4 ms·
What if the obfuscation removes the ability to construct a control flow graph, but is not self-decrypting?
by munin 11y ago
What if the obfuscation removes the ability to construct a control flow graph, but is not self-decrypting?
- NateLawson 11y agoWe depend on a huge number of program features so CFG alone isn't enough to throw it off (data references, function layout, linker behavior, and much more are included in our matching). You're right that, at some point, you've destroyed enough of the features that matching will fail. For that case, you'll always need targeted techniques, such as for virtualizing obfuscators. Since there's a big performance loss when you use them, almost no legitimate mobile apps are willing to pay the battery and speed loss.