3 posts in tag Deobfuscation

Unfolding obfuscated code with Reven (part 2)

25 Jan 2017 by tdta - Technical - Reverse Engineering Deobfuscation ctf Reven

Last time, by abstracting the runtime effect of the first virtual machine, we have reduced the challenge to a simpler but semantically equivalent program. Its control flow graph has a unique entry point as the basic block starting at 0x402048, whereas ones at 0x4023d4 and at 0x40266e are exit points...

Unfolding obfuscated code with Reven (part 1, full write-up)

01 Nov 2016 by tdta - Technical - Reverse Engineering Deobfuscation ctf

In this article, we present a reverse engineering task performed using Reven. This is the full write-up corresponding to a first overview published in October. The binary examined here is F4b_XOR_W4kfu, the challenge scoring the highest number of points over all categories (cryptography, exploit, reverse engineering, etc.) in Grehack 2015’s...

Unfolding obfuscated code (part 1)

01 Oct 2016 by tdta, Fred, Mathieu, Benoit - Technical - Reverse Engineering Deobfuscation ctf Reven

This article is the first one in a series of two. We present an overview of some reverse engineering capabilities of REVEN-Axion, applied to a publicly available challenge, namely F4b_XOR_W4kfu, the most valued at Grehack 2015’s CTF contest (500 points). A more detailed write-up will be published soon for those interested....