ReMASTering Applications by Obfuscating during Compilation

Summary: Trail of Bits built MAST, an LLVM compiler-level obfuscation toolkit that combines opaque predicate insertion, code diffusion modeled on return-oriented programming, and Objective-C symbol mangling to defeat static analysis. The company cites Gauss malware as inspiration, noting Kaspersky Lab publicly asked for outside help decrypting part of it and researchers have been unable to deobfuscate it to this day; MAST's code diffusion slowed bzip2 by approximately 55% on x86 in testing.
Key Takeaway: The same obfuscation that kept Gauss unreadable to professional analysts is now a commercial product, and MAST ties each binary to a specific device so a captured copy is useless against other hosts - meaning the reverse-engineering barrier your own patches and proprietary code rely on is now something you buy rather than assume.

Read the original at Trail of Bits Blog ↗