Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I am reverse engineering an program. I encountered a problem where I can't reverse engineer it as the program code is obfuscated. I realised the program is obfuscated thanks to my friend who noticed that the program is obfuscated thanks to him seeing him what IDA showed. My friend is telling me that the program is using virtualization as form of obfuscation.
What can I do to reverse engineer the obfuscated program?
If a packer with virtualization is used then code will become obfuscated but for different reason. It will be under virtual machine which will completely destroy the code when trying to load it in IDA.
You should scan the program with programs like DIE, ExeInfo, PEID or similar to determine what packer was used and what version. Then you have to:
This is no easy task. Depending on which packer is used and what version, it can be extremely hard to unpack if newer versions of commercial packers were used. If older version of packer was used you can probably find tutorials on how to unpack your target.
