Главная
Study mode:
on
1
Intro
2
OUTLINE
3
INTRO
4
WHAT IS OBFUSCATION?
5
WHY OBFUSCATE SCRIPTS?
6
HOW ARE SCRIPTS OBFUSCATED?
7
OBFUSCATED SCRIPTS IN ATTACK SCENARIOS
8
WHY DEOBFUSCATE?
9
DEOBFUSCATION GOALS
10
WHAT DO I NEED?
11
GENERAL TIPS
12
UNUSED / GARBAGE CODE
13
COMPLICATED VARIABLE AND FUNCTION NAMES
14
INDIRECT CALLS AND OBSCURED CONTROL FLOW
15
ARITHMETIC SEQUENCES
16
OBFUSCATED STRING VALUES
17
IF SCRIPT IS STILL HEAVILY OBFUSCATED
18
REMOVE JUNK
19
STANDARDIZE FORMATTING
20
REARRANGE FUNCTION ORDER
21
MERGE FUNCTIONS TOGETHER
22
BEGIN SIMPLIFYING...
23
PICTURE BEGINS TO CLEAR UP
24
YUP, THEY'RE FILE PATHS
25
FUNCTION RELABELING
26
DEOBFUSCATION TOOLS
27
CONCLUSION
Description:
Explore advanced techniques for defeating the latest script obfuscation methods in this 30-minute conference talk from Derbycon 2016. Learn about the purpose and methods of script obfuscation, its role in attack scenarios, and the importance of deobfuscation. Discover general tips for tackling obfuscated scripts, including handling unused code, complicated naming conventions, and obscured control flow. Gain insights into simplifying arithmetic sequences, decoding obfuscated string values, and dealing with heavily obfuscated scripts. Master practical steps like removing junk code, standardizing formatting, and rearranging functions to improve readability. Understand the process of function relabeling and explore various deobfuscation tools to enhance your analysis capabilities.

Defeating the Latest Advances in Script Obfuscation

Add to list