The Poor Man's Obfuscator

Comments, chapters, ... Slides Search
Loading Click here to add:
Subscribe to notifications

When subscribed to notifications, an email will be sent to you for all added annotations.

Your user account has no email address.

Information on this media

105 views
The purpose of this lightning talk is to present executable files formats tricks (ELF and Mach-O)
to prevent static analysis tools (like IDA, BinaryNinja, ...) from working correctly.

While these tricks do not break the execution of the original binary, when they are opened in IDA, BinaryNinja and, Radare2
the code looks obfuscated while only the file format is modified (not the instructions)

These modifications are leveraged by LIEF and the scripts will be published at the end
of the conference with an associated blog post.

 
Romain Thomas

Romain Thomas is a security engineer working on mobile applications and obfuscated code.

Author of LIEF, a library to parse and manipulate executable file formats (ELF, PE, Mach-O),
he enjoys going back and forth between reverse engineering and tool development to see which part of the process can be automated.

Romain is also interested in iOS, whitebox cryptography and reverse engineering app protocols.
He contributed in the past to the Triton project, especially on de-obfuscation based on symbolic execution.

Creation date: July 5, 2022
Speakers: Romain Thomas
License: CC BY-SA v4
Links:

Other media in the channel "2022"