Detection and decoding of Base64 strings
- Dominant language
- C++
- Stars
- 8.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
There are Base64 strings in [sample](https://www.virustotal.com/en/file/5b7e3d214eca40b44969652db601d8b236501bc40c1caa8fa0840f354e897058/analysis/). We could detect and decode them just like Hex-Rays does:
```c
int sub_4029E3()
{
// Possible Base64 string "firefox.exe"
v0 = sub_4018F5("ZmlyZWZveC5leGU=");
result = sub_402867((char *)v0);
if ( !(_BYTE)result )
{
// Possible Base64 string "opera.exe"
v2 = sub_4018F5("b3BlcmEuZXhl");
result = sub_402867((char *)v2);
if ( !(_BYTE)result )
{
// Possible Base64 string "iexplore.exe"
v3 = sub_4018F5("aWV4cGxvcmUuZXhl");
result = sub_402867((char *)v3);
if ( !(_BYTE)result )
{
// Possible Base64 string "chrome.exe"
v4 = sub_4018F5("Y2hyb21lLmV4ZQ==");
result = sub_402867((char *)v4);
if ( !(_BYTE)result )
{
// Possible Base64 string "IEXPLORE.EXE"
v5 = sub_4018F5("SUVYUExPUkUuRVhF");
result = sub_402867((char *)v5);
}
}
}
}
}
```
This would be best implemented as dedicated analysis in `llvmir2hll`. We need to do a heuristic using the following:
- Encoded string length can be divided by 4.
- Encoded string contains only `[a-zA-Z0-9+/]` and can end with one or two `=`.
- Decoded string should contain only characters from some pre-determined range (e.g. ASCII).
- If there is one encoded string, it is likely there are more.
Problems:
- We can never be 100% sure.
- [Wiki](https://en.wikipedia.org/wiki/Base64#Implementations_and_history) says there are many Base64 variants.
- [Wiki](https://en.wikipedia.org/wiki/Base64#Implementations_and_history) says some implementations do not rely on alignment characters - we could not use length or alignment heuristics.
- Alignment characters do not have to be present, if the original string had the right length - we can not rely on them.
- If binary data were encoded -> problems.
- etc.
What needs to be done:
1. Modify `llvmir2hll` so that expressions/commands can be associated with multiple metadata entries. Right now, only one string can be assigned to every expression/command.
2. Implement the detection & decoding analysis. It would assign metadata info to expressions/commands.
3. Modify output code generator to generate such metadata as comments.
4. Test it and add regression tests.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in the llvmir2hll metadata handling to trace how one string is associated with an expression or command. Then review the output code generator and existing regression tests before designing multi-entry metadata and the Base64 analysis. Done means detected and decoded strings produce comment metadata and regression tests cover the behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers, devtools
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100