Could you please specify in a few words main contemporary deobfuscation techniques which we can apply to 32/64 bit PE files? For example, (1) using instruction templates, such as:

mov edx, 5B1F04F1h
xor edx, 6ADB1F45h
add edx, 0CE3BE450h

Can be convert to:

mov r32, imm32_1
xor r32, imm32_2
add r32, imm32_3

Pack into:

mov r32, (imm32_1 ^ imm32_2 + imm32_3)

And later become:

mov edx, 4h

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.