之前介绍了android1337的crystr项目，他的brkida项目也很有意思，准备合入PerfectLoader，项目地址：://github.com/android1337/brkida

项目介绍

作者提供一个BRKIDA宏，来阻止IDA工具进行反编译。原代码只支持x64的MSVC编译器，稍作修改，支持clang，如下：

#ifndef BRKIDA_HPP#define BRKIDA_HPP#if defined(_WIN64) && (defined(_MSC_VER) || defined(__clang__)) // Support MSVC and Clang on Windows x64#include <intrin.h> // __AddressOfReturnAddress (supported by Clang on Windows)// Very simple compile-time hash algorithm for binary randomnessunsigned constexpr long long const_hash(const char* input) {    return *input ? static_cast<unsigned long long>(*input) + 33 * const_hash(input + 1) : 5381;}/** stub proc* jmp useless ; E8 08* mov [rsp + BIGINT_HERE], rcx; this will never be executed (48 89 8C 24 DE AD BE EF)* useless:* ret ; C3* stub endp*/#define BRKIDA {     constexpr unsigned __int8 stub[] = {         0xEB, 0x08, /* jmp 0x8 */         0x48, 0x89, 0x8C, 0x24, /* mov [rsp + ????????], rcx */         static_cast<unsigned __int8>((const_hash(__DATE__ __TIME__) + __COUNTER__ * __COUNTER__) % 0xFF), /* mod of max uint8_t */         static_cast<unsigned __int8>((const_hash(__DATE__ __TIME__) + __COUNTER__ * __COUNTER__) % 0xFF), /* mod of max uint8_t */         static_cast<unsigned __int8>((const_hash(__DATE__ __TIME__) + __COUNTER__ * __COUNTER__) % 0xFF), /* mod of max uint8_t */         static_cast<unsigned __int8>((const_hash(__DATE__ __TIME__) + __COUNTER__ * __COUNTER__) % 0xFF), /* mod of max uint8_t */         0xC3 /* ret */     };     /* We don’t want to execute the stub because we don’t change the protection to executable, so it would crash */     if (!_AddressOfReturnAddress()) {         ((void(*)())uintptr_t(stub))();         ((void(*)())uintptr_t(0x0))(); /* A call to 0x0 sometimes breaks IDA decompiler too */     } }#else#define BRKIDA#error "BRKIDA is currently only supported on Windows x64 with MSVC or Clang"#endif#endif // include guard

这个项目利用了这样一个事实：当 IDA 反编译器遇到对一个过大指针的栈访问时，它会失败。

核心代码：

jmp useless ; jump 8 byte after to skip the next instruction (E8 08)mov [rsp + BIGINT_HERE], rcx ; this will never be executed or we would crash too (48 89 8C 24 DE AD BE EF)useless:ret ; C3

原文始发于微信公众号（红蓝对抗技战术）：对抗IDA反编译