PHDays CTF Quals 2014 Write-up: "turututu"

Reversing this program is made frustrating by the fact that it was written in OCaml, generating many instructions that maintain internal structures, check stack alignment, etc.  It becomes clear that in order to get the flag, we must pass the checks performed by each function within a list.

Unambiguous Encapsulation: Defending Against "Packet in Packet" Attacks

Spill and Ossman propose using a special error correcting code that has a property they call “isolation.” They call this family of codes “Isolated Complementary Binary Linear Block Codes” (ICBLBC). We implemented a generator that encodes the ICBLBC constraints as a Satisfiability Modulo Theories problem and used Digital Operatives’ proprietary constraint optimizer to enumerate all feasible solution codes.

Programmatic String Deobfuscation in .NET Malware

In .NET assemblies, String obfuscation is most often implemented by passing a series of nonsensical arguments to a deobfuscation method which then returns the deobfuscated string to a method. In this post, you will learn some quick and dirty methods of using reflection to automate string deobfuscation in .NET assemblies.