Если пропустили предыдущие эпизоды, их можно посмотреть в записи:

Эпизод 1: погружение в Threat Intelligence

Эпизод 2: мир киберугроз с threat intelligence — задачи, не ограниченные индикаторами компрометации

Эпизод 3: потоки TI-данных — как использовать сведения об актуальных киберугрозах

Эпизод 4. Будни TI-аналитика: задачи, навыки и инструменты

io_wrapper = BytesIO(code)
proj = angr.Project(
        io_wrapper,
        main_opts={
            "backend": "blob",
            "arch": "x86",  
            "base_addr": imagebase,
        },
        auto_load_libs=False,
    )

cfg = proj.analyses.CFGFast(
    cross_references=True,
    normalize=True,
)

config = SmdaConfig()
config.CALCULATE_HASHING = False
config.CALCULATE_SCC = False
# having a valid prologue is enough
config.CONFIDENCE_THRESHOLD = 0.29
config.MAX_IMAGE_SIZE = 5 * 2 ** 20 #
config.TIMEOUT = 60

dism = Disassembler(config=config, backend="intel")
report = dism.disassembleBuffer(file_content=code, base_addr=imagebase, bitness=32)
if report.status == "ok":
    report.initCodeXrefs()

for smda_func in report.getFunctions():
    if smda_func.blocks:
        for block_instructions in smda_func.blocks.values():
            for smda_isnn in block_instructions:
                print(f"{smda_func.offset} | {smda_isnn.detailed}")

    for smda_out_ref in smda_func.getCodeOutrefs():
        print(f"{smda_func.offset} | Out ref {smda_out_ref.to_func}")

    for smda_in_ref in smda_func.getCodeInrefs():
        print(f"{smda_func.offset} | In ref {smda_in_ref.from_func}")

c749b0 | <CsInsn 0xc749b0 [ff742408]: push dword ptr [esp + 8]>
c749b0 | <CsInsn 0xc749b4 [ff742408]: push dword ptr [esp + 8]>
c749b0 | <CsInsn 0xc749b8 [e893feffff]: call 0xc74850>
c749b0 | <CsInsn 0xc749bd [83c408]: add esp, 8>
c749b0 | <CsInsn 0xc749c0 [89c1]: mov ecx, eax>
c749b0 | <CsInsn 0xc749c2 [31c0]: xor eax, eax>
c749b0 | <CsInsn 0xc749c4 [85c9]: test ecx, ecx>
c749b0 | <CsInsn 0xc749c6 [7409]: je 0xc749d1>
c749b0 | <CsInsn 0xc749c8 [83790402]: cmp dword ptr [ecx + 4], 2>
c749b0 | <CsInsn 0xc749cc [7503]: jne 0xc749d1>
c749b0 | <CsInsn 0xc749ce [8b4108]: mov eax, dword ptr [ecx + 8]>
c749b0 | <CsInsn 0xc749d1 [c3]: ret >
c749b0 | Out ref 0xc749b8 (0xc749b0) -> 0xc74850 (0xc74850)

ALERT: Apple detected a targeted mercenary spyware attack against your iPhone

Apple detected that you are being targeted by a mercenary spyware attack that is trying to remotely compromise the iPhone associated with your Apple Account (ВАШ АККАУНТ). This attack is likely targeting you specifically because of who you are or what you do. Although it's never possible to achieve absolute certainty when detecting such attacks, Apple has high confidence in this warning - please take it seriously.