|
The movfuscator and its variations are mostly broken. For instance, have a look at this talk:
description: https://recon.cx/2016/talks/%22Movfuscator-Be-Gone.html
video: https://www.youtube.com/watch?v=d_R8i0dVBsQ
code: https://github.com/kirschju/demovfuscator
thesis/writeup: https://kirschju.re/static/ba_jonischkeit_2016.pdf
Others have broken the movfucator earlier: https://twitter.com/tathanhdinh/status/634165703558434816
Symbolic execution is also quite successful on these kind of obfuscations. If you mix it with some taint analysis, there should not be much left. For a great work for generic obfuscation have a look at https://www.cs.arizona.edu/people/debray/Publications/generic-deobf.pdf .
Last edited by t3xc0d3; 12-08-2016 at 18:28.
|