Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.c++ > #70169

Re: Obfuscate Assembler (Remove Function Calls, Unroll Loops)

Show all headers | View raw

On 29/11/2019 18:18, Scott Lurndal wrote:
> David Brown <david.brown@hesbynett.no> writes:
>> On 28/11/2019 16:58, Frederick Gotham wrote:
>>>
> 
>> Once your LTO-optimised binary is stripped of all extra symbols, it will
>> be very difficult to follow by examination of the object code.
> 
> Until you run it under QEMU and get a full instruction/register trace.
> 

It will still be difficult to follow there.  LTO generally results in a 
lot of inlining, including partial inlining - code from all over the 
project can get merged together into huge blocks of assembly with no 
clear structure.  With -O3 you get unrolling, re-arrangement of loops, 
function cloning, and more.

Certainly QEMU or similar tools are a big aid to tracing the 
functionality of code (and they pretty much neutralise things like code 
encryption), but they won't make it an easy job here.  Even for more 
complex obfuscation techniques, like self-modifying code, extra jumps 
added all over, extra dummy code, etc., there are tools available for 
picking out the real code flow - though they may be hard to find and 
expensive to get.

That is why complex obfuscation is pointless here, but LTO is a simple 
and easy way to get block casual inspection of the code.

Back to comp.lang.c++ | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Obfuscate Assembler (Remove Function Calls, Unroll Loops) Frederick Gotham <cauldwell.thomas@gmail.com> - 2019-11-28 07:58 -0800
  Re: Obfuscate Assembler (Remove Function Calls, Unroll Loops) "Alf P. Steinbach" <alf.p.steinbach+usenet@gmail.com> - 2019-11-28 19:47 +0100
  Re: Obfuscate Assembler (Remove Function Calls, Unroll Loops) Öö Tiib <ootiib@hot.ee> - 2019-11-28 11:19 -0800
    Re: Obfuscate Assembler (Remove Function Calls, Unroll Loops) Frederick Gotham <cauldwell.thomas@gmail.com> - 2019-11-28 13:10 -0800
  Re: Obfuscate Assembler (Remove Function Calls, Unroll Loops) David Brown <david.brown@hesbynett.no> - 2019-11-29 11:21 +0100
    Re: Obfuscate Assembler (Remove Function Calls, Unroll Loops) scott@slp53.sl.home (Scott Lurndal) - 2019-11-29 17:18 +0000
      Re: Obfuscate Assembler (Remove Function Calls, Unroll Loops) David Brown <david.brown@hesbynett.no> - 2019-11-30 12:00 +0100
        Re: Obfuscate Assembler (Remove Function Calls, Unroll Loops) scott@slp53.sl.home (Scott Lurndal) - 2019-11-30 19:03 +0000
    Re: Obfuscate Assembler (Remove Function Calls, Unroll Loops) Frederick Gotham <cauldwell.thomas@gmail.com> - 2019-11-29 10:58 -0800
      Re: Obfuscate Assembler (Remove Function Calls, Unroll Loops) Vir Campestris <vir.campestris@invalid.invalid> - 2019-11-29 21:19 +0000
  Re: Obfuscate Assembler (Remove Function Calls, Unroll Loops) Mr Flibble <flibbleREMOVETHISBIT@i42.co.uk> - 2019-11-29 16:43 +0000

csiph-web