An Effective Approach to Software Obfuscation
summary
Argues that most obfuscation boosts potency and resilience but ignores stealth, making transforms easy to detect. Analyzes LLVM’s control-flow flattening (dispatcher sets a local constant) and shows automated tools — IDA/Hex-Rays, BinSec/angr, BAP, r2, Binary Ninja plugin — rely on heuristics. Implements stealthy opaque predicates that defeat IDA’s overlap heuristic, cause wrong disassembly (function returns nonzero instead of zero) and produce no warning, demonstrating detection-resistant obfuscation is the missing ingredient.
AI-written summary · about
chapters (12)
- 0:00Introduction to talk
- 0:22What is software obfuscation
- 1:24Three properties of obfuscation
- 4:16Obfuscation vs cryptography
- 6:05Maximizing time-consuming aspect
- 7:30Control flow graph flattening
- 10:46Problem with modern obfuscation
- 11:50Effective obfuscation approach
- 12:35Importance of stealth property
- 13:37Opaque predicates example
- 21:38Summary and conclusion
- 22:01Q&A session
related talks
45m"Advanced Malware Threat: handling obfuscated code using..."
15mObfuscation in Mobile Apps
47mJavaScript Obfuscation: It’s All About the P a c k e r s
36mMaster the Art of Code Obfuscation from Simple to Advanced
21mWhen Obfuscations Preserve Cryptographic Constant-Time
05mMachObfuscator
13mComparing Malware Evasion Theory with Practice: Results from Interviews with Expert
35mEnhancing Software Composition Analysis Resilience Against Container Image Obfuscation