The Poor Man's Obfuscator

Display subtitles automatically

None
In the preferred language only when the video is using another
Always in the preferred language
Always in the original language of the video

Preferred language:

Qualities

UbiCast player x

Keyboard shortcuts

Key

Action

K or space

Play / Pause

Mute / Unmute

Select next subtitles

Select next audio track

Show slide in full page or toggle automatic source change

left arrow

Seek 5s backward

right arrow

Seek 5s forward

shift + left arrow or J

Seek 10s backward

shift + right arrow or L

Seek 10s forward

control + left arrow

Seek 60s backward

control + right arrow

Seek 60s forward

shift + down arrow

Decrease volume

shift + up arrow

Increase volume

shift + comma

Decrease playback rate

shift + dot or shift + semicolon

Increase playback rate

end

Seek to end

beginning

Seek to beginning

Loading Click here to add:

Information on this media

Number of views:

91 (this month: 3)

Creation date:

July 5, 2022

Speakers:

Romain Thomas

License:

CC BY-SA v4

Description

The purpose of this lightning talk is to present executable files formats tricks (ELF and Mach-O)
to prevent static analysis tools (like IDA, BinaryNinja, ...) from working correctly.

While these tricks do not break the execution of the original binary, when they are opened in IDA, BinaryNinja and, Radare2
the code looks obfuscated while only the file format is modified (not the instructions)

These modifications are leveraged by LIEF and the scripts will be published at the end
of the conference with an associated blog post.

Romain Thomas

Romain Thomas is a security engineer working on mobile applications and obfuscated code.

Author of LIEF, a library to parse and manipulate executable file formats (ELF, PE, Mach-O),
he enjoys going back and forth between reverse engineering and tool development to see which part of the process can be automated.

Romain is also interested in iOS, whitebox cryptography and reverse engineering app protocols.
He contributed in the past to the Triton project, especially on de-obfuscation based on symbolic execution.