Seeing Through Themida's Code Mutation

Explore x86-64 machine code obfuscation through an in-depth analysis of Themida's code mutation feature in this 34-minute conference talk from Recon 2024. Begin with an introduction to Themida and the methodology used to study its code obfuscation implementation. Delve into the technical details of Themida's mutation-based code obfuscation techniques and discover the key research findings. Learn how to implement an attack based on symbolic execution that completely deobfuscates protected machine code and regenerates simplified, functional binaries. Presented by Erwan Grelet, a security researcher at Ubisoft's Game Security team with extensive experience as a low-level software engineer and expertise in software reverse engineering, vulnerability research, and software obfuscation.