{"id":11730,"date":"2023-03-20T08:27:55","date_gmt":"2023-03-20T08:27:55","guid":{"rendered":"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/"},"modified":"2023-07-06T04:53:42","modified_gmt":"2023-07-06T04:53:42","slug":"an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt","status":"publish","type":"product","link":"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/","title":{"rendered":"An Analytical Approach to Modern Binary Deobfuscation (HKT)"},"content":{"rendered":"
\n
\n

ATTEND ONLINE<\/span><\/strong>: <\/span><\/strong>Virtual via Zoom and Discord<\/strong><\/h4>\n<\/div>\n<\/div>\n

DATE: 21-24 August 2023<\/strong><\/h4>\n

TIME: 09:00 to 17:00 ICT\/GMT+7<\/strong><\/h4>\n\n\n\n\n\n\n\n
Date<\/strong><\/td>\nDay<\/strong><\/td>\nTime<\/strong><\/td>\nDuration<\/strong><\/td>\n<\/tr>\n
21 Aug<\/td>\nMonday<\/td>\n0900-17:00 ICT\/GMT+7<\/td>\n8 Hours<\/td>\n<\/tr>\n
22 Aug<\/td>\nTuesday<\/td>\n0900-17:00 ICT\/GMT+7<\/td>\n8 Hours<\/td>\n<\/tr>\n
23 Aug<\/td>\nWednesday<\/td>\n0900-17:00 ICT\/GMT+7<\/td>\n8 Hours<\/td>\n<\/tr>\n
24 Aug<\/td>\nThursday<\/td>\n0900-17:00 ICT\/GMT+7<\/td>\n8 Hours<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n
Code obfuscation has become one of the most prevalent mechanisms aiming to complicate the process of software reverse engineering. It plays a major role on a wide range of domains: from malware threats to protection of intellectual property and digital rights management.<\/h5>\n

An Analytical approach to Modern Binary Deobfuscation<\/em>\u00a0is a curated training that provides an intensive jump-start into the field of code (de)obfuscation. Over the course of this training, students will receive a comprehensive introduction to the most relevant software obfuscation mechanisms as well as existing deobfuscation techniques to analyze, confront and defeat obfuscated code.<\/p>\n

<\/h5>\n
Teaching Methodology<\/strong><\/h5>\n

Live classes are designed to be dynamic and engaging, making the students get the most out of the training materials and instructor expertise. A clear presentation of the concepts, accompanied by illustrative examples and demos. For each section, there will be practice time allocated. The students will be provided with several exercises and projects to work on, with the continuous support of the instructor.<\/p>\n

 <\/p>\n

Key Learning Objectives<\/strong><\/h5>\n
    \n
  • Obtain a high-level overview of the context and scenarios where code obfuscation is used<\/li>\n
  • Gain an in-depth understanding of code obfuscation mechanisms<\/li>\n
  • Build obfuscated code, both from scratch and through available tooling<\/li>\n
  • Develop an understanding of the main code deobfuscation techniques<\/li>\n
  • Learn tooling for analyzing obfuscated code and apply deobfuscation techniques<\/li>\n
  • Become familiar with state of the art (de)obfuscation research literature<\/li>\n<\/ul>\n

     <\/p>\n

    Students will be provided with<\/strong><\/h5>\n
      \n
    • Access to a VM with all tools, examples and exercises<\/li>\n
    • Access to a private chat with instructor and other students<\/li>\n<\/ul>\n

       <\/p>\n

      Agenda<\/strong><\/h5>\n
      \n

      Day 1<\/strong><\/p>\n

      \n
        \n
      • Introduction, context and motivation<\/b><\/span><\/li>\n
      • <\/b>Data-flow based obfuscation<\/b><\/span>\n
          \n
        • <\/i>Constant unfolding<\/i><\/span><\/li>\n
        • <\/i>Dead code insertion<\/i><\/span><\/li>\n
        • <\/i>Encodings<\/i><\/span><\/li>\n
        • <\/i>Pattern-based obfuscation<\/i><\/span><\/li>\n<\/ul>\n<\/li>\n
        • <\/b>Control-flow based obfuscation<\/b><\/span>\n
            \n
          • <\/i>Function inlining\/outlining<\/i><\/span><\/li>\n
          • <\/i>Opaque predicates<\/i><\/span><\/li>\n
          • <\/i>Control-flow flattening<\/i><\/span><\/li>\n<\/ul>\n<\/li>\n
          • <\/b>Mixing data-flow and control-flow obfuscation<\/b><\/span>\n
              \n
            • <\/i>VM-based obfuscation<\/i><\/span><\/li>\n
            • <\/i>Hardening VM-based obfuscation<\/i><\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

