πŸ“’Just published my Maths & CS BSc thesis:
πŸ“„"Code deobfuscation by program synthesis-aided simplification of Mixed Boolean-Arithmetic expressions".

Serves as an intro/review to:
- Code (de)obfuscation
- MBA expressions
- Program synthesis

πŸ‘‰github.com/arnaugamez/tfg Cover of the thesis documentAbstract of the thesis
First @radareorg r2syntia prototype was developed in the context of this work. Now it has already been slightly improved and it is being updated and maintained here, in case you are interested: github.com/arnaugamez/r2s…
There is nothing really new (a part form r2syntia) but I would be glad if this "synthesis" work (pun intended) serves as a first step into the field of code (de)obfuscation and motivates the study of MBA expressions and program synthesis to help in further low-level research.
I will also present some of this work at my upcoming talk during @HITBSecConf #HITBLockdown002 if you want to get a quick review of it, be sure not to miss it!
Last but not least, this thesis couldn't have been possible without the (amazing and inspiring) previous work done by great researchers like: @RolfRolles, @mr_phrazer, Ninon Eyrolles, @werewtk (++ at @quarkslab) and many others. I want to publicly thank them here.

β€’ β€’ β€’

Missing some Tweet in this thread? You can try to force a refresh
γ€€

Keep Current with Arnau

Arnau Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @arnaugamez

22 Apr
Ok, I had some time to read the new paper on MBA deobfuscation: usenix.org/conference/use…

TL;DR Cool stuff and great contribution, but tarnished by some omissions that make it seem to have a bigger impact and general applicability than it really has, imho.

A thread 🧡
First things first. I don't consider myself an expert, but I'm quite familiar with academic literature regarding MBA (de)obfuscation. This paper constitutes great research, provides a novel proof and offers promising results.
That being said, I think it is necessary to point out some omissions, limitations and/or formal inaccuracies that might not be obvious if one is not familiar with MBA literature. I'll use excerpts from my thesis () and literature to clarify some ideas.
Read 25 tweets
1 Dec 20
πŸ”₯ #AdventOfReversing 1/24 πŸ”₯
Get dirty as soon as possible. Don't fall into thinking you are not ready. Sure, you will be confused by many things at first. That's fine! I used to confuse sections and segments when I started. Keep pushing, and things will become clear naturally.
πŸ”₯ #AdventOfReversing 2/24 πŸ”₯
Get used to (re)name *everything* in your disassembler. You might be able to mentally track data across registers and memory for small crackmes w/ easy control flow, but this does not scale at all. Unclutter your mind. Make your life easier.
πŸ”₯ #AdventOfReversing 3/24 πŸ”₯
You really want to have some programming foundations, but which languages? I mostly agree with this post by @MalwareTechBlog:

🐍 Python
πŸ—οΈ C
βš™οΈ ASM (different flavors: x86(-64) desktop, ARM mobile...)

Give it a read! πŸ“°
malwaretech.com/2018/03/best-p…
Read 19 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

:(