denuvo-ref/r2con2021_deobfuscation
1
0
Fork 0
mirror of https://github.com/mrphrazer/r2con2021_deobfuscation synced 2026-08-17 18:26:03 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
No description
9 commits 1 branch 0 tags 326 KiB
Find a file
Exact
Tim Blazytko 2391a7ccaa
Merge pull request #1 from Fare9/main 
Added vm tracer
2021-10-20 16:26:53 +02:00
miasm@5522eb059a added miasm as submodule 2021-09-30 00:13:07 +02:00
samples added samples and scripts 2021-09-29 23:52:04 +02:00
tracer Added vm tracer 2021-10-11 00:40:57 +02:00
.gitignore Initial commit 2021-09-19 17:37:14 +02:00
.gitmodules added miasm as submodule 2021-09-30 00:13:07 +02:00
follow_execution_flow.py added samples and scripts 2021-09-29 23:52:04 +02:00
LICENSE Initial commit 2021-09-19 17:37:14 +02:00
README.md added link to recording 2021-09-30 21:55:16 +02:00
slides.pdf added slides 2021-09-30 21:22:19 +02:00
symbolic_execution.py added samples and scripts 2021-09-29 23:52:04 +02:00
vm_disassembler.py added samples and scripts 2021-09-29 23:52:04 +02:00
vm_disassembler_final.py added samples and scripts 2021-09-29 23:52:04 +02:00

README.md

Analysis of Virtualization-based Obfuscation

This repository contains slides, samples and code of the 4h code deobfuscation workshop at r2con2021. We give a brief introduction into virtualization-based obfuscation and manually analyze a simple VM generated by Tigress. Afterward, we use symbolic execution to automate the analysis and write a dynamic VM disassembler that is based on Miasm.

The recording is available here.

Installation

# on debian/ubuntu based systems:
sudo apt-get install python-dev

# clone repository and init submodules
git clone https://github.com/mrphrazer/r2con2021_deobfuscation.git
cd r2con2021_deobfuscation
git submodule update --init --rebase --recursive

# install miasm
cd miasm
pip install -r requirements.txt
pip install .
cd ..

Contact

For more information, contact Tim Blazytko (@mr_phrazer).