Thread: Obfuscate code
View Single Post
  #4  
Old 11-30-2013, 21:18
sendersu sendersu is offline
VIP
 
Join Date: Oct 2010
Posts: 1,305
Rept. Given: 337
Rept. Rcvd 237 Times in 127 Posts
Thanks Given: 340
Thanks Rcvd at 652 Times in 357 Posts
sendersu Reputation: 200-299 sendersu Reputation: 200-299 sendersu Reputation: 200-299
The subject is not wellcovered by tools, so you could even write yourself one

some materials...
https://www.hex-rays.com/products/ida/support/ppt/caro_obfuscation.ppt
http://recon.cx/2008/a/eric_d_lapse/Deobfuscator_RECON2008.ppt

optimice Deobfuscation plugin for IDA
http://code.google.com/p/optimice/

Simple Deobfuscation of Code Transformation
http://hooked-on-mnemonics.blogspot.com/2012/10/simple-deobfuscation-of-code.html

IDA Plugin deofuscator plugin
http://www.openrce.org/forums/posts/1915

Ariadne Deobfuscation Technology (IDA/Olly plugins)
http://ariadne.group-ib.ru/en/about
or here http://www.woodmann.com/collaborative/tools/index.php/Ariadne

Attacking Obfuscated code with Ida Pro
http://www.blackhat.com/presentations/bh-usa-04/bh-us-04-eagle.pdf

Code doctor plugin has some deobfuscating features
http://www.woodmann.com/collaborative/tools/index.php/CodeDoctor


lots of cool IDA plugins coudl be found in contests by years
https://www.hex-rays.com/contests/index.shtml

......
Reply With Quote