Syntia: Synthesizing the Semantics of Obfuscated Code
summary
Proposes Syntia, a program-synthesis deobfuscator that uses Monte Carlo Tree Search to learn semantics from short execution trace windows rather than relying on brittle symbolic execution or tainting. Prototype synthesizes 489 of 500 expressions obfuscated with Mixed Boolean–Arithmetic, recovers arithmetic instruction handlers from VMProtect and Themida with >94% success, and also learns ROP gadget semantics. Works by generating candidate programs, sampling input/output vectors, and ranking candidates against observed traces.
AI-written summary · about
chapters (7)
- 0:00Syntia and obfuscated code
- 3:33Reverse engineering semantics
- 9:21Syntia approach
- 14:37Program similarity with Syntia
- 18:02Syntia versus protections
- 23:25Deterministic behavior with Syntia
- 24:35Live demo & Q&A
related talks
47mBig Ideas in Program Synthesis
38mProgram Synthesis: A Dream Realized?
45m"Advanced Malware Threat: handling obfuscated code using..."
31mSynthesizing Evidence of Emergent Computation
22mBi-abductive adversarial program synthesis
40mType-Driven Program Synthesis
26mAn Effective Approach to Software Obfuscation
37mMANTIS: Semantics-driven Inductive Program Synthesis