0

Metamorphic is a technique to obfuscate a binary and change the opcode sequence and create new samples with same functionality. In my case, I have some elf binary of ARM processor type and their source code is not accessible. Is there any way to obfuscate them and create new samples with same functionality?

1

Is there any ready solution for metamorphing ARM, I don't think so. Is there a way to do metamorphing? Yes, but this should be done during the compilation phase with tools like llvm. It must be done during the compilation, in order to have the full context of what is done by each instruction, and in order to make a really good metamorphing, not some stupid instruction replacement.

4
  • Yes, you are true. Unfortunately I haven't found a ready metamorphing for ARM and llvm is useless for me because I don't access the source codes. I am searching for a generator but it seems there is not generator for my case or I haven't found anything yet!!! What is your idea? Should I do it myself since I need just code replacement? Nov 22 '17 at 13:40
  • You need to have an ideally disassembled code. I.e. asm file made from binary. Which you can recompile back to ELF(or what ever format your code is). After you made this work you can manipulate asm text how you see it fit. Then just recompile it again. I did such thing on x86 binaries. But it took me a week to make a good asm file out of IDA, so that I could compile it again with MASM. Nov 22 '17 at 14:06
  • What is your mean of an ideally disassembled? Can IDA disassembler create an ideally disassembled code or in other words How can ideally disassembled code? Nov 22 '17 at 14:20
  • IDA can give you some disassembled text, but you have to fix it before you can build it with assembler. Main problem is data pointers and constant data structures which point to other constants, you have to find them all and define in IDA before trying to generate asm file. Otherwise they are defined as meaningless bytes and will not be processed by assembler properly. Nov 23 '17 at 8:52

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .