Research in (Virtualization-) Code Obfuscators?

[miraculix]

Hi,

I want to write my Bachelor's thesis on Code obfuscators in DRM. The plan was for me to describe different protection features and then implement some of them by writing my own little code obfuscator.

However, now the uber-boss of the department intervened because he thinks the topic lacks an adequate "research question". That is, the thesis has to answer/solve a concrete problem or question, not just reimplement existing techniques. He might be right, I guess.

But I cant think of a good and appropriate "research question" in this way.

Can anyone imagine a good research question in that regard I might cover?

 

[If this post is in the wrong section, please move it.]

[Kurapica]

These days I'm reading this PDF, It could be related to your new project.

Automatic Deobfuscation and Reverse Engineering of Obfuscated Code

http://arizona.openrepository.com/arizona/bitstream/10150/613135/1/azu_etd_14572_sip1_m.pdf

[kao]

On 5/10/2017 at 3:29 PM, miraculix said:

... he thinks the topic lacks an adequate "research question". That is, the thesis has to answer/solve a concrete problem or question, not just reimplement existing techniques.

Well, yes. Academic studies are about research and invention.  It all depends on your interests, skills and abilities. Pick something you really like and work on that. Plan on expanding on that research during your Masters/PhD studies.

From the top of my head:

* Measuring performance impact of code virtualizers on CPU-intensive code. For example, measure how applying different protections slow down x265 encoder/decoder;
* Impact of code virtualizers on detection abilities of anti-malware solutions. For example, take some leaked malware source, compile and protect it with different virtualization solutions and see how different AVs handle that;
* Automatic generation of new code VMs. Figure out a way to automatically generate random VM and virtualize code, so that each VM has to be analyzed from scratch to defeat it.
* (Holy Grail) Analysis and devirtualization of code VMs. That's more like Masters/PhD theme. Bachelors research could, for example, hook into .NET Core interpreter/JIT engine and extract code from Eazfuscator/KoiVM protected .NET assemblies.

[XenocodeRCE]

@op : If needed I can provide executable files for KoiVM protection, so you can do analysis for your bachelor. I've been there too.

[Holy]

4 hours ago, XenocodeRCE said:

@op : If needed I can provide executable files for KoiVM protection, so you can do analysis for your bachelor. I've been there too.

May I have some samples too please? I'm curious in how they implement a VM in .NET.

[XenocodeRCE]

1 hour ago, Holy said:

May I have some samples too please? I'm curious in how they implement a VM in .NET.

I said to OP to help him for his bachelor.