π’Just published my Maths & CS BSc thesis:
π"Code deobfuscation by program synthesis-aided simplification of Mixed Boolean-Arithmetic expressions".
Serves as an intro/review to:
- Code (de)obfuscation
- MBA expressions
- Program synthesis
First @radareorg r2syntia prototype was developed in the context of this work. Now it has already been slightly improved and it is being updated and maintained here, in case you are interested: github.com/arnaugamez/r2sβ¦
There is nothing really new (a part form r2syntia) but I would be glad if this "synthesis" work (pun intended) serves as a first step into the field of code (de)obfuscation and motivates the study of MBA expressions and program synthesis to help in further low-level research.
I will also present some of this work at my upcoming talk during @HITBSecConf#HITBLockdown002 if you want to get a quick review of it, be sure not to miss it!
Last but not least, this thesis couldn't have been possible without the (amazing and inspiring) previous work done by great researchers like: @RolfRolles, @mr_phrazer, Ninon Eyrolles, @werewtk (++ at @quarkslab) and many others. I want to publicly thank them here.
β’ β’ β’
Missing some Tweet in this thread? You can try to
force a refresh
TL;DR Cool stuff and great contribution, but tarnished by some omissions that make it seem to have a bigger impact and general applicability than it really has, imho.
A thread π§΅
First things first. I don't consider myself an expert, but I'm quite familiar with academic literature regarding MBA (de)obfuscation. This paper constitutes great research, provides a novel proof and offers promising results.
That being said, I think it is necessary to point out some omissions, limitations and/or formal inaccuracies that might not be obvious if one is not familiar with MBA literature. I'll use excerpts from my thesis (
π₯ #AdventOfReversing 1/24 π₯
Get dirty as soon as possible. Don't fall into thinking you are not ready. Sure, you will be confused by many things at first. That's fine! I used to confuse sections and segments when I started. Keep pushing, and things will become clear naturally.
π₯ #AdventOfReversing 2/24 π₯
Get used to (re)name *everything* in your disassembler. You might be able to mentally track data across registers and memory for small crackmes w/ easy control flow, but this does not scale at all. Unclutter your mind. Make your life easier.
π₯ #AdventOfReversing 3/24 π₯
You really want to have some programming foundations, but which languages? I mostly agree with this post by @MalwareTechBlog:
π Python
ποΈ C
βοΈ ASM (different flavors: x86(-64) desktop, ARM mobile...)