Get the latest tech news
GoStringUngarbler: Deobfuscating Strings in Garbled Binaries
We discuss how threat actors protect malware with garble obfuscation, and the process of automatically deobfuscating it.
This tool can streamline the reverse engineering process by producing a deobfuscated binary with all strings recovered and shown in plain text, thereby simplifying static analysis, malware detection, and classification. Because of this setup, subroutines of this transformation type are easily recognizable in the decompiler and disassembly views due to the multiple function calls it makes in the decryption process. The tool can deobfuscate and produce functionally identical executables with recovered strings stored in plain text, improving both reverse engineering analysis and malware detection workflows.
Or read this on Hacker News
