Статья Декомпилятор на нейронках. Скрещиваем IDA Pro с ChatGPT

waveOut_work    proc near

                push    ebx
                mov     ebx, offset pwh

loc_409F0E:
                push    20h ; ' '       ; cbwh
                push    ebx             ; pwh
                push    ds:hwo          ; hwo
                call    __imp_waveOutUnprepareHeader
                add     ebx, 20h ; ' '
                cmp     ebx, offset byte_412DE4
                jb      short loc_409F0E
                push    ds:hwo          ; hwo
                call    __imp_waveOutClose
                pop     ebx
                retn
waveOut_work    endp

MMRESULT waveOut_work()
{
  struct wavehdr_tag *v0; // ebx

  v0 = &pwh;
  do
    waveOutUnprepareHeader(hwo, v0++, 0x20u);
  while ( v0 < (struct wavehdr_tag *)&byte_412DE4 );
  return waveOutClose(hwo);
}

void waveOut_work()
{
    WAVEHDR *pwh = (WAVEHDR *) &pwh;  // Начало массива структур WAVEHDR
    while ((BYTE *)pwh < (BYTE *)0x412DE4)
    {
        waveOutUnprepareHeader(hwo, pwh, sizeof(WAVEHDR));
        pwh++;
    }
    waveOutClose(hwo);
}

sub_40C5A4      proc near

String          = dword ptr  4

                push    ebx
                push    esi
                mov     ebx, [esp+8+String]
                mov     esi, 105h
                cmp     word ptr [ebx], 21h ; '!'
                jnz     short loc_40C5D0
                xor     ebx, ebx
                call    __imp_GetVersion
                test    eax, 80000000h
                mov     esi, 3
                jnz     short loc_40C5FB
                mov     esi, 0Bh
                jmp     short loc_40C5FB

loc_40C5D0:
                cmp     word ptr [ebx], 3Fh ; '?'
                jnz     short loc_40C5DF
                xor     ebx, ebx
                mov     esi, 3
                jmp     short loc_40C5FB

loc_40C5DF:
                movsx   ecx, byte ptr [ebx]
                test    ds__ctype+1)[ecx], 4
                jz      short loc_40C5FB
                push    ebx             ; String
                call    j__atoi
                mov     ebx, eax
                mov     esi, 1
                add     esp, 4

loc_40C5FB:
                push    ebx             ; dwData
                push    esi             ; uCommand
                push    offset FullPath_HLP ; lpszHelp
                push    ds:g_hWnd_0     ; hWndMain
                call    __imp_WinHelpA
                pop     esi
                pop     ebx
                retn    4
sub_40C5A4      endp

BOOL __stdcall sub_40C5A4(char *String)
{
  char *v1; // ebx
  UINT v2; // esi

  v1 = String;
  v2 = 261;
  if ( *(_WORD *)String == 33 )
  {
    v1 = 0;
    v2 = 3;
    if ( (GetVersion() & 0x80000000) == 0 )
      v2 = 11;
  }
  else if ( *(_WORD *)String == 63 )
  {
    v1 = 0;
    v2 = 3;
  }
  else if ( (*((_BYTE *)_ctype + *String + 1) & 4) != 0 )
  {
    v1 = (char *)j__atoi(String);
    v2 = 1;
  }
  return WinHelpA(g_hWnd_0, FullPath_HLP, v2, (ULONG_PTR)v1);
}

int __stdcall sub_40C5A4(LPCSTR String)
{
    int dwData = 0;
    UINT uCommand = 0x105; // Значение по умолчанию

    if (*(WORD *)String == '!')
    {
        // Если строка начинается с '!'
        GetVersion(); // результат используется только для проверки платформы
        if (GetVersion() & 0x80000000)
            uCommand = 3;
        else
            uCommand = 0x0B;
    }
    else if (*(WORD *)String == '?')
    {
        // Если строка начинается с '?'
        uCommand = 3;
    }
    else if (isxdigit((unsigned char)*String)) // или isdigit, если __ctype+1[ecx] == 4 означает цифру
    {
        dwData = atoi(String);
        uCommand = 1;
    }

    WinHelpA(g_hWnd_0, FullPath_HLP, uCommand, dwData);
    return 0;
}

import idc
import idaapi
import idautils
import openai
import re

client = openai.OpenAI(
  api_key="sk-proj-*"
)

def ask_gpt_about_function(c_code):
    prompt_text = f"""

