corCTF 2023 vmquack's vectorized vices: VM Obfuscation through AVX-512
ID: 51ada845-3195-53f4-9c83-6a4fe0515138
STIX ID: report--51ada845-3195-53f4-9c83-6a4fe0515138
Feed Name: Will's Root
This post details the design and inner workings of an AVX-512-based VM obfuscation used in a corCTF reversing challenge, shows common obfuscated instruction sequences (register spills, broadcasts, arithmetic, division via floating-point conversion, array indexing, calls/returns), presents a Binary Ninja pattern-matching deobfuscator script to patch obfuscated code back to native operations, and includes a brief solver and discussion of the obfuscator's implementation and development.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
