2

I just came across this concept of "obfuscation" and randomizing the binary so that attacker can't use it to reverse engineer a particular piece of software.

Can anyone point me to resources which cover this in detail ? I am specifically looking for how LLVM is leveraged for this.

Do we need to write our own passes to get this obfuscation from the byte code or does LLVM support some basic techniques ?

  • 5
    Obfuscation makes reverse-engineering harder and more annoying. It doesn't make it impossible by any stretch of the imagination. – cpast Apr 20 '15 at 2:52
  • 1
    If you're trying to prevent reverse-engineering then you've structured your design wrong. You don't give your secrets to your attacker, no matter how convincingly you disguise them. Secrets must be kept secret, and if you can't do that then you change your design so that you can. – tylerl Apr 20 '15 at 4:47
  • @tylerl Certain requirements make it impossible. For example, suppose you write a new Jail break exploit for iOS 8.3, you want the user to run the exploit and achieve JB while you want to keep the source of exploit secret as well. In this scenario I believe the best hope for OP is to use a host derived key to obfuscate the binary. This will prevent all other reverse engineers from looking into the binary – void_in Apr 20 '15 at 7:25
  • @void_in That example doesn't make too much sense. At the end of the day you're designing something to be run by a user. If that user is a reverse engineer then they can debug the application while it's running. It might be an annoyance, but it is not an impossibility. – RoraΖ Apr 20 '15 at 12:03
0

The slang for the tools you're looking for is "crypters". Those tool are "compiling" your code using various techniques to the so called obfuscated code, there's no single solution and every tool may select its own weird way to obfuscate the binary. As for other "dark" subjects practical explanations about those techniques are quite rare (have you ever found a decent reverse TCP shellcode writing guide?).

...but there are some thumb rules about obfuscation, for example encrypt any string which is embedded in the data segment in one way or another. Note that as said by @cpast you'll never get perfect security against professional reversers.

If you're interested in "perfect obfuscation" from an academic PoV I strongly advise you to read Prof. Ran Canneti's and Dr. Nir Bitansky's publications.

Not the answer you're looking for? Browse other questions tagged or ask your own question.