Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Solving BinaryShield VM Crackme by ra1n

blog.washi.dev | blog | #windows | #reverse-engineering | #obfuscation | #crackme | #virtual-machine | #devirtualization

Summary

A walkthrough of solving ra1n's BinaryShield crackme, featuring a custom virtual-machine obfuscation: building a disassembler, reversing opcode handlers, devirtualizing the code and solving it.
Published
Collected

original ↗

Related coverage

blog · projectzero.google
Using Binary Diffing to Discover Windows Kernel Memory Disclosure Bugs
A Project Zero post on using binary patch diffing to uncover Windows kernel memory disclosure bugs, including methodology, tooling, and notable findings from this approach.
blog · netspi.com
Java Obfuscation Tutorial with Zelix Klassmaster
Java and .NET binaries decompile trivially unless obfuscated. The post covers name renaming, string encryption, and control flow obfuscation, with a short Zelix Klassmaster tutorial.
blog · blog.washi.dev
Awaiting the Awaitables - Building the AwaitFuscator
Explores the internals of C# async/await to build AwaitFuscator, an obfuscator that encodes entire programs as long chains of await expressions by abusing custom awaiters and state machines.
blog · blog.washi.dev
On the recent VMProtect leaks and why it is a bad thing
An opinion piece arguing that the leak of VMProtect's source code, though tempting for learners, ultimately harms the reverse-engineering community, and how to handle leaked proprietary code.
blog · blog.washi.dev
Breaking Javascript with Python Pickles (Solving brinebid in DEFCON CTF Qualifiers 2023)
A DEFCON CTF Quals 2023 write-up for 'brinebid': combining a Python pickle-based client, a JavaScript VM server and a VM vulnerability to achieve arbitrary code execution and capture the flag.
blog · blog.washi.dev
Confusing .NET Debuggers: Proxy Objects
Explores proxy objects as an anti-analysis technique: using implicit operators, obfuscated names and custom display formatters to hide sensitive data from .NET debuggers like dnSpy.
back