Unpacking Obfuscated Android ELF Native Libraries with Frida and Unicorn
Approach
The target binary utilized OLLVM control flow flattening. We hooked mprotect and dumped the decrypted pages.
JAVASCRIPT
Interceptor.attach(Module.findExportByName(null, "mprotect"), {
onEnter: function(args) {
console.log("[*] mprotect called: " + args[0] + " len: " + args[1]);
}
});FLAG SOLUTION // SPOILER
WHUB{0llvm_cff_fl4tt3n1ng_unp4ck3d}