PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Turning Regular Code Into Atrocities With LLVM

blog.quarkslab.com | research | #obfuscation | #tutorial | #llvm | #compilers | #bytecode
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Hands-on introduction to LLVM bytecode obfuscation: an out-of-tree pass that replaces null literals with a provably-false boolean expression, teaching LLVM pass development basics along the way.
Published
Collected

Related coverage

research · blog.quarkslab.com
goto llvm_dev_meeting;
Announcement: Quarkslab's compiler crew is off to the LLVM Developer Meeting in California, presenting an out-of-tree LLVM pass tutorial and a lightning talk on bytecode obfuscation.
research · blog.quarkslab.com
Turning Regular Code Into Atrocities With LLVM: The Return
LLVM obfuscation tutorial, part two: a pass that hides XOR operations by converting operands from base 2 to base 3 before adding them, turning a simple xor into a much harder-to-recognise sequence.
research · blog.quarkslab.com
Obfuscating Java bytecode with LLVM and Epona
An internship project testing whether Java bytecode can be round-tripped through LLVM IR to reuse Epona's opt-in obfuscation passes; covers the approach, advantages, limitations and examples.
research · blog.quarkslab.com
Implementing a Custom Directive Handler in Clang
How-to on implementing a custom #pragma directive handler in clang, used to drive an LLVM-based obfuscator while keeping sources compilable elsewhere; a tour of the preprocessing and parsing stages.
research · blog.quarkslab.com
llvm_dev_meeting:
Report from the 2015 LLVM Developer Meeting: Quarkslab's out-of-tree pass tutorial and a lightning talk on LLVM's limits, plus recaps of talks on WebAssembly, OpenCL and performance tracking.
research · blog.quarkslab.com
A glance at compiler internals: Keep my memset
Why Clang/LLVM can delete your memset: tracing llvm.memset through Dead Store Elimination, the risk for code that wipes secrets, and the volatile function-pointer trick that keeps the wipe alive.
Back