Has anyone a resource for unobfuscating and hence making decompilation practical for the output of the movfuscator?
Quote:
|
https://github.com/xoreaxeaxeax/movfuscator
|
Quote:
The M/o/Vfuscator (short 'o', sounds like "mobfuscator") compiles programs into "mov" instructions, and only "mov" instructions. Arithmetic, comparisons, jumps, function calls, and everything else a program needs are all performed through mov operations; there is no self-modifying code, no transport-triggered calculation, and no other form of non-mov cheating.
The basic effects of the process can be seen in overview, which illustates compiling a simple prime number function with gcc and the M/o/Vfuscator.
|
Inspired by "mov is Turing-complete" by Stephen Dolan
Quote:
|
Finding Turing-completeness in unlikely places has long been a pastime of bored computer scientists.
|
Quote:
|
Removing all but the mov instruction from future iterations of the x86 architecture would have many advantages: the instruction format would be greatly simplified, the expensive decode unit would become much cheaper, and silicon currently used for complex functional units could be repurposed as even more cache. As long as someone else implements the compiler.
|
Quote:
|
http://www.cl.cam.ac.uk/~sd601/papers/mov.pdf
|
It is an interesting topic since it looks like obfuscation is ahead of deobfuscation and quite significantly given this and other AES based schemes out there.