               <\/p>\n

              Exercises
              \n<\/span><\/strong>Project – Manually craft a custom obfuscation VM<\/span><\/p>\n

               <\/p>\n

              \n

              Day 2<\/strong><\/p>\n

              \n
                \n
              • SMT-based analysis<\/b><\/span>\n
                  \n
                • <\/i>A primer on SMT solvers<\/i><\/span><\/li>\n
                • <\/i>Translate code conditions into SMT solver constraints<\/i><\/span><\/li>\n
                • <\/i>Program analysis with SMT solvers<\/i><\/span><\/li>\n<\/ul>\n<\/li>\n
                • <\/b>Mixed Boolean-Arithmetic<\/b><\/span>\n
                    \n
                  • <\/i>Preliminary concepts<\/i><\/span><\/li>\n
                  • <\/i>MBA rewriting<\/i><\/span><\/li>\n
                  • <\/i>Insertion of identities<\/i><\/span><\/li>\n
                  • <\/i>Opaque constants<\/i><\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

                     <\/p>\n

                    Exercises
                    \n<\/span><\/strong>Project – Applied MBA to obfuscate the semantics of VM-handlers<\/span><\/p>\n

                     <\/p>\n

                    \n

                    Day 3<\/strong><\/p>\n

                    \n
                      \n
                    • Symbolic execution<\/strong>\n
                        \n
                      • Reasoning about code in a symbolic way<\/li>\n
                      • Working with native code<\/li>\n
                      • Working with intermediate representations<\/li>\n
                      • Data-flow analysis and compiler optimizations<\/li>\n
                      • Extract symbolic formulas<\/li>\n
                      • Extract path constraints<\/li>\n
                      • Plugging an SMT solver<\/li>\n
                      • Attacking obfuscation schemes<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

                         <\/p>\n

                        Guided project<\/strong> – Build your own (toy) symbolic execution engine<\/p>\n

                        Exercises<\/strong>
                        \nProject – Attack obfuscated VM and explore symbolic execution limits<\/p>\n

                         <\/p>\n

                        \n

                        Day 4<\/strong><\/p>\n

                        \n
                          \n
                        • Program synthesis<\/b><\/span>\n
                            \n
                          • <\/i>Code syntax VS Code semantics<\/i><\/span><\/li>\n
                          • <\/i>Specifying program behavior<\/i><\/span><\/li>\n
                          • <\/i>Oracle-based program synthesis<\/i><\/span><\/li>\n
                          • <\/i>Describing semantics through I\/O behavior<\/i><\/span><\/li>\n
                          • <\/i>Generating I\/O pairs<\/i><\/span><\/li>\n
                          • <\/i>Different synthesis flavors<\/i><\/span><\/li>\n
                          • <\/i>Practical considerations<\/i><\/span><\/li>\n
                          • <\/i>Attacking obfuscation schemes<\/i><\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

                             <\/p>\n

                              \n
                            • Conclusions and research directions<\/b><\/span><\/li>\n<\/ul>\n

                               <\/p>\n

                              Guided project<\/strong> – Build your own code semantics synthesizer<\/span><\/p>\n

                              Exercises
                              \n<\/span><\/strong>Project – Recover the semantics of MBA-obfuscated VM-handlers<\/span><\/p>\n

                               <\/p>\n

                              Tools used<\/strong><\/h5>\n
                                \n
                              • Disassemblers<\/strong>\n
                                  \n
                                • IDA Free\/Home\/Pro<\/em><\/li>\n
                                • Ghidra<\/em><\/li>\n
                                • Radare2<\/li>\n<\/ul>\n<\/li>\n
                                • Obfuscation<\/strong>\n
                                    \n
                                  • Manual obfuscation<\/em><\/li>\n
                                  • O-LLVM<\/em><\/li>\n
                                  • Tigress<\/em><\/li>\n<\/ul>\n<\/li>\n
                                  • Symbolic execution<\/strong>\n
                                      \n
                                    • Miasm<\/em><\/li>\n
                                    • Triton<\/em><\/li>\n<\/ul>\n<\/li>\n
                                    • Program synthesis<\/strong>\n
                                        \n
                                      • Syntia<\/em><\/li>\n
                                      • Msynth<\/em><\/li>\n
                                      • Custom tooling<\/em><\/li>\n<\/ul>\n<\/li>\n
                                      • Other tools<\/strong>\n
                                          \n
                                        • Z3<\/em><\/li>\n
                                        • Other custom tooling<\/em><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

