LLVM-powered devirtualization
This work was carried out during an internship at Thalium on the subject of deobfuscation of virtualized binaries.ContextObfuscation is the process of deliberately making code difficult to understand in order to hinder its analysis. It is often used in malware to conceal malicious intent and avoid detection.Various binary obfuscation strategies exist today, including:Removing comments / symbolsAdding opaque predicates (branches on a constant condition)Control flow flatteningVirtualizationVirtual...
Read more at blog.thalium.re