Florian Magin
Florian Magin is a Security Researcher at Fraunhofer Institute for Secure Information Technology (SIT) with 10 years of experience in getting distracted by subpar decompiler output.
After an initial excursion into industry at ERNW Research GmbH, he switched to the kind of place where it's acceptable to spend months solving the
general problem instead of 5 minutes in a debugger: an academic research institute.
There, he has been building analysis tooling to tackle the myriad languages cropping up in the iOS app store: Objective-C, Swift, Flutter, React
Native, and others.
Session
A binary in a new language that suspiciously looks like it's designed to foil your static analysis tools:
A new string format that breaks references and readability, virtual dispatch that masks which function is called where and a reference counting garbage collector so you can't even tell which object ends up where.
Participants will learn how to leverage Ghidra and P-Code to tackle the challenges that pop up when analyzing compiled high level languages.
The focus will be on the iterative workflow of assisting the decompiler: Understanding why it fails,
assisting it with a custom analysis script that uses the P-Code emitted by the decompiler,
and feeding the resulting information back to Ghidra and the decompiler via the right APIs,
so that the decompiler can continue doing the heavy lifting, and provides better P-Code to tackle the next challenge.
By the end, participants will have a transferable toolbox for adapting Ghidra's decompiler to unfamiliar language runtimes by identifying runtime patterns, writing P-Code-driven analysis scripts or to feeding recovered types and dispatch targets back to the decompiler.