Search code examples
cgccscriptingdeobfuscationconstantfolding

Constant folding in the preprocessing stage

I have a piece of C code I need to deobfuscate. It contains a bunch of tricky macros. I ran the code through C preprocessor and indent and now it looks similar to this:

switch (9263 + 1505) {
case 1505 + 41131 + 6729 + 2347:
            ...
case 1505 + 41131 + 6729 + 2347 + 1:
            ...
case 1505 + 41131 + 6729 + 2347 + 2:
            ...

To simplify further analysis I am looking for some tool that can fold all the constants in the code. I know that C preprocessor is unable to do this and constant folding optimisation will be performed during compilation stage. But what about source code?

Shell scripts are appreciated as well, as I suspect this could be the only way to do this.

Solution

  • Use clang to compile it, and use its c backend to generate c code.

    Something like this should work:

    clang -emit-llvm source.cpp -o - | llc -march=c