PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

ReMASTering Applications by Obfuscating during Compilation

blog.trailofbits.com | blog | #reverse-engineering | #obfuscation | #llvm | #darpa | #compilers | #mast
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Introducing MAST, an LLVM-based obfuscation toolkit: symbol mangling, opaque predicates, code diffusion and environmental keying, inspired by nation-state malware; funded via DARPA Cyber Fast Track.
Published
Collected

Related coverage

research · blog.quarkslab.com
Turning Regular Code Into Atrocities With LLVM: The Return
LLVM obfuscation tutorial, part two: a pass that hides XOR operations by converting operands from base 2 to base 3 before adding them, turning a simple xor into a much harder-to-recognise sequence.
research · blog.quarkslab.com
Turning Regular Code Into Atrocities With LLVM
Hands-on introduction to LLVM bytecode obfuscation: an out-of-tree pass that replaces null literals with a provably-false boolean expression, teaching LLVM pass development basics along the way.
blog · blog.trailofbits.com
Join us at Etsy’s Code as Craft
Trail of Bits' Sophia D'Antoine speaks at Etsy's Code as Craft on iOS security, presenting MAST, a mobile security toolkit adding jailbreak detection, anti-debugging, and anti-reversing via LLVM.
blog · blog.trailofbits.com
Close Encounters with Symbolic Execution (Part 2)
Part 2: how to build KLEE with LLVM 3.2 on Ubuntu 14.04 and use mcsema to symbolically execute a maze-oracle binary — translating it to bitcode and solving all paths with a symbolic-input driver.
blog · blog.trailofbits.com
McSema is Officially Open Source!
McSema is now open source under a BSD license: the framework translates x86 machine code to LLVM bitcode so tools like KLEE can run on existing binaries; development was DARPA-sponsored.
blog · blog.washi.dev
Awaiting the Awaitables - Building the AwaitFuscator
Explores the internals of C# async/await to build AwaitFuscator, an obfuscator that encodes entire programs as long chains of await expressions by abusing custom awaiters and state machines.
Back