Summary

  • Code obfuscation makes code look confusing and messy on purpose, making it harder for malicious actors to hide their activities from antivirus and security software.
  • Obfuscation is particularly important for C, C++ and C# programs as these are frequently used in both legitimate and malware processes.
  • Functions involved in code obfuscation include generate_random_name , which creates ambiguous variable names, and obfuscate_variables and obfuscate_functions, which rename variables and functions respectively.
  • Other functions such as add_junk_macros, split_lines and format_c_code add meaningless macros, break lines and alter code patterns respectively.
  • The obfuscate function manages the main processes of obfuscation, maintaining confusion and difficulty for analysts whilst keeping the code functional.
  • A full implementation of these methods is available at the linked git repository.

By Aleksa Zatezalo

Original Article