Static analysis: string obfuscation (affine mod 127)

Address: 0x140071d80 (shadow-copy command), 0x140034500 (VM extensions), 0x140003680 (DB extensions) Callers / callees: main (shadow copy); CRT static initializers (extension sets)

Purpose

Hide the most signature-worthy strings from static string scans.

Walkthrough

• Scheme: each string is built on the stack, or read from a .rdata table, and decoded byte by byte with an affine map mod 127. Each string or table has its own constants, in the form ((±(b − K))·M) mod 0x7F or (a·b + c) mod 127.
• Shadow-copy command (FUN_140071d80): 76 bytes decoded with ((0x39 − b)·0x0B) mod 0x7F. The result was confirmed in x64dbg memory.
• VM-disk extensions (FUN_140034500): 20 wide strings, each with its own key.
• Database extensions (FUN_140003680): 153 tables in .rdata starting around 0x1400d3c00.
  • Ghidra’s decompiler timed out on this function, and inline Ghidra scripts are disabled (GHIDRA_MCP_ALLOW_SCRIPTS=0; the config was left unchanged).
  • Instead, the full disassembly (artifacts/ghidra/FUN_140003680_db_ext_initializer.disasm.txt, 1.65 MB) and a 40,000-byte .rdata dump (artifacts/ghidra/rdata_1400d3c00_40000.bin) were parsed on the host.
  • Each table’s key was solved by UTF-16 known plaintext (a leading . and NUL terminators), then checked for consistency across the whole table.
  • Output: artifacts/decoded/db_extensions.txt, with keys and RVAs in artifacts/decoded/dbext_groups.json.

Findings

• The obfuscation is light and applied to only three string groups. Log strings, the note, CLI names and .akira stay plaintext and make good detection anchors.

Cross-references

• Related: 03-pre-encryption-actions.md, 04-encryption-modes.md