Indirect Branch Obfuscation with LLVM — Building and Removing It
Indirect branch obfuscation with LLVM, replacing direct branches with indirect jumps to break static control-flow analysis of compiled binaries, and the internals laid out in detail.
Tag: obfuscation
Graph-Topology Software Watermarking with LLVM — Part 1: Leaf Node Injection and Locating
Graph-topology software watermarking with LLVM, part one: embedding watermarks in a program's control-flow graph to track piracy, with every step broken down clearly.
De-obfuscating ZKM Control-Flow Flattening with ASM
De-obfuscating ZKM control-flow flattening with ASM, using bytecode rewriting to reconstruct the original Java control flow and logic, with the tools and offsets documented.
Writing and Removing LLVM Bogus Control Flow
Writing and removing LLVM bogus control flow, showing how the pass inserts junk blocks and opaque predicates, then how to strip them back out, and the mechanism explained clearly.
VMProtect 3.8.1 Obfuscation Strategies Explained
VMProtect 3.8.1 obfuscation strategies, cataloging the transformation techniques it applies to protected code and how each complicates analysis, and the gotchas flagged along the way.
A General Methodology for Reversing Deeply Obfuscated Modified MD5
Reversing a deeply obfuscated modified MD5, cutting through the obfuscation to recover a custom variant of the hash function and its constants, with the analysis method shown end to end.
Analyzing and Deobfuscating Polaris's BogusControlFlow Pass - Detecting Opaque Predicates with angr
Analyzing and deobfuscating Polaris's BogusControlFlow pass, using angr to detect opaque predicates and strip the bogus control flow, and the internals laid out in detail.
Building an Open-Source ARM64 VMP from Scratch: Virtualizing All 121 A64 Base Instructions
Building an open-source ARM64 VMP from scratch, virtualizing all 121 A64 base instructions to create a custom VM-based protector, so you can reproduce it yourself.
Reversing the MSVC Compiler: IL Emission and the Warbird Obfuscation Interface
Reversing MSVC compiler IL emission and Warbird obfuscation, tracing how the compiler transforms code into its internal representation, and the internals laid out in detail.
Three Ways to Protect Android Native Libraries - Function Encryption, Program Header Obfuscation, and a Custom ELF Format
Three ways to protect Android native libraries: function encryption, program-header obfuscation, and a custom ELF format, compared and explained, with the tools and offsets documented.
An OLLVM Survival Guide: Building, Understanding, and Defeating Control-Flow Obfuscation
An OLLVM survival guide, collecting practical techniques for navigating flattened control flow, bogus blocks, and instruction substitution, and the bypass logic broken down.
Reversing OLLVM's Control-Flow Flattening With IDA Python
Reversing OLLVM control-flow flattening, reconstructing the original control flow from the dispatcher loop, state variable, and jump tables, and the code traced down to the core.
Reconstructing a Dex VMP: From Trace Capture to Opcode Recovery
Reconstructing a DEX VMP from trace capture to opcode recovery, walking the full path from virtualized bytecode back into readable smali you can analyze.
Software Protection, Explained: From Application Packing to Algorithm Protection
A survey of software protection from application packing and code encryption to algorithm-level protection, explaining the full landscape and how each layer actually defends a binary.
Obfuscation Pass Analysis — Flattening
Analyzing the control-flow flattening obfuscation pass, explaining how it breaks the CFG into a dispatcher loop and what it looks like in decompiled code.
Hikari Source Analysis — AntiClassDump
Source analysis of Hikari's AntiClassDump LLVM pass, showing how it rewrites Objective-C method lists to defeat class-dump tooling entirely, with every step broken down clearly.
Deobfuscating libDexHelper.so: Inside an Enterprise Android Shell
Deobfuscating libDexHelper.so inside an enterprise Android shell, defeating its junk instructions, string encryption, and VMP layer with Unicorn and Frida.