I want to know the difference between stripped binary and obfuscated binary.
1 Answer
Stripped binary is the one that compiled without debugging information [symbols, strings]. For gcc compiler it's -s flag.
Obfuscated binary is the one where developer deliberately chose to make part of it [or all] less readable and harder to analyse/debug/disassemble. Obfuscation can impact:
- code - when author hide some parts of code sections and specific parts of executable code using cryptors/packers/various techniques of code polymorphism etc.
- resources - when author apply various tehnniques of obfuscation (crypto/packing/custom modification) on data (strings, data, configuration etc.)
- complete binary - when external executable/code used to completely hide presence of binary that should be hidden.
-
4Well, actually stripped usually means that the information was removed afterward (which also matches the meaning of "to strip" in English) by means of
strip
orobjcopy
or similar.– 0xC0000022L ♦Sep 4, 2018 at 8:18