• Registered: 2011-03-18
  • Posts: 15
  • User Karma: 5

Topic: Code Obfuscators

Does anyone know of any tell-tale signs that may indicate what kind of code obfuscator may have been used to generate a binary? I'm sure that you could look at what kind of code obfuscation that is being done (e.g. control flow obfuscation, stack built strings, constant obfuscation, etc...), but I wonder if there's any way to signature what particular code obfuscator was used to generate a binary.  I recently looked at something that was full of jumps (which would eventually lead to function calls). Fortunately, it wasn't as annoying as obfuscation used in SpyEyes (for anyone who has ever looked at it), and I was able to use the IDA plugin optimice to clean up the code decently.

I've done some googling and found that [Register or log in to view the URL] has some proprietary software that can be used for software protection. I also found references to some older stuff like the z0mbie mutation engine. Anyone know of any other more mainstream code obfuscators--possibly even free ones? The majority of my googles are just giving me .NET stuff, and I'm more interested in C/C++ code obfuscators.

Last edited by prot0man (2011-08-24 14:07:28)

  • Registered: 2011-07-30
  • Posts: 15
  • User Karma: 3

Re: Code Obfuscators

This looks like obfuscation directly built into the binary during compilation. Very interesting. I was going to suggest using PEiD if the binary was obfuscated with some kind of packer. But I don't think this will be of any use in your case. Sorry I am not of any more help. Please post back if you find a solution. I am also curious if there are other *obfuscators* similar to the tool in the link that you provided.

+1

  • Registered: 2011-03-18
  • Posts: 15
  • User Karma: 5

Re: Code Obfuscators

sfsfs wrote:

This looks like obfuscation directly built into the binary during compilation. Very interesting. I was going to suggest using PEiD if the binary was obfuscated with some kind of packer. But I don't think this will be of any use in your case. Sorry I am not of any more help. Please post back if you find a solution. I am also curious if there are other *obfuscators* similar to the tool in the link that you provided.

Yeah, still no luck in identifying what particular code obfuscator was used in generating the binary I was looking at, but mostly what I was hoping for was a list of some of the more common code obfuscators that people use.

After reading your response, I did a few more googles and have found more results when searching for "C/C++ software protectors" vice "C/C++ code obfuscators". I'll probably post here whenever I get a good list of the things out there.

Thanks for at least looking smile.

  • Registered: 2011-03-18
  • Posts: 15
  • User Karma: 5

Re: Code Obfuscators

So yeah, I guess my problem with answering my own question was a result of poor wording in my googling. In my case, I didn't really care about .NET obfuscators, but there are quite a few results for that too if anyone is ever looking into obfuscating their .NET code. So, on to the code obfuscators!

1) Stunnix C/C++ Code obfuscators ([Register or log in to view the URL])
*This obfuscator works on the C/C++ source code to generate a binary that is harder to reverse engineer. Of note, some of obfuscations it does is renaming symbols to meaningless names, translating constants to mathematical expressions, translating strings to their hex codes, and has ability to watermark code.

2) Themida ([Register or log in to view the URL])
*I'd heard of this before but never really looked at anything that had been obfuscated with this tool. This tool has a really nice GUI and works on the binary instead of the source code. Some of the interesting features of this obfuscator are garbage code insertion, import table obfuscation (to prevent reconstruction by analysis tools), virtual machine emulation for blocks of code, and random internal data relocation. This tool has many other features than what I just mentioned, so definitely check out the page if you're interested.

3) Intelliprotector ([Register or log in to view the URL])
*This tool takes source code and generates an obfuscated binary. Features are anti-debug / anti-disassembler stuff.

4) peguard.com


My laptop is running out of battery, so I had to make it short at the end. Hope that helps others.

  • samus
  • New member
  • Offline
  • Registered: 2011-11-16
  • Posts: 1

Re: Code Obfuscators

i remember also armadillo as software protection [Register or log in to view the URL]

  • crim
  • Member
  • Offline
  • Registered: 2010-03-19
  • Posts: 87
  • User Karma: 4

Re: Code Obfuscators

samus wrote:

i remember also armadillo as software protection [Register or log in to view the URL]

armadillo is a packer, not source code obfuscator

forum have become too shitty lately, if you need me find me at coru or dk, 10-4 over and out.