Why disassemble multi-thread binary is hard? I also know that some obfuscation techniques are to create unnecessary threads. But why reverse engineering multi-thread program is hard.


The technique you are referring to is called 'nanomites'. I would advise you the reading of this article as a full example of reverse of a nanomite crack-me.

Never the less, the problem of multi-thread or multi-process reverse-engineering is that in place of one sequence of events (with only one program), you have to follow in parallel multiple programs that interact (possibly in a non-deterministic way) with each others. It raise up exponentially the complexity of the reverse-engineering process.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.