obfuscator

My research is about detecting semantically similar executable code inside obfuscated and stripped programs. I don't know what commercial antivirus or vulnerability scanners use internally, but it's possible to generate similarity scores between an obfuscated/stripped unknown binary and a bunch of known binaries. I suspect commercial scanners use a lot of heuristics. I know IDA Pro has a plugin for "fingerprinting" but it's based on hashes of byte sequences and can be spoofed. My approach is basically: train a model on a large obfuscated dataset seeded with "known" examples. While you can't say with certainty what an unknown sample contains, you can determine how similar it is to a known sample, so you can spend more of your time analyzing the really weird stuff. The hardest part in my opinion is generating the training data. You need a g

Love this topic. I remember Everquest used to checksum areas of memory that were commonly modified from cheats. World of Warcraft used to (possibly still does, it has been forever since I looked at this) inject anti cheat code at runtime. Obfuscation and deobfuscation is also super interesting. I think overall reverse engineering and figuring out how things work is one of the most interesting things in computer science. https://github.com/obfuscator-llvm/obfuscator/tree/llvm-4.0/... https://blog.quarkslab.com/deobfuscation-recovering-an-ollvm...

I’m surprised that no one has mentioned how this is actually accomplished. The answer is: largely automatically, at the compiler level. Snapchat acquired Obfuscator-LLVM and the people behind it in 2017, which was actually partially open source for a period of time. It is a compiler backend for LLVM that obfuscates your code for you. You can read a bit about some of the techniques used on their old wiki: https://github.com/obfuscator-llvm/obfuscator/wiki/Features (outdated) https://www.bloomberg.com/news/articles/2017-07-21/snap-hire...

Sorry, there might be some confusion. This entire time I was referring to code obfuscation/integrity checks, and why bitcode is a problem for people who want to obfuscate their code. I was not referring to apps like Signal at all. As an interesting aside, LLVM's ARM backend can be made into an obfuscating compiler, and furthermore some people have started obfuscating the LLVM bitcode itself: https://github.com/obfuscator-llvm/obfuscator/wiki http://0vercl0k.tuxfamily.org/bl0g/?p=260