search

gwen001 / offsectools_www

A vast collection of security tools and resources curated by the community.
https://offsec.tools
180 stars 21 forks source link

[addtool] demovfuscator #1328

Closed gwen001 closed 1 year ago

gwen001 commented 1 year ago

[tags]obfuscation,binaries,compiler[/tags] [short_descr]A work-in-progress deobfuscator for movfuscated binaries.[/short_descr] [link] https://github.com/leetonidas/demovfuscator [/link] [long_descr] This tool constitutes a generic way of recovering the control flow of the original program from movfuscated binaries. As our approach makes zero assumptions about register allocations or a particular instruction order, but rather adheres to the high-level invariants that each movfuscated binary needs to conform to, our demovfuscator is also not affected by the proposed hardening techniques such as register renaming and instruction reordering. To achieve this, we use a combination of static taint analysis on the movfuscated code and a satisfiable modulo theory (SMT) solver. We successfully used our demovfuscator against several movfuscated binaries that emerged during several CTFs during the last months (Hackover CTF and 0CTF) proving that it already can handle real-world binaries that were not created by us. [/long_descr] [image] https://raw.githubusercontent.com/gwen001/offsectools_www/main/tmp/c3b495b190d8c1e6d3d429c2719d09dc.png [/image] [image] https://raw.githubusercontent.com/gwen001/offsectools_www/main/tmp/5fdf4a7bbc4459590570cc945a01c886.png [/image]

gwen001 commented 1 year ago

Issue correctly handled, tool is waiting for human validation.

gwen001 commented 1 year ago

Tool has been accepted by the team: https://offsec.tools/tool/demovfuscator

Thank you for your contribution!