Respond strictly in the following format:
Function name: <name>
Description: <short explanation>
"""
    try:
        response = client.chat.completions.create(
            model="gpt-4",
            messages=[
                {"role": "user", "content": prompt_text}
            ],
            temperature=0.5
        )

        return response.choices[0].message.content
    except Exception as e:
        print(f"[!] GPT API error: {e}")
        return None

def apply_result_to_function(ea, gpt_response):
    match = re.search(r"Function name:\s*(\w+).?Description:\s(.*)", gpt_response, re.DOTALL)
    if match:
        name = "gpt_" + match.group(1)
        desc = match.group(2).strip()

        if ida_name.force_name(ea, name, idc.SN_AUTO):
            print(f"[+] Renamed function at {hex(ea)} to: {name}")
        else:
            print(f"[!] Could not rename function to: {name}")

        idc.set_func_cmt(ea, desc, 0)
    else:
        print(f"[!] Could not parse GPT response:\n{gpt_response}")

def is_user_defined_name(ea):
    return not idc.get_name(ea).startswith("sub_")

def get_decompiled_code(ea):
    try:
        cfunc = idaapi.decompile(ea)
        return str(cfunc)
    except Exception as e:
        print(f"[!] Failed to decompile function at {hex(ea)}: {e}")
        return None

def main():
    for func_ea in idautils.Functions():


        print(f"[*] Processing function at {hex(func_ea)} {is_user_defined_name(func_ea)}")

        if is_user_defined_name(func_ea):
            continue

        code = get_decompiled_code(func_ea)
        if not code:
            continue

        gpt_result = ask_gpt_about_function(code)
        if gpt_result:
            apply_result_to_function(func_ea, gpt_result)

main()

// This function swaps the second and third bytes of the input array and then masks the second byte with a value from a global byte array and a bitwise AND operation. The result is stored back into the second byte of the input array.
int __fastcall gpt_swap_and_mask_bytes_0(int a1, int a2, _BYTE *a3)
{
  int result; // eax

  LOBYTE(a2) = a3[2];
  a3[2] = a3[3];
  a3[3] = a2;
  LOBYTE(a2) = a3[1];
  result = a2;
  LOBYTE(result) = byte_4110E4[(int)(unsigned __int8)a2 >> 4] | a2 & 0xF;
  a3[1] = result;
  return result;
}

// This function copies and inverts the pixels from one area of the image to another. The source and destination areas, as well as the dimensions, are determined by the input parameters. The pixels are processed in reverse order, and zero pixels are skipped.
char __stdcall gpt_copy_inverted_pixels(int a1, int a2, int a3, int a4, int a5, int a6, int a7, int a8, int a9)
{
  char *v9; // edi
  char *v10; // esi
  int v11; // edx
  int v12; // ebp
  int v13; // ecx
  char result; // al

  v9 = (char *)lpBits + a4 + dword_412CD0 * (dword_412CD4 - 1 - a3);
  v10 = (char *)(a9 + a8 + a6 + a6 * -a7 - 1);
  v11 = a2 - a4 + dword_412CD0;
  v12 = a1 - a3;
  dword_412CD8 = a2 - a4;
  do
  {
    v13 = dword_412CD8;
    while ( 1 )
    {
      result = *v10--;
      if ( !result )
        break;
LABEL_4:
      *v9++ = result;
      if ( !--v13 )
        goto LABEL_8;
    }
    while ( 1 )
    {
      ++v9;
      if ( !--v13 )
        break;
      result = *v10--;
      if ( result )
        goto LABEL_4;
    }
LABEL_8:
    v9 -= v11;
    v10 += a2 - a4 + a6;
  }
  while ( v12-- > 1 );
  return result;
}

tools = [
    self.__GetAddressInfoTool(),
    self.__GetDefinitionTool(),
    self.__GetPseudocodeTool(),
    self.__SetFunctionCommentTool(),
    self.__SetFunctionDefinitionTool(),
    self.__SetFunctionNameTool(),
    self.__GetIsMyWorkDoneTool(ea)
]

class __GetAddressInfoTool(BaseTool):
    name = 'get_address_info'
    description = ('Given a hex address or function name, show its information. '
                   'Input Format: <hex_address_or_function_name>. '
                   'Input Example1: sub_140007080. '
                   'Input Example2: 0x140007080.')

class Copilot:
    def run(self, temperature=0.5, model='gpt-4o'):

default_prompt_en = PromptTemplate(
    input_variables=['binary_description'],
    template="""

{binary_description}

Please continue your analysis until get_is_my_work_done tells you the work is complete.
""")

import time

    class __GetIsMyWorkDoneTool(BaseTool):
        def _run(self, query: str, run_manager: Optional[CallbackManagerForToolRun] = None) -> Any:
            time.sleep(1)

    class __SetFunctionNameTool(BaseTool):
        def _run(self, query: str, run_manager: Optional[CallbackManagerForToolRun] = None) -> Any:
            time.sleep(1)

BOOL show_help()
{
  BOOL result; // eax

  if ( g_hWnd_0 )
  {
    WinHelpA(g_hWnd_0, FullPath_HLP, 2u, 0);
    return DestroyWindow(g_hWnd_0);
  }
  return result;
}

def do_analysis(code,model_name):
    url = ollama_url
    headers = {"Content-Type": "application/json"}
    payload = {"model": model_name, "prompt": code, "stream": False,"format":"json"}
    print('Prompt:', code)
    res = requests.post(url, headers=headers, json=payload)
    try:
        t = res.json()['response']
        t = json.loads(t)
        print('Response:', t)
        return t
    except:
        # rarely this occurs, leftover from early on
        logging.error(f'aiDAPal: error unpacking response\n{res.json()["response"]}')
        return None

