Understanding Obfuscated Code
Matias Madou,
Ludo Van Put and
Koen De Bosschere
Department of Electronics and Information Systems
Ghent University
St Pietersnieuwstraat 41
B-9000 Ghent, Belgium
Abstract
Code obfuscation makes it harder for a security analyst to
understand the malicious payload of a program. In most cases an analyst needs
to study the program at the machine code level, with little or no extra
information available, apart from his experience. An unexperienced analyst is
confronted with a steep learning curve, as understanding unobfuscated machine
code already requires some skills. We have built Loco, a graphical,
interactive environment to help a security analyst improving his skills in
understanding obfuscated code.