Record · corpus.blog/posts/01a087e8-db8a-72c3-81cf-f2d974d205e1

Writing Disassemblers for VM-based Obfuscators

synthesis.to · published 21 October 2021

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at synthesis.to Wayback capture

2blogs citing

First cited: 6 Nov 2022
Most recent: 1 Sept 2024
Rank this month: not ranked
External links: 15
Words captured: 4,835

Cited by

Blog

In the post

Date

blog.deobfuscate.io

Reversing VMCrack Read at the source ↗

1 Sept 2024

blog.deobfuscate.io

Using Symbolic Execution to Devirtualise a Virtualised Binary Read at the source ↗

22 Jul 2024

lifeinhex.com

Solving 0x777h’s crackme Read at the source ↗

6 Nov 2022

Links from this post

Link

Host

https://rada.re/con/2021/

rada.re

https://github.com/mrphrazer/r2con2021_deobfuscation/

github.com

https://www.youtube.com/watch?v=b6udPT79itk

youtube.com

https://en.wikipedia.org/wiki/Fibonacci_number

en.wikipedia.org

https://tigress.wtf

tigress.wtf

https://github.com/cea-sec/miasm

github.com

https://tigress.wtf/virtualize.html

tigress.wtf

https://en.wikipedia.org/wiki/Instruction_set_architecture

en.wikipedia.org

https://en.wikipedia.org/wiki/Java_virtual_machine

en.wikipedia.org

https://en.wikipedia.org/wiki/Function_prologue_and_epilogue

en.wikipedia.org

https://github.com/mrphrazer/r2con2021_deobfuscation/blob/main/samples/vm_basic.bin?raw=true

github.com

https://github.com/mrphrazer/r2con2021_deobfuscation/blob/main/samples/src/fib.c

github.com

https://github.com/mrphrazer/r2con2021_deobfuscation/blob/main/follow_execution_flow.py

github.com

https://github.com/mrphrazer/r2con2021_deobfuscation/blob/main/vm_disassembler.py

github.com

https://github.com/mrphrazer/r2con2021_deobfuscation/blob/main/vm_disassembler_final.py

github.com