Dynamic Binary Instrumentation Techniques to Address Native Code Obfuscation
summary
Shows QBDI dynamic instrumentation used to recover actual function targets, resolve JNI registerNative mappings, and extract decoded strings by record printable byte memory accesses rather than redoing complex static deobfuscation. Demonstrates an exact broker for external calls that maps addresses to symbols, tracks malloc/mmap/mprotect to instrument JITed code, and combines QBDI with LEAF to patch syscall results to bypass anti‑Frida checks. Works on ARM/ARM64 in private branch and successfully unpacks and analyzes real Android obfuscators.
AI-written summary · about
chapters (6)
- 0:00Start
- 5:28History of Kubernetes
- 15:51Gni Function
- 26:53Gni Onload
- 30:27Video Game Protection
- 35:30Implicit Destructor
related talks
31mDABiD: The Powerful Interactive Android Debugger for Android Malware Analysis
29mEndoscope: Unpacking Android Apps with VM-Based Obfuscation
45mBreak Out of The Truman Show: Active Detection and Escape of Dynamic Binary Instrumentation
15mObfuscation in Mobile Apps
53mAndroid: He protec, but he also attac
45mReverse engineering mobile apps: how, why, and what now?
15mInvestigating Internals With Stoic
47mAttacking Android Applications