Oct 30, 2023 · 6 min read · If you've been reversing x86/x64 for a while then you will have definitely come across functions that end like this: We know two things here: The RET/RETN opcode in x86/x64 pops the stack and jumps to that address The PUSH before the return here i...
Join discussionAug 18, 2023 · 8 min read · I was really really excited when Open Obfuscator was launched. I've enjoyed the challenges that application obfuscation have given us over the years, and it was fun to find a well documented and open source obfuscator that we could play with and try ...
Join discussionAug 3, 2023 · 9 min read · If you've been reversing for a while then eventually you'll come up against a control flow graph that looks like this: This is a simple toy app hosted at https://github.com/samrussell/cff_playground if you feel like following along at home. The plug...
Join discussionNov 18, 2022 · 17 min read · I've started looking into the Adylkuzz malware, as mentioned by Tim Blazytko in his article on Automated Detection of Obfuscated Code. Initial analysis shows a TLS entry handler that dumps us straight into a VMProtect VMEnter() function, that looks l...
Join discussionNov 11, 2022 · 6 min read · Hashing function names slows down reversers It's common for packed and otherwise obfuscated binaries to effectively user their own shellcode to populate the imports that they plan to use. This does two things: It hides imports from the reverser that...
Join discussionOct 27, 2022 · 10 min read · Carrying on from the previous article, we can take the first of the tigress challenges and finesse it so the VM parser shows up nicely as a big switch/case statement and we can unpick what all the VM handlers do. The next step is to translate the VM ...
Join discussionJul 15, 2022 · 4 min read · I've recently started reversing some of the Tigress obfuscator challenges, and I decided to use this to test out some of the functionality in Binary Ninja. One of the keys to reversing a virtualization obfuscator is identifying the control loop where...
Join discussion