0

I am reverse engineering an program. I encountered a problem where I can't reverse engineer it as the program code is obfuscated. I realised the program is obfuscated thanks to my friend who noticed that the program is obfuscated thanks to him seeing him what IDA showed. My friend is telling me that the program is using virtualization as form of obfuscation.

What can I do to reverse engineer the obfuscated program?

1

If a packer with virtualization is used then code will become obfuscated but for different reason. It will be under virtual machine which will completely destroy the code when trying to load it in IDA.

You should scan the program with programs like DIE, ExeInfo, PEID or similar to determine what packer was used and what version. Then you have to:

  • Devirtualize the VM and dump the program
  • Fix the program (IAT, OEP, etc..)
  • Load fixed program it in IDA\Ghidra and analyze it without any obfuscation\protection.

This is no easy task. Depending on which packer is used and what version, it can be extremely hard to unpack if newer versions of commercial packers were used. If older version of packer was used you can probably find tutorials on how to unpack your target.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.