"Advanced Malware Threat: handling obfuscated code using..."
summary
Shows a concrete workflow for deobfuscation: small intentionally-obfuscated C examples are transformed back to original logic using assemblers/disassemblers and emulators, and results validated (EAX = 9). Builds an IDA Pro plugin and tiny loaders, runs numeric emulation and symbolic execution with symbolic execution with miasma, and uses Keystone/Capstone for assemble/disassemble. Demonstrates a VM-detection trick via CPU temperature, reports real-world unpacking takes weeks and a roughly 6% success rate on advanced protectors.
AI-written summary · about
chapters (16)
- 0:00Introduction and agenda
- 1:14Entry reversing basics
- 4:39Obfuscation techniques overview
- 7:21Advanced packers and virtualization
- 10:02Polymorphic and code flattening
- 16:56Handling adversity packers
- 20:21Code flattening demo
- 23:20Obfuscated code reversal process
- 24:31Using Uncompyle and Keystone
- 26:26Numeric approach with Capstone
- 28:16Symbolic execution with Miasm
- 32:30Triton for symbolic execution
- 35:12Hydra for emulation
- 37:11Virtual machine detection trick
- 40:39Recommendations and conclusion
- 41:50Q&A session
related talks
01h 09mDeobfuscate UEFI/BIOS Malware And Virtualized Packers
51mFull System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware
26mAn Effective Approach to Software Obfuscation
47mJavaScript Obfuscation: It’s All About the P a c k e r s
13mComparing Malware Evasion Theory with Practice: Results from Interviews with Expert
29mA Day in the Life of a Mobile Malware Reverse Engineer
33mBasic Malware Analysis for Incident Responders
55mHiding PIN's Artifacts to Defeat Evasive Malware