Title :
Deobfuscator: An Automated Approach to the Identification and Removal of Code Obfuscation
Author :
Raber, Jason ; Laspe, Eric
Abstract :
The Deobfuscator is an IDA Pro plug-in that neutralizes anti-disassembly code and transforms obfuscated code to simplified code in the actual binary. This plug-in is used in conjunction with a binary injector to remove obfuscated code and replace it with a simplified, transformed equivalent. We developed this tool in assessing strengths of protections and malware analysis for DoD government entities and commercial companies.
Keywords :
invasive software; program diagnostics; reverse engineering; software engineering; Deobfuscator; IDA Pro plug-in; antidisassembly code; binary code; binary injector; code obfuscation identification; code obfuscation removal; malware analysis; protection strength assessment; reverse engineering; Application software; Automatic control; Emulation; Government; Pattern matching; Pattern recognition; Protection; Registers; Reverse engineering; Software algorithms;
Conference_Titel :
Reverse Engineering, 2007. WCRE 2007. 14th Working Conference on
Conference_Location :
Vancouver, BC
Print_ISBN :
978-0-7695-3034-5
DOI :
10.1109/WCRE.2007.18
