zyrox

Zyrox LLVM Obfuscator plugin di compilazione e link-time di llvm per offuscare codice nativo Perché perché no ¯\ツ/¯ Uno dei miei progetti più grandi, in cui ho imparato molto sugli internals di LLVM, formati binari, assembly e tecniche di offuscamento. Credo che imparare costruendo sia il modo...

obfuscation_detection

Obfuscation Detection v2.4 Autor: Tim Blazytko Erkennen Sie automatisch verschleierten Code und andere interessante Codekonstrukte Beschreibung: Obfuscation Detection ist ein Binary-Ninja-Plugin zur Erkennung von verschleiertem Code und interessanten Codekonstrukten z. B. Zustandsautomaten in...

binprotect

Bauanweisungen Siehe 4. Bauen für Bauanweisungen. Inhalt 1. Einleitung 2. Binär-Rewriter 2.1. Relative Adressverfolgung 2.2. Disassemblierung 2.2.1. Basisblock-Aufteilung 2.2.2. Indirekter Kontrollfluss 2.2.2.1. Sprungtabellen 2.2.2.1.1. Begrenzte Sprungtabellen 2.2.2.1.2. Unbegrenzte...

Alcatraz

Alcatraz Alcatraz è un offuscatore binario x64 in grado di offuscare vari file PE, inclusi: .exe .dll .sys Panoramica Alcatraz Requisiti Utilizzo Funzionalità Offuscamento dei movimenti immediati Appiattimento del flusso di controllo Mutazione ADD Offuscamento del punto di ingresso Offuscamento L...

obfuscation_detection

Obfuscation Detection v2.4 Author: Tim Blazytko Automatically detect obfuscated code and other interesting code constructs Description: Obfuscation Detection is a Binary Ninja plugin to detect obfuscated code and interesting code constructs e.g., state machines in binaries. Given a binary, the...

"Digital Camouflage": the LLVM Challenge in LLM-Based Malware Detection

Large Language Models LLMs have emerged as promising tools for malware detection by analyzing code semantics, identifying vulnerabilities, and adapting to evolving threats. However, their reliability under adversarial compiler-level obfuscation is yet to be discovered. In this study, we empirical...

Defeating Compiler-Level Obfuscations Used in APT10 Malware

Summary The Carbon Black Threat Analysis Unit TAU recently analyzed a series of malware samples that utilized compiler-level obfuscations. For example, opaque predicates were applied to Turla mosquito and APT10 ANEL. Another obfuscation, control flow flattening, was applied to APT10 ANEL and Dhar...