PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

PhD defense of Ninon Eyrolles: Obfuscation with Mixed Boolean-Arithmetic Expressions: Reconstruction, Analysis and Simplification Tools

blog.quarkslab.com | research | #obfuscation | #mba | #program-analysis | #quarkslab | #deobfuscation | #phd
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Ninon Eyrolles' PhD defense on Mixed Boolean-Arithmetic obfuscation: reconstructing an MBA implementation, defining simplicity metrics, and building two tools that simplify published MBA samples.
Published
Collected

Related coverage

research · blog.quarkslab.com
PhD Defense of Jonathan Salwan: Use of Symbolic Execution for Binary Deobfuscation
Announcement of Jonathan Salwan's PhD defense on using symbolic execution for binary deobfuscation, including the thesis abstract on opaque predicate detection and devirtualization approaches.
research · blog.quarkslab.com
What theoretical tools are needed to simplify MBA expressions?
Why Mixed Boolean-Arithmetic (MBA) expressions are hard to de-obfuscate: the maths behind expressions that mix arithmetic and bitwise operators, and the theoretical tools needed to simplify them.
research · blog.quarkslab.com
Defeating AI-Assisted Reverse Engineering (or at Least Trying To)
This coverage gives security teams current context for monitoring, validation, and remediation.
research · blog.quarkslab.com
Symbolic Deobfuscation: From Virtualized Code Back to the Original (DIMVA 2018)
A micro-post on joint research with CEA and VERIMAG (DIMVA 2018): symbolically deobfuscating virtualized hash functions by tainting VM inputs and concretizing unrelated instructions.
research · blog.quarkslab.com
Arybo: cleaning obfuscation by playing with mixed boolean and arithmetic operations
Introducing Arybo, a Python module wrapping a native library for understanding, creating and simplifying Mixed Boolean-Arithmetic expressions, aiding de-obfuscation of protected code.
research · blog.quarkslab.com
Deobfuscation: recovering an OLLVM-protected program
Quarkslab breaks the protections of Obfuscator-LLVM (LLVM 3.5) on a sample function, stripping control-flow flattening and the other layers one by one with the Miasm reverse-engineering framework.
Back