5 ms·
My suspicion is that most of these features wouldn't survive in an adversarial setting -- either by consciously changing your coding style or (better) using aut
by moyix 11y ago
My suspicion is that most of these features wouldn't survive in an adversarial setting -- either by consciously changing your coding style or (better) using automated tools to rewrite your source code before compilation to alter the control flow structure (e.g., control flow flattening [1]).
http://reverseengineering.stackexchange.com/questions/2221/what-is-a-control-flow-flattening-obfuscation-technique http://reverseengineering.stackexchange.com/questions/2221/w...
- EGreg 11y agoI am not so sure that the coding style doesn't survive the automated tools. It's also about what features you implement and how you do it.
- moyix 11y agoRunning `strip` on the binary decreased classification accuracy by 12%. They quite correctly point out that this isn't a large drop, but strip is really the lowest of the low hanging fruit when it comes to code obfuscation. I'd expect much bigger drops from anything that's trying to make code harder to fingerprint.
- petke 11y agoAnother option would be safety in numbers. Take a large executable written by someone else and wear its dead code like its your own skin. Hiding your true self in there somewhere.
- EGreg 11y agoThat might be an interesting way to defeat it! Thanks.