Binary Obfuscation from the Top Down
Sean Taylor explores binary obfuscation from the top down at DEF CON 17, examining malware-analysis and practical defenses.
Summary
Architecture and Background
Binary Obfuscation from the Top-Down: Obfuscating Executables Without Writing Assembly Sean "Frank^2" Taylor Security Engineer, Rapid7 Binary obfuscation is commonly applied in malware and by software vendors in order to frustrate the efforts of reverse engineers to understand the underlying code. A common misconception is one must be a master of assembly in order to properly obfuscate a binary.
Vulnerability Analysis
However, with knowledge of compiler optimizations and certain keywords, one can frustratingly obfuscate their binary simply by writing specifically crafted high-level code. This talk will attempt to teach an array of methods that can be employed to obfuscate a binary as it is compiled rather than afterward.
Exploitation and Demonstrations
Knowledge of C/C++ is the only prerequisite for this talk. Sean Taylor is a candidate for a BS in Computer Science at Cal Poly Pomona.
Remediation and Defensive Strategies
In his spare time he can be found trying to take apart various pieces of malware or tinkering with a personal project. He is one of the architects of TwatFS-- the Twitter file system-- created by DC949 and has helped develop other (perhaps questionable) tools for Twitter. For copies of the slides and additional materials please see the DEF CON 17 Archive here:
Related talks
Main Stage·20 min
Summit Siddharth
Summit Siddharth explores the making of the second sql injection worm at DEF CON 17, examining malware-analysis and practical defenses.
Main Stage·42 min
Nick Harbour
Nick Harbour explores win at reversing tracing and sandboxing through inline hooking at DEF CON 17, examining malware-analysis and practical defenses.
Main Stage·20 min
Marion Marschalek
Marion Marschalek explores a thorny piece of malware and me at DEF CON 21, examining malware-analysis and practical defenses.