Quick Binary Ninja snippet to statically deobfuscate global data protected by simple XOR constants.
It parses the HLIL (High Level IL) of functions referencing the current address, extracts constant XOR operations (e.g., data_x ^ 0xAA), and patches the binary view in-place.
Useful for malware configs or global strings that get XOR'd immediately upon access.
- HLIL-based: Uses Binja's IL to ignore architecture-specific assembly noise.
- Auto-Patching: Modifies memory directly so decoded strings show up in Linear View / Strings window.
- Preview: Dumps "string-like" blocks (continuous ASCII) found after patching to the console.
- Last Write Wins: If a byte is XOR'd multiple times in the IL, the last operation takes precedence.
- Open the Binary Ninja python console (`Ctrl + ``).
- Navigate to the start of the encrypted blob/data.
- Paste the script.
- Run:
decode_from_here_lastwins()
decode_from_here_lastwins(patch=False)Default arguments:
decode_from_here_lastwins(patch=True, preview=True, min_len=6, min_score=0.85, max_funcs=60)
min_len / min_score: Filters for the "string-like blocks" output (noise reduction).max_funcs: Cap on analyzed functions to prevent hanging on globals with massive xref counts.
Regex on IL: The script relies on regex parsing of str(hlil_instruction). If Binja changes HLIL text formatting in updates, the regex might need tweaking.
Static Only: Only handles constant keys (val ^ 0x55). Won't solve dynamic keys generated at runtime or complex loop decoding.