PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Malware development part 6 - advanced obfuscation with LLVM and template metaprogramming

0xpat.github.io | blog | #red-team | #obfuscation | #llvm | #malware-development | #anti-analysis | #template-metaprogramming
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Malware development part 6: anti-disassembly obfuscation with Obfuscator-LLVM—how IR-level transforms and template metaprogramming hide control flow, plus the VS2017 build setup.
Published
Collected

Related coverage

blog · 0xpat.github.io
Malware development part 4 - anti static analysis tricks
Malware dev part 4: Visual Studio compiler and linker settings as evasion—custom msvcrt.lib builds that shrink payloads to ~4 KB, optimization flags, and obfuscation for static-analysis resistance.
blog · 0xpat.github.io
Malware development part 2 - anti dynamic analysis & sandboxes
Malware dev part 2: sandbox and VM detection for dynamic-analysis evasion—fingerprinting limited resources, indicative device names and artifacts to tell real hosts from analysis environments.
blog · blog.washi.dev
Confusing .NET Debuggers: Proxy Objects
Explores proxy objects as an anti-analysis technique: using implicit operators, obfuscated names and custom display formatters to hide sensitive data from .NET debuggers like dnSpy.
research · blog.quarkslab.com
Turning Regular Code Into Atrocities With LLVM: The Return
LLVM obfuscation tutorial, part two: a pass that hides XOR operations by converting operands from base 2 to base 3 before adding them, turning a simple xor into a much harder-to-recognise sequence.
research · blog.quarkslab.com
Turning Regular Code Into Atrocities With LLVM
Hands-on introduction to LLVM bytecode obfuscation: an out-of-tree pass that replaces null literals with a provably-false boolean expression, teaching LLVM pass development basics along the way.
research · eshard.com
Obfuscation of Rust code with LLVM
Option 1: Technical & Tutorial Focused (Best for SEO) Learn how to obfuscate Rust code using OLLVM. This guide walks you through rebuilding the Rust LLVM toolchain, building the obfuscator-llvm pass-plugin, and applying transformations like control flow flattening and bogus control flow.
Back