New answers tagged

2 votes

x86 - How do I detect virtualized code by looking at the assembly?

That's tricky because obfuscated code often looks similar regardless of whether or not it specifically uses virtualization obfuscation. Most VMs ultimately have a similar high-level structure, as laid ...
user avatar
  • 7,814
0 votes

Guidelines for dealing with obfuscated code

You can press Ctrl+E to select the TLS entry point. see here: https://hex-rays.com/blog/tls-callbacks/
user avatar

Top 50 recent answers are included