/wiki/Base64#Implementations_and_history) says some implementations do not rely on alignment characters - we could not use length or alignment heuristics.
- Alignment characters do not have to be present, if the original string had the right length - we can not rely on them.
- If binary data were encoded -> problems.
- etc.

What needs to be done:
1. Modify `llvmir2hll` so that expressions/commands can be associated with multiple metadata entries. Right now, only one string can be assigned to every expression/command.
2. Implement the detection & decoding analysis. It would assign metadata info to expressions/commands.
3. Modify output code generator to generate such metadata as comments.
4. Test it and add regression tests.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in the llvmir2hll metadata handling to trace how one string is associated with an expression or command. Then review the output code generator and existing regression tests before designing multi-entry metadata and the Base64 analysis. Done means detected and decoded strings produce comment metadata and regression tests cover the behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers, devtools
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.