0

I am interested in software obfuscation techniques. I found your excellent summary of obfuscation in order to avoid (as possible) reverse engineering.

One of the proposed technique you quoted:

Packing and encrypting code segment

I will group encryption and packing into the same category. They both serve the same purpose and they both have the same issues. In order to execute the code, the CPU needs to see the plain text. So you have to provide the key in the binary. The only remotely effective way of encrypting and packing code segments is if you encrypt and decrypt them at functional boundaries and only if the decryption happens upon function entry and then re-encryption happens when leaving the function. This will provide a small barrier against dumping your binary as it is running but is must be coupled with strong obfuscation.

Crypting the code segment is very common for malware writers. I am very intrested on how to encrypt/pack each function separatly: decryption upon function entry and then re-encryption when leaving the function. (These are you words)

Where I can find documention for this technique ?

I find this an excellent idea.

Anyway, thanks !

  • note: I can put a breakpoint right after your function is decrypted and dump it. the fact that it gets decrypted at any point allows me to dump it – rev Aug 22 '15 at 17:00
  • "In order to execute the code, the CPU needs to see the plain text." - Not quite... see white-box cryptography. – Jason Geffner Aug 22 '15 at 17:05
  • @AcidShout Yes I know but I am very intrested on how to implement a such idea. I know that it could be bypassed with breakpoints. I've searched on net for a while but didn't find anything.. – odysseasg Aug 25 '15 at 15:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.