Attacking Obfuscated Code: Automated Deobfuscation Techniques
Chris Eagle explores attacking obfuscated code: automated deobfuscation techniques at DEF CON 12, examining reverse-engineering and practical defenses.
Summary
Architecture and Background
Chris Eagle explores static and dynamic binary analysis strategies to defeat obfuscated software, covering control flow flattening deconstruction, automated unpacking, dead code elimination, and custom IDA Pro disassembler plugins. Chris Eagle contextualize these mechanics within the broader malware landscape.
Vulnerability Analysis
The technical analysis investigates threat vectors and design shortcomings related to reverse-engineering, deobfuscation, binary-analysis, ida-pro.
Exploitation and Demonstrations
Chris Eagle explores static and dynamic binary analysis strategies to defeat obfuscated software, covering control flow flattening deconstruction, automated unpacking, dead code elimination, and custom IDA Pro disassembler plugins.
Remediation and Defensive Strategies
Defenders and researchers are provided actionable defensive mitigations, monitoring telemetry, and configuration safeguards to minimize systemic risk.
Related talks
Main Stage·52 min
Chris Eagle · Sk3wlDbg
Chris Eagle and Sk3wlDbg demonstrate integrating architecture-independent CPU emulation into IDA Pro to unpack obfuscated malware and trace execution.
Blue Team Village·1 hr
Holger Unterbrink
Demonstrates Dynamic Data Resolver, an IDA Pro plugin leveraging DynamoRIO to unpack and analyze obfuscated malware.
Main Stage·42 min
Atlas
Atlas showcases Symboliks, an intermediate representation and symbolic execution library designed to simplify reverse engineering and automated exploit derivation.