PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Turning Regular Code Into Atrocities With LLVM: The Return

blog.quarkslab.com | research | #obfuscation | #tutorial | #llvm | #compilers | #programming | #xor
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

LLVM obfuscation tutorial, part two: a pass that hides XOR operations by converting operands from base 2 to base 3 before adding them, turning a simple xor into a much harder-to-recognise sequence.
Published
Collected

Related coverage

research · blog.quarkslab.com
Turning Regular Code Into Atrocities With LLVM
Hands-on introduction to LLVM bytecode obfuscation: an out-of-tree pass that replaces null literals with a provably-false boolean expression, teaching LLVM pass development basics along the way.
research · blog.quarkslab.com
Implementing a Custom Directive Handler in Clang
How-to on implementing a custom #pragma directive handler in clang, used to drive an LLVM-based obfuscator while keeping sources compilable elsewhere; a tour of the preprocessing and parsing stages.
research · blog.quarkslab.com
llvm_dev_meeting:
Report from the 2015 LLVM Developer Meeting: Quarkslab's out-of-tree pass tutorial and a lightning talk on LLVM's limits, plus recaps of talks on WebAssembly, OpenCL and performance tracking.
research · blog.quarkslab.com
goto llvm_dev_meeting;
Announcement: Quarkslab's compiler crew is off to the LLVM Developer Meeting in California, presenting an out-of-tree LLVM pass tutorial and a lightning talk on bytecode obfuscation.
research · blog.quarkslab.com
A glance at compiler internals: Keep my memset
Why Clang/LLVM can delete your memset: tracing llvm.memset through Dead Store Elimination, the risk for code that wipes secrets, and the volatile function-pointer trick that keeps the wipe alive.
research · eshard.com
Obfuscation of Rust code with LLVM
Option 1: Technical & Tutorial Focused (Best for SEO) Learn how to obfuscate Rust code using OLLVM. This guide walks you through rebuilding the Rust LLVM toolchain, building the obfuscator-llvm pass-plugin, and applying transformations like control flow flattening and bogus control flow.
Back