Flare-On Reversing Challenges 2015

Summary: FireEye's FLARE team hosted its second annual Flare-On Challenge this summer, an eleven-challenge reverse-engineering contest for reverse engineers, malware analysts, and security professionals, with challenges spanning password crack-mes, kernel drivers, and steganography in images. The Trail of Bits writeup walks through four of the eleven (challenges 6, 7, 9, and 11), including an ARM shared-object Android challenge solved by porting the decryption logic to Python with IDAPython, a SmartAssembly-obfuscated .NET binary deobfuscated with de4dot, an x86 crack-me brute-forced byte by byte using a Pin instruction-count tool, and a CryptoGraph.exe binary using RC5 decryption across staged resources.
What's compelling: The techniques described here - IDAPython data carving, de4dot against SmartAssembly, instruction-count side channels, and staged RC5 key recovery - are the same methods analysts use against real malware, so the writeup doubles as a working map of the anti-reversing defenses your detection stack is likely to encounter.

Read the original at Trail of Bits Blog ↗