Code deobfuscation by optimization
- Type
- Audio
- Tags
- reverse engineering
- Authors
- Branko Spasojevic
- Event
- Chaos Communication Congress 27th (27C3) 2010
- Indexed on
- Mar 27, 2013
- URL
- http://mirror.fem-net.de/CCC/27C3/mp3-audio-only/27c3-4096-en-code_deobfuscation_by_optimization.mp3
- File name
- 27c3-4096-en-code_deobfuscation_by_optimization.mp3
- File size
- 22.2 MB
- MD5
- a14dff15e958af3058a85a940dc9ef2a
- SHA1
- e84c57e5fa3bc07e6c36752b24a2f941c8c9d10c
Optimization algorithms present an effective way for removing most obfuscations that are used today. Much of the compiler theory can be applied in removing obfuscations and building fast and reliable deobfuscation systems. By understanding traditional optimization problems and techniques it is possible to develop and customize compiler optimization algorithms for usage in binary deobfuscation/analysis. Analysis of malware binaries is constantly becoming more difficult with introduction of many different types of code obfuscators. One common theme in all obfuscators is transformation of code into a complex representation. This process can be viewed as inverse of compiler optimization techniques and as such can be partially removed using optimization algorithms. Optimization algorithms present an effective way for removing most obfuscations that are used today. Much of the compiler theory can be applied in removing obfuscations and building fast and reliable deobfuscation systems. By understanding traditional optimization problems and techniques it is possible to develop and customize compiler optimization algorithms for usage in binary deobfuscation/analysis. Optimization algorithms are especially successful in following: • Removal of no operation instructions • Simplifying complex instructions • Removal of unconditional jumps • Removal of conditional jumps • Simplifying control-flow graph This presentation shows common obfuscation techniques and a process of adapting optimization algorithms for removing obfuscations. Additionally, a open-source plug-in for the IDA Pro disassembler is presented that demonstrates usability of the proposed optimization process as well as a set of techniques to speed up the process of analyzing obfuscated code.
About us
Secdocs is a project aimed to index high-quality IT security and hacking documents. These are fetched from multiple data sources: events, conferences and generally from interwebs.
Statistics
Serving 8166 documents and 531.0 GB of hacking knowledge, indexed from 2419 authors from 163 security conferences.
Contribute
To support this site and keep it alive, you can click on the buttons below. Any help is really appreciated! This service is provided for free, but real money is needed to pay bills.
