Language: English
Reverse engineering is fun and profitable, but can become tedious when the code is obfuscated, especially if done by hand. Under strong obfuscation, even automated analyses based on taint or symbolic reasoning fail, becoming quickly too imprecise. Fortunately, a new hope arises with black-box deobfuscation. This is an emerging paradigm for automated deobfuscation that leverages program synthesis to simplify local, highly obfuscated code snippets. Black-box deobfuscation is especially promising because it is not affected by the syntactic complexity introduced by obfuscation. Hence, it scales to strong obfuscation, where taint or symbolic reasoning would typically fail. The Xyntia framework is the state-of-the-art of black-box deobfuscation. It is backed by recent publications in international academic conferences (ACM CCS 2021 & 2025). This presentation will provide an overview of its internals and describe practical examples of successful deobfuscation with Xyntia. In particular, we will show how Xyntia can be used to deobfuscate virtual machine handlers or MBA expressions found in real code (e.g., Snapchat).
This presentation is based on publications that are joint works with Grégoire Menguy (presenter), Sébastien Bardin, Vidal Attias, Nicolas Bellec, Jean-Yves Marion, Richard Bonichon and Cauim de Souza Lima.
