4 ms·
This not quite true, especially with current state-of-the-art tools like Ghidra, IDA pro (with Hex-rays), etc. In fact, Rolf Rolles wrote a wonderful guest pos
by Andoryuuta 6y ago
This not quite true, especially with current state-of-the-art tools like Ghidra, IDA pro (with Hex-rays), etc.
In fact, Rolf Rolles wrote a wonderful guest post[1] for the Hex-Rays blog about automating the reversal of this exact obfusactor, though he wasnt aware of it's origins at the time.
[1]: https://www.hex-rays.com/blog/hex-rays-microcode-api-vs-obfuscating-compiler/ https://www.hex-rays.com/blog/hex-rays-microcode-api-vs-obfu...
- underdeserver 6y agoExactly. Such tools are definitely possible, even if they rely on Ghidra or IDA's plugin systems. What I like is the economics of the idea that one company can build an obfuscator, and then another company can build an anti-obfuscator which completely nullifies the value proposition of the first company.
- 3eed 6y agoAll these are great programs, but none of them can understand that level of obfuscation so far. As stated in the post, both Ghidra and IDA interpret the very first block in any of the obfuscated functions, which ends with an indirect branch, as a complete function in and of its own. Because this is the usual case, indirect branches AKA tail calls terminate a function to start another, all with the same stack frame. EDIT: also keep in mind the CFG isn't flattened here.
- underdeserver 6y agoI think the idea is that Ghidra's and IDA's plugin systems allow for manipulation of binaries at a level that allows writing deobfuscators over them.
- QuickReply 6y agoinside developer console: Array.from(document.images).forEach(img => console.log(img.src= img.src.replace("http://hexblog.com" http://hexblog.com", "https://hex-rays.com"))); https://hex-rays.com"))); to make the blog readable