PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Symbolic Deobfuscation: From Virtualized Code Back to the Original (DIMVA 2018)

blog.quarkslab.com | research | #virtualization | #research | #program-analysis | #symbolic-execution | #triton | #deobfuscation
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A micro-post on joint research with CEA and VERIMAG (DIMVA 2018): symbolically deobfuscating virtualized hash functions by tainting VM inputs and concretizing unrelated instructions.
Published
Collected

Related coverage

research · blog.quarkslab.com
Triton v0.8 and ARMv7: A Guideline for Adding New Architectures
A follow-up to the Triton v0.8 release explaining how ARMv7 support was added to the symbolic execution framework and outlining a guideline for integrating new architectures.
research · blog.quarkslab.com
Triton v0.8 is Released!
Triton v0.8 is released under Apache 2.0, bringing bug fixes and features: implicit concretization, new path predicate APIs, ARMv7 support and more, highlighted from a large changelog.
research · blog.quarkslab.com
PhD Defense of Jonathan Salwan: Use of Symbolic Execution for Binary Deobfuscation
Announcement of Jonathan Salwan's PhD defense on using symbolic execution for binary deobfuscation, including the thesis abstract on opaque predicate detection and devirtualization approaches.
research · blog.quarkslab.com
Mistreating Triton
Experiments that mistreat the Triton concolic-execution framework with forged C programs: unsupported vector instructions, orchestrated forks and inflated path counts to challenge its CFG recovery.
research · blog.quarkslab.com
QBDI vs TritonDSE against a VM: who will be the fastest?
Quarkslab solves a custom-VM CTF challenge twice — with symbolic execution engine TritonDSE and instrumentation framework QBDI — and compares which approach gets to the solution fastest.
research · blog.quarkslab.com
PASTIS For The Win!
PASTIS, a Quarkslab framework combining grey-box and white-box fuzzing, won a Google-sponsored SBFT bug-discovery competition and is released as open source under Apache 2.0.
Back