Reproduce “Pushan: Trace-Free Deobfuscation of Virtualization-Obfuscated Binaries” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Ashwin Sudhir, Zion Leonahenahe Basque, Wil Gibbs, Ati Priya Bajaj, Pulkit Singh Singaria, Mitchell Zakocs, Jie Hu, Moritz Schloegel and 4 more
PUSHAN offers a system for trace-free deobfuscation of virtualization-protected binaries, recovering complete control flow graphs and generating high-quality C pseudocode directly consumable by decompilers. The method analyzes over 1,000 diverse obfuscated targets, producing isomorphic CFGs for 999 of them, and successfully analyzes real-world malware in 85 minutes.
Key insights
- Bounding symbolic state at basic block boundaries (using `block address, VPC` tuples) prevents path explosion while still recovering comprehensive control flow.
- Eliminating reliance on path satisfiability for branch resolution by treating the SMT solver as an expression simplifier significantly improves scalability and robustness against obfuscation countermeasures.
- A multi-stage simplification pipeline, including standard, stack-variable, loop-specific, and obfuscator-specific rules, effectively transforms a flat, obfuscated CFG into a semantically equivalent, cleaner representation.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.