Prompt:
/*
0x401a74 is __imp_GetVersion //
0x417404 is g_hWnd_0 //
0x401b08 is __imp_WinHelpA //
*/
BOOL __stdcall sub_40C5A4(char *String)
{
  char *v1; // ebx
  UINT v2; // esi

  v1 = String;
  v2 = 261;
  if ( *(_WORD *)String == 33 )
  {
    v1 = 0;
    v2 = 3;
    if ( (GetVersion() & 0x80000000) == 0 )
      v2 = 11;
  }
  else if ( *(_WORD *)String == 63 )
  {
    v1 = 0;
    v2 = 3;
  }
  else if ( (*((_BYTE *)_ctype + *String + 1) & 4) != 0 )
  {
    v1 = (char *)j__atoi(String);
    v2 = 1;
  }
  return WinHelpA(g_hWnd_0, FullPath_HLP, v2, (ULONG_PTR)v1);
}

Response:
{
   "function":"sub_40C5A4",
   "comment":"This function interprets a string input and performs specific actions based on the first character of the string. It primarily calls WinHelpA with different parameters depending on the initial character of the input string.",
   "variables":[
      {
         "original_name":"String",
         "new_name":"input_string"
      },
      {
         "original_name":"v1",
         "new_name":"temp_variable"
      },
      {
         "original_name":"v2",
         "new_name":"command_flag"
      }
   ],
}

Prompt: int __stdcall sub_409590(int a1)
{
  unsigned int v1; // esi
  int result; // eax
  unsigned int *v3; // edx

  v1 = *(_DWORD *)(a1 + 12);
  result = dword_417300 + 8 * dword_417204 - 8;
  if ( v1 < *(_DWORD *)(result + 4) )
  {
    v3 = (unsigned int *)(result + 4);
    do
    {
      v3 -= 2;
      result -= 8;
    }
    while ( *v3 > v1 );
  }
  return result;
}

Response:
{
   "function":"sub_409590",
   "comment":"This function seems to be calculating an index based on a given input value and a set of predefined values. It uses several pointer arithmetic operations and conditional logic to find the index, possibly for use in accessing or manipulating data in memory.",
   "variables":[
      {
         "original_name":"a1",
         "comment":"Input parameter"
      },
      {
         "original_name":"v1",
         "comment":"Value calculated from input parameter"
      },
      {
         "original_name":"result",
         "comment":"Calculated index or address"
      },
      {
         "original_name":"v3",
         "comment":"Pointer used in loop to compare and update index"
      }
   ]
}

Prompt: int __stdcall sub_408F20(char *String)
{
  return sub_40C5A4(String);
}

Response:
{
   "function":"int sub_408F20(char *String)",
   "comment":"This function is a simple wrapper for another function, 'sub_40C5A4'. It takes a character string as an argument and returns the result of calling 'sub_40C5A4' with that string.",
   "variables":[
      {
         "originalName":"String",
         "newName":"inputString"
      }
   ]
}

Response:
{
   "function":"int __fastcall sub_408F20(_DWORD *String)",
   "comment":"This function is a simple wrapper for another function named 'sub_40C5A4'. It takes a pointer to a character string as its argument, calls 'sub_40C5A4' with that argument, and returns the result of that call."
}

char sub_4081B8()
{
  int rowIndex; // ecx
  int columnIndex; // ebx
  _BYTE *currentCell; // edx
  char returnCode; // [esp+4h] [ebp-4h]

  rowIndex = 0;
  columnIndex = 0;
  returnCode = 0;
  for ( currentCell = (_BYTE *)dword_4173D4; !*currentCell; ++currentCell )
  {
    if ( rowIndex && *(currentCell - 1) == 6
      || rowIndex < dword_4173D8 && currentCell[1] == 6
      || columnIndex && currentCell[dword_4173DC] == 6
      || columnIndex < dword_4173E0 && currentCell[dword_4171E8] == 6 )
    {
      returnCode = 4;
      *currentCell = 4;
    }
LABEL_12:
    if ( ++rowIndex >= dword_4171E8 )
    {
      if ( ++columnIndex >= dword_4171EC )
        return returnCode;
      rowIndex = 0;
    }
  }
  if ( *currentCell != 2
    || (!rowIndex || *(currentCell - 1) != 6)
    && (rowIndex >= dword_4173D8 || currentCell[1] != 6)
    && (!columnIndex || currentCell[dword_4173DC] != 6)
    && (columnIndex >= dword_4173E0 || currentCell[dword_4171E8] != 6) )
  {
    goto LABEL_12;
  }
  dword_412C94 = rowIndex;
  dword_412C98 = columnIndex;
  return 1;
}