educationJan 27, 202615:27pending
Course 20 - Malware Analysis: Identifying and Defeating Code Obfuscation | Episode 3: Analyzing and Defeating String Obfuscation in Native
About this episode
In this lesson, you’ll learn about:
You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy
- String Obfuscation in Native Malware:
- Why string analysis is significantly harder in native code compared to interpreted languages.
- How compiled binaries store logic as machine instructions inside formats like the Portable Executable (PE), requiring reverse engineering rather than simple string extraction.
- Core Native String-Hiding Techniques:
- Stack Strings: Constructing strings dynamically on the stack using assembly instructions instead of storing them in readable sections of the binary.
- Checksum-Based Resolution: Hiding API and file names by comparing runtime-generated hashes against hard-coded checksums to build dynamic import tables without exposing cleartext strings.
- Encrypted Strings: Using encryption algorithms to keep strings unreadable until they are decrypted during execution.
- Static Analysis and String Recovery:
- Leveraging advanced extraction tools to recover stack strings that standard utilities cannot detect.
- Manually reconstructing strings in disassembly tools by converting numeric byte values into ASCII characters.
- Using cross-references (Xrefs) to confirm which functions are responsible for resolving APIs or decrypting strings.
- Dynamic Analysis and Debugging:
- Verifying static findings by stepping through execution in a debugger and observing register values and memory changes.
- Inspecting memory with appropriate commands to correctly display Unicode or multi-byte strings that contain embedded null bytes.
- Reversing Checksum Logic:
- Tracing low-level assembly operations such as bit rotations (ROL) and XOR instructions used to generate hashes from strings.
- Understanding normalization steps, such as converting strings to lowercase, to ensure consistent checksum comparisons across systems.
You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy
Get every episode summarized
Each time CyberCode Academy publishes, we email you a written briefing from the transcript — the topics, who appeared, and any specific claims, with the ad reads skipped.
Email me new episodesFree for 3 shows. No card needed.
No transcript yet
This episode has not been transcribed. Request it and it moves to the front of the queue.
More episodes
More from CyberCode Academy
Course 42 - Mobile Malware Analysis Fundamentals | Episode 9: Mastering Basic St...
CyberCode Academy
Sep 5, 202621:16completed
Course 42 - Mobile Malware Analysis Fundamentals | Episode 8: Static Analysis of...
CyberCode Academy
Sep 4, 202621:15completed
Course 42 - Mobile Malware Analysis Fundamentals | Episode 7: Malware Tools and...
CyberCode Academy
Sep 3, 202621:03completed
Course 42 - Mobile Malware Analysis Fundamentals | Episode 6: The Evolution and...
CyberCode Academy
Sep 2, 202622:42pending