On deobfuscation in practice
•Télécharger en tant que PPS, PDF•
3 j'aime•3,397 vues
ZeroNights 2011 slides
![Obfuscation applications ,[object Object],[object Object]](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (18)
En vedette
En vedette (20)
Similaire à On deobfuscation in practice
Similaire à On deobfuscation in practice (20)
Dernier
Dernier (20)
On deobfuscation in practice
- 1. On deobfuscation in practice Vasily Bukasov Dmitry Schelkunov
- 7. Code virtualization Get instruction byte-code Byte-code fetching loop Get instruction arguments from VM context or from another location Process instruction Save result into VM context or into another location
- 10. VM stack context layout Stack of the protected code Reserved area VM context rSP 0 Not initialized
- 12. Virtualized code execution Getting byte-code Loading from VM context Instruction execution Saving to VM context Getting byte-code Loading from VM context Instruction execution Saving to VM context This code is asking to be optimized etc…
- 15. Code morphing and CFG obfuscation Therefore protectors don’t even try to do it It’s a difficult task to decompile a machine code
- 16. Code morphing and CFG obfuscation Data dependencies analysis is weak in protectors Therefore they are limited in choice of obfuscation techniques
- 17. Code morphing common techniques Recursive templates Instruction Instruction Instruction … Instruction Template Template Template Template