4

VM packers like Code Virtualizer and VMProtect seem challenging to existing reverse engineering work, especially static approach like IDA Pro.

According to this slides

www.hex-rays.com/products/ida/support/ppt/caro_obfuscation.ppt

from Hex-rays, IDA Pro requires experienced reverse engineer to manually recognize the opcode array and understand the semantic, then decode the bytecode array..

I myself use IDA Pro to deal with simple quicksort program using Code Virtualizer, and I can share two pics.

enter image description here

See, I use Code Virtualizer to protect this part and IDA Pro can not go to 0X599050h.

enter image description here

See, the size of relocation section has a significant growth.

So my questions:

  1. Can IDA Pro automatically deal with VM obfuscated binaries?
  2. Any other interesting materials on the state-of-art in this area?

Thank you!

8

Regarding question #1, no IDA does not handle obfuscated binaries.

You might be interested by the Virtual Deofbuscator talk Jason Raber gave at Blackhat last year, he also released an IDA plugin and the source code is available.

  • Yes, I have seen this slides. anyway, thank you! – lllllllllllll Mar 26 '14 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.