News Score: Score the News, Sort the News, Rewrite the Headlines

LLVM-powered devirtualization

This work was carried out during an internship at Thalium on the subject of deobfuscation of virtualized binaries.ContextObfuscation is the process of deliberately making code difficult to understand in order to hinder its analysis. It is often used in malware to conceal malicious intent and avoid detection.Various binary obfuscation strategies exist today, including:Removing comments / symbolsAdding opaque predicates (branches on a constant condition)Control flow flatteningVirtualizationVirtual...

Read more at blog.thalium.re

© News Score  score the news, sort the news, rewrite the headlines