PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Obfuscation vs the Optimizer: An LLVM Middle-End Arms Race

blog.quarkslab.com | research | #reverse-engineering | #obfuscation | #llvm | #clang | #software-protection | #compiler-optimization
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A Quarkslab post on the tug-of-war between obfuscators and compiler optimizers: through LLVM's middle-end IR and passes, it shows how a single upstream commit can unravel an obfuscation.
Published
Collected

Related coverage

research · blog.quarkslab.com
Clang Hardening Cheat Sheet - Ten Years Later
Quarkslab updates its Clang Hardening Cheat Sheet a decade later with OpenSSF-recommended flags and newer mitigations against memory corruption, ROP/JOP and speculative execution attacks.
research · blog.quarkslab.com
Global Dead Code Elimination for LLVM, revisited
A giant function with millions of instructions exposes quadratic behavior in LLVM's Global Dead Code Elimination pass, found while building an LLVM-based obfuscator; the post digs into the algorithm.
research · blog.quarkslab.com
Implementing a Custom Directive Handler in Clang
How-to on implementing a custom #pragma directive handler in clang, used to drive an LLVM-based obfuscator while keeping sources compilable elsewhere; a tour of the preprocessing and parsing stages.
research · blog.quarkslab.com
Turning Regular Code Into Atrocities With LLVM: The Return
LLVM obfuscation tutorial, part two: a pass that hides XOR operations by converting operands from base 2 to base 3 before adding them, turning a simple xor into a much harder-to-recognise sequence.
research · blog.quarkslab.com
Turning Regular Code Into Atrocities With LLVM
Hands-on introduction to LLVM bytecode obfuscation: an out-of-tree pass that replaces null literals with a provably-false boolean expression, teaching LLVM pass development basics along the way.
research · blog.quarkslab.com
SCAF - Source Code Analysis Framework based on Clang - Pre-alpha preview
A preview of SCAF, a Clang-based source code analysis framework: a Python API and GUI that store ASTs and metadata in a shared database, plus a make-process hook for accurate build context.
Back