Understanding Obfuscated Code

Matias Madou, Ludo Van Put and Koen De Bosschere
Department of Electronics and Information Systems
Ghent University
St Pietersnieuwstraat 41
B-9000 Ghent, Belgium

Abstract
Code obfuscation makes it harder for a security analyst to understand the malicious payload of a program. In most cases an analyst needs to study the program at the machine code level, with little or no extra information available, apart from his experience. An unexperienced analyst is confronted with a steep learning curve, as understanding unobfuscated machine code already requires some skills. We have built Loco, a graphical, interactive environment to help a security analyst improving his skills in understanding obfuscated code.