Suspected malware obfuscated and causing Warning: out of memory; trying to recover
- Dominant language
- C++
- Stars
- 8.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
I try to decompile the full source,
each process return output will have Warning: out of memory; trying to recover
but
```
-> running CArrayArgOptimizer ( 104.87s )
Running phase: variable renaming [readable] ( 105.07s )
LLVM ERROR: Could not acquire a cryptographic context: The specified procedure could not be found. (0x7F)
Error: Decompilation of file D:\NNN.bc failed
```
here is the file sample:
https://drive.google.com/open?id=1pPbk0nE9qrk4EnwCeo7vXKeV5kxMkkhw
This project is the best ever project existed in mankind. I feel thankful to these amazing contributors and the coder(s). I salute.
I wanted to compile to try debugging but I am stuck in LLVM\ something .h missing.
Also when I use release version of March built 0x7F is identified ^look above
edit: when I use latest commit built using windows server, this is the error output
```
LLVM ERROR: out of memory
0x00007FF7339C2935 (0x0000000000000001 0x0000000000000040 0x000000952FFFDF40 0x00007FF847D5BF01)
0x00007FF847DBDB77 (0x0000000000000040 0x000000952FFFDF40 0x00007FF847D5BF01 0x0000001B00000008)
0x0000000000000001 (0x000000952FFFDF40 0x00007FF847D5BF01 0x0000001B00000008 0x0000000000000000)
0x0000000000000040 (0x00007FF847D5BF01 0x0000001B00000008 0x0000000000000000 0x0000001B00000000)
0x000000952FFFDF40 (0x0000001B00000008 0x0000000000000000 0x0000001B00000000 0x0000000000000001)
0x00007FF847D5BF01 (0x0000000000000000 0x0000001B00000000 0x0000000000000001 0x0000000000000000)
0x0000001B00000008 (0x0000001B00000000 0x0000000000000001 0x0000000000000000 0x0000026F59A88F40)
Error: Decompilation of file D:\NNN.bc failed
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing decompilation of the linked D:\NNN.bc sample with the March release and the latest Windows build. Inspect the reported CArrayArgOptimizer and variable-renaming phases, then compare the cryptographic-context and LLVM out-of-memory failures. Done means identifying a reproducible cause and documenting or validating a project-level fix.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers, reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100