While there are several frameworks for #reverseengineering that provide features we needed to see
through Wslink’s virtual-machine-based obfuscator, we used @MiasmRe in this project simply because
it’s actively maintained and we’re already familiar and satisfied with it. 4/5
@_trou_ It's more and more difficult to "manually" address problems generated by tools : 25 years ago, obfuscation, optimizations or even program size had "human size". Now, most of them are tool generated (even source code). So we also have to use tools to be able to solve them.
@crackin76726107 Hum, as Miasm is a framework, I would answer "as the user has decided to implement it" :)
To be honest, the picture gives nearly no clue. Is it code flattening?
@BincatLady@moyix Yes, the core algorithms are re-coded in Rust to improve speed (Jitter / Lifter / code analysis / ... ) and to clean APIs a bit :)
But bindings allow python scripting currently!
Giving the workshop on code deobfuscation was great fun. Thanks for your active participation! #HITB2021AMS
Check out code, slides and samples here: github.com/mrphrazer/hitb…
Giving the workshop on code deobfuscation was great fun. Thanks for your active participation! #HITB2021AMS
Check out code, slides and samples here: github.com/mrphrazer/hitb…
Congratulation, you both succeeded in:
- resolving the challenge
- writing a great tutorial on how to add a custom architecture in Miasm & exploit the IR!
Writeup for FCSC CTF 2021 - 'VMV'
"Defeating Nested Virtualization with @MiasmRe"
mrt4ntr4.github.io/FCSC21-CTF-VMV/
I explain how to write a custom architecture in Miasm and then use some pattern detection logic to solve the challenge.
This took most of my time, Hope you guys like it!
If you want to learn more about control-flow graph construction, analysis and loop detection, check out my slide deck. I also wrote a blog post on how these concepts can be easily explored with @MiasmRe.
synthesis.to/2021/03/15/con…
A good example of automatic code deobfuscation based on pattern matching is stadeo by @ESET. They use @MiasmRe to automatically remove control flow flattening for the stantinko malware family.
github.com/eset/stadeo
@mr_phrazer@r2gui Great workshop Tim!
Hopefully, IR translation/symbolic execution/z3 translation will be nearly instantaneous in the @rust version of miasm ;)
Friday, 19:00 GMT+2 at #r2con2020:
In a live coding, I will use @r2gui and @MiasmRe to automatically identify and remove opaque predicates in an APT malware sample.
Check it out: rada.re/con/2020/youtu…
@rh0main If I don't mess up, api-ms-win-core-processthreads-l1-1-2 is not present in the ApiSet, and it's present on the disk (in the downlevel sub dir). So I definitively miss something here.
I am missing something here; On windows 10 15063:
- In kernel32, IsProcessCritical is an export redirected to api-ms-win-core-processthreads-l1-1-2.IsProcessCritical
- no ApiSet for this dll
- in this dll, IsProcessCritical is... a redirected export to kernel32.IsProcessCritical
773 Followers 947 FollowingSecurity research @GroupIB . Interested in #APT research and targeted #malware. @GroupIB_TI
Opinions are my own not of my employer.
1 Followers 507 FollowingInfosec, Entrepreneur, Lifestyle Coach, Food Enjoyer, Business Angel, Web Surfer, Air Breather, Author, Philantropist, CEO of Cyber, Artist, Crypto Investor
2K Followers 688 FollowingSecurity researcher @DarknavyOrg. CTF player @0ops_ctf. Somehow got a PhD on hardware stuff @SJTU1896. Opinions/Shitposts are my own.
84 Followers 2K Followingh3kt0r_ is no Trojan ... At the moment doing cyber things in IT and OT. Other stuff is Wetware Hacking and Big Data 🔮🔬mostly in medical research.
8K Followers 139 Following🇫🇷 grep'ing for memcpy() since 2002AD. Currently @ Databricks. Formerly GOOG, MSFT. Tweets are my own, and sometimes attempts at being funny.