avast / avast/retdec

Suspected malware obfuscated and causing Warning: out of memory; trying to recover

Open
#667 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

I try to decompile the full source,
each process return output will have Warning: out of memory; trying to recover

but
```
-> running CArrayArgOptimizer ( 104.87s )
Running phase: variable renaming [readable] ( 105.07s )
LLVM ERROR: Could not acquire a cryptographic context: The specified procedure could not be found. (0x7F)
Error: Decompilation of file D:\NNN.bc failed
```

here is the file sample:
https://drive.google.com/open?id=1pPbk0nE9qrk4EnwCeo7vXKeV5kxMkkhw

This project is the best ever project existed in mankind. I feel thankful to these amazing contributors and the coder(s). I salute.
I wanted to compile to try debugging but I am stuck in LLVM\ something .h missing.
Also when I use release version of March built 0x7F is identified ^look above

edit: when I use latest commit built using windows server, this is the error output
```
LLVM ERROR: out of memory
0x00007FF7339C2935 (0x0000000000000001 0x0000000000000040 0x000000952FFFDF40 0x00007FF847D5BF01)
0x00007FF847DBDB77 (0x0000000000000040 0x000000952FFFDF40 0x00007FF847D5BF01 0x0000001B00000008)
0x0000000000000001 (0x000000952FFFDF40 0x00007FF847D5BF01 0x0000001B00000008 0x0000000000000000)
0x0000000000000040 (0x00007FF847D5BF01 0x0000001B00000008 0x0000000000000000 0x0000001B00000000)
0x000000952FFFDF40 (0x0000001B00000008 0x0000000000000000 0x0000001B00000000 0x0000000000000001)
0x00007FF847D5BF01 (0x0000000000000000 0x0000001B00000000 0x0000000000000001 0x0000000000000000)
0x0000001B00000008 (0x0000001B00000000 0x0000000000000001 0x0000000000000000 0x0000026F59A88F40)
Error: Decompilation of file D:\NNN.bc failed
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing decompilation of the linked D:\NNN.bc sample with the March release and the latest Windows build. Inspect the reported CArrayArgOptimizer and variable-renaming phases, then compare the cryptographic-context and LLVM out-of-memory failures. Done means identifying a reproducible cause and documenting or validating a project-level fix.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.