PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

PhD Defense of Jonathan Salwan: Use of Symbolic Execution for Binary Deobfuscation

blog.quarkslab.com | research | #reverse-engineering | #program-analysis | #symbolic-execution | #deobfuscation | #phd | #thesis
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Announcement of Jonathan Salwan's PhD defense on using symbolic execution for binary deobfuscation, including the thesis abstract on opaque predicate detection and devirtualization approaches.
Published
Collected

Related coverage

research · blog.quarkslab.com
Symbolic Deobfuscation: From Virtualized Code Back to the Original (DIMVA 2018)
A micro-post on joint research with CEA and VERIMAG (DIMVA 2018): symbolically deobfuscating virtualized hash functions by tainting VM inputs and concretizing unrelated instructions.
research · blog.quarkslab.com
PhD defense of Ninon Eyrolles: Obfuscation with Mixed Boolean-Arithmetic Expressions: Reconstruction, Analysis and Simplification Tools
Ninon Eyrolles' PhD defense on Mixed Boolean-Arithmetic obfuscation: reconstructing an MBA implementation, defining simplicity metrics, and building two tools that simplify published MBA samples.
research · blog.quarkslab.com
Triton v0.8 and ARMv7: A Guideline for Adding New Architectures
A follow-up to the Triton v0.8 release explaining how ARMv7 support was added to the symbolic execution framework and outlining a guideline for integrating new architectures.
research · blog.quarkslab.com
Triton v0.8 is Released!
Triton v0.8 is released under Apache 2.0, bringing bug fixes and features: implicit concretization, new path predicate APIs, ARMv7 support and more, highlighted from a large changelog.
research · blog.quarkslab.com
Mistreating Triton
Experiments that mistreat the Triton concolic-execution framework with forged C programs: unsupported vector instructions, orchestrated forks and inflated path counts to challenge its CFG recovery.
research · blog.quarkslab.com
Arybo: cleaning obfuscation by playing with mixed boolean and arithmetic operations
Introducing Arybo, a Python module wrapping a native library for understanding, creating and simplifying Mixed Boolean-Arithmetic expressions, aiding de-obfuscation of protected code.
Back