                                          ATTEND ONLINE: Virtual via Zoom and Discord DATE: 21-24 August 2023 TIME: 09:00 to 17:00 ICT\/GMT+7 Date Day Time Duration 21 Aug Monday 0900-17:00 ICT\/GMT+7 8 Hours 22 Aug Tuesday 0900-17:00 ICT\/GMT+7 8 Hours 23 Aug Wednesday 0900-17:00 ICT\/GMT+7 8 Hours 24 Aug Thursday 0900-17:00 ICT\/GMT+7 8 Hours Code obfuscation has become one of the […]<\/p>\n","protected":false},"featured_media":11729,"template":"","meta":{"_acf_changed":false},"product_cat":[77,62],"product_tag":[],"class_list":{"0":"post-11730","1":"product","2":"type-product","3":"status-publish","4":"has-post-thumbnail","6":"product_cat-hitb2023hkt","7":"product_cat-virtual","9":"first","10":"instock","11":"featured","12":"shipping-taxable","13":"purchasable","14":"product-type-simple"},"acf":[],"yoast_head":"\nAn Analytical Approach to Modern Binary Deobfuscation (HKT) - HITB (in)Cyber 2024 - Abu Dhabi<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"An Analytical Approach to Modern Binary Deobfuscation (HKT) - HITB (in)Cyber 2024 - Abu Dhabi\" \/>\n<meta property=\"og:description\" content=\"ATTEND ONLINE: Virtual via Zoom and Discord DATE: 21-24 August 2023 TIME: 09:00 to 17:00 ICT\/GMT+7 Date Day Time Duration 21 Aug Monday 0900-17:00 ICT\/GMT+7 8 Hours 22 Aug Tuesday 0900-17:00 ICT\/GMT+7 8 Hours 23 Aug Wednesday 0900-17:00 ICT\/GMT+7 8 Hours 24 Aug Thursday 0900-17:00 ICT\/GMT+7 8 Hours Code obfuscation has become one of the […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/\" \/>\n<meta property=\"og:site_name\" content=\"HITB (in)Cyber 2024 - Abu Dhabi\" \/>\n<meta property=\"article:modified_time\" content=\"2023-07-06T04:53:42+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/conference.hitb.org\/hitbincyber2024\/wp-content\/uploads\/sites\/21\/2023\/03\/hitb2010kul-400x300-1.jpeg\" \/>\n\t<meta property=\"og:image:width\" content=\"400\" \/>\n\t<meta property=\"og:image:height\" content=\"300\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/\",\"url\":\"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/\",\"name\":\"An Analytical Approach to Modern Binary Deobfuscation (HKT) - HITB (in)Cyber 2024 - Abu Dhabi\",\"isPartOf\":{\"@id\":\"https:\/\/conference.hitb.org\/hitbincyber2024\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/conference.hitb.org\/hitbincyber2024\/wp-content\/uploads\/sites\/21\/2023\/03\/hitb2010kul-400x300-1.jpeg\",\"datePublished\":\"2023-03-20T08:27:55+00:00\",\"dateModified\":\"2023-07-06T04:53:42+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/#primaryimage\",\"url\":\"https:\/\/conference.hitb.org\/hitbincyber2024\/wp-content\/uploads\/sites\/21\/2023\/03\/hitb2010kul-400x300-1.jpeg\",\"contentUrl\":\"https:\/\/conference.hitb.org\/hitbincyber2024\/wp-content\/uploads\/sites\/21\/2023\/03\/hitb2010kul-400x300-1.jpeg\",\"width\":400,\"height\":300},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/conference.hitb.org\/hitbincyber2024\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Shop\",\"item\":\"https:\/\/conference.hitb.org\/hitbincyber2024\/shop\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"An Analytical Approach to Modern Binary Deobfuscation (HKT)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/conference.hitb.org\/hitbincyber2024\/#website\",\"url\":\"https:\/\/conference.hitb.org\/hitbincyber2024\/\",\"name\":\"HITB (in)Cyber 2024 - Abu Dhabi\",\"description\":\"May 14 - 16, Etihad Arena \",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/conference.hitb.org\/hitbincyber2024\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"An Analytical Approach to Modern Binary Deobfuscation (HKT) - HITB (in)Cyber 2024 - Abu Dhabi","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/","og_locale":"en_US","og_type":"article","og_title":"An Analytical Approach to Modern Binary Deobfuscation (HKT) - HITB (in)Cyber 2024 - Abu Dhabi","og_description":"ATTEND ONLINE: Virtual via Zoom and Discord DATE: 21-24 August 2023 TIME: 09:00 to 17:00 ICT\/GMT+7 Date Day Time Duration 21 Aug Monday 0900-17:00 ICT\/GMT+7 8 Hours 22 Aug Tuesday 0900-17:00 ICT\/GMT+7 8 Hours 23 Aug Wednesday 0900-17:00 ICT\/GMT+7 8 Hours 24 Aug Thursday 0900-17:00 ICT\/GMT+7 8 Hours Code obfuscation has become one of the […]","og_url":"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/","og_site_name":"HITB (in)Cyber 2024 - Abu Dhabi","article_modified_time":"2023-07-06T04:53:42+00:00","og_image":[{"width":400,"height":300,"url":"https:\/\/conference.hitb.org\/hitbincyber2024\/wp-content\/uploads\/sites\/21\/2023\/03\/hitb2010kul-400x300-1.jpeg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/","url":"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/","name":"An Analytical Approach to Modern Binary Deobfuscation (HKT) - HITB (in)Cyber 2024 - Abu Dhabi","isPartOf":{"@id":"https:\/\/conference.hitb.org\/hitbincyber2024\/#website"},"primaryImageOfPage":{"@id":"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/#primaryimage"},"image":{"@id":"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/#primaryimage"},"thumbnailUrl":"https:\/\/conference.hitb.org\/hitbincyber2024\/wp-content\/uploads\/sites\/21\/2023\/03\/hitb2010kul-400x300-1.jpeg","datePublished":"2023-03-20T08:27:55+00:00","dateModified":"2023-07-06T04:53:42+00:00","breadcrumb":{"@id":"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/#primaryimage","url":"https:\/\/conference.hitb.org\/hitbincyber2024\/wp-content\/uploads\/sites\/21\/2023\/03\/hitb2010kul-400x300-1.jpeg","contentUrl":"https:\/\/conference.hitb.org\/hitbincyber2024\/wp-content\/uploads\/sites\/21\/2023\/03\/hitb2010kul-400x300-1.jpeg","width":400,"height":300},{"@type":"BreadcrumbList","@id":"https:\/\/conference.hitb.org\/hitbincyber2024\/product\/an-analytical-approach-to-modern-binary-deobfuscation-hitb2023hkt\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/conference.hitb.org\/hitbincyber2024\/"},{"@type":"ListItem","position":2,"name":"Shop","item":"https:\/\/conference.hitb.org\/hitbincyber2024\/shop\/"},{"@type":"ListItem","position":3,"name":"An Analytical Approach to Modern Binary Deobfuscation (HKT)"}]},{"@type":"WebSite","@id":"https:\/\/conference.hitb.org\/hitbincyber2024\/#website","url":"https:\/\/conference.hitb.org\/hitbincyber2024\/","name":"HITB (in)Cyber 2024 - Abu Dhabi","description":"May 14 - 16, Etihad Arena ","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/conference.hitb.org\/hitbincyber2024\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/conference.hitb.org\/hitbincyber2024\/wp-json\/wp\/v2\/product\/11730"}],"collection":[{"href":"https:\/\/conference.hitb.org\/hitbincyber2024\/wp-json\/wp\/v2\/product"}],"about":[{"href":"https:\/\/conference.hitb.org\/hitbincyber2024\/wp-json\/wp\/v2\/types\/product"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/conference.hitb.org\/hitbincyber2024\/wp-json\/wp\/v2\/media\/11729"}],"wp:attachment":[{"href":"https:\/\/conference.hitb.org\/hitbincyber2024\/wp-json\/wp\/v2\/media?parent=11730"}],"wp:term":[{"taxonomy":"product_cat","embeddable":true,"href":"https:\/\/conference.hitb.org\/hitbincyber2024\/wp-json\/wp\/v2\/product_cat?post=11730"},{"taxonomy":"product_tag","embeddable":true,"href":"https:\/\/conference.hitb.org\/hitbincyber2024\/wp-json\/wp\/v2\/product_tag?post=11730"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}