Class Central is learner-supported. When you buy through links on our site, we may earn an affiliate commission.

YouTube

API Deobfuscator - Resolving Obfuscated API Functions in Modern Packers

Black Hat via YouTube

Overview

Explore techniques for deobfuscating API functions in modern packers during this 42-minute Black Hat conference talk. Learn about static and dynamic API obfuscation methods used by malware to hinder analysis. Discover a novel approach using memory access analysis to map obfuscated API functions to their original counterparts, overcoming limitations of pattern matching and code optimization techniques. Examine the iterative run-until-API method for handling static obfuscation, leveraging dynamic binary instrumentation with Intel Pin to identify real API functions without full system emulation. Gain insights into applying these deobfuscation techniques to Themida 32/64 packed binaries, enabling analysis with common reverse engineering tools like x64dbg, Ollydbg, and IDA Pro.

Syllabus

API Deobfuscator: Resolving Obfuscated API Functions In Modern Packers

Taught by

Black Hat

Reviews

Start your review of API Deobfuscator - Resolving Obfuscated API Functions in Modern Packers

Never Stop Learning.

Get personalized course recommendations, track subjects and courses with reminders, and more.

Someone learning on their laptop while sitting on the floor.