Analyzing User String Stream Obfuscation and Recovery
· 11:22 · Watch on YouTube ↗
Summary
A workshop demonstrates how string obfuscation removes the .NET user string stream, and how analysts can recover strings using DE4dot or by tracing execution with breakpoints.
Key points
- The demonstrated obfuscation removes readable strings and the user string stream, storing string data in a form that requires analysis to recover.
- The presenter compares DE4dot versions and reports that the newer version better recognizes and cleans the string-resolution method than the older installed version.
- Static analysis can trace transformed string IDs and follow code references to understand how strings are reconstructed.
- When automated cleanup is unavailable, analysts can inspect methods that return strings and recover them by tracing execution or iterating through returned values.
- The sample retained anti-debug behavior, but the presenter found that string resolution could still be observed without needing to bypass it in the demonstrated path.
- The workshop notes that layering string obfuscation with renaming and other anti-analysis techniques can make analysis more difficult; control-flow obfuscation is introduced as a future topic.
Article Details
- Topics
- [00:00] Constants protection and layered anti-analysis techniques
- [00:57] Renaming and visibility in the binary
- [01:25] Obfuscated strings and comparison of DE4dot versions
- [05:19] How transformed IDs and the removed user string stream relate to string recovery
- [08:37] Using breakpoints and execution tracing to recover strings
- [10:48] Layered obfuscation and the upcoming discussion of control-flow obfuscation