1

Could you please specify in a few words main contemporary deobfuscation techniques which we can apply to 32/64 bit PE files? For example, (1) using instruction templates, such as:

mov edx, 5B1F04F1h
xor edx, 6ADB1F45h
add edx, 0CE3BE450h

Can be convert to:

mov r32, imm32_1
xor r32, imm32_2
add r32, imm32_3

Pack into:

mov r32, (imm32_1 ^ imm32_2 + imm32_3)

And later become:

mov edx, 4h

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.