4 ms·
At first look, the code produced by Movfuscator is mind boggling. But despite its perceived entanglement there exist some deobfuscators that bring the code back
by garganzol 8y ago
At first look, the code produced by Movfuscator is mind boggling. But despite its perceived entanglement there exist some deobfuscators that bring the code back to Harvard (e.g. human readable) model.
TL/DR obfuscation by translating a program to "mov" instructions is susceptible to static analysis and thus fully reversible.
- TimTheTinker 8y ago> there exist some deobfuscators that bring the code back Care to elaborate? The author of Movfuscator is very experienced and capable at reverse engineering. In one of his video talks he hits some Movfuscated code with some tools and says he doesn't know of anything that can deobfuscate it. That may have changed since then -- I'd be curious to know.
- andreareina 8y agoThere's the demovfuscator: https://kirschju.re/demov https://kirschju.re/demov
- TimTheTinker 8y agoThanks! That’s really cool.