Why disassemble multi-thread binary is hard? I also know that some obfuscation techniques are to create unnecessary threads. But why reverse engineering multi-thread program is hard.


The technique you are referring to is called 'nanomites'. I would advise you the reading of this article as a full example of reverse of a nanomite crack-me.

Never the less, the problem of multi-thread or multi-process reverse-engineering is that in place of one sequence of events (with only one program), you have to follow in parallel multiple programs that interact (possibly in a non-deterministic way) with each others. It raise up exponentially the complexity of the reverse-engineering process.


This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .