Reverse › Module 8 › Lesson 3
Obfuscation Named
Obfuscation literacy — control-flow flattening, opaque predicates, string encryption named; read Ghidra output on $RE_LAB without building obfuscators for crime.
Visual · t23_obfuscation_named
Obfuscation = code hiding named. Read on $RE_LAB. Original Cyberlium.
Opening
Obfuscated code is a maze — learn to name the maze types on CTF bins, not to build mazes that hide ransomware.
Obfuscation hides intent: control-flow flattening (dispatcher loops), opaque predicates, bogus control flow, string encryption/decryption stubs, junk instructions, and VM-based protectors at literacy level. Analyst approach: identify dispatcher pattern in Ghidra graph, locate string decrypt routine, dynamic breakpoint on decrypt return, rename honestly. Cyberlium teaches naming and high-level reading on $RE_LAB CTF and malware-class samples — NOT writing obfuscators for malware campaigns, NOT obfuscating piracy tools, NOT defeating commercial VMProtect for stolen software. Document technique class and analyst time cost — purple value: noisy graphs signal protected or malicious intent.
1. Obfuscation patterns
Flattening: single state variable dispatcher; opaque predicates: always-true/false branches; string encrypt: loop xor near entry.
Ghidra decompiler ugly graph — literacy expects slow read, not instant pseudocode.
Command guide
Try these commands — Obfuscation patterns
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Obfuscation literacy — https://docs.binary.ninja/ (opaque predicates / string hiding concepts) strings limits — https://man7.org/linux/man-pages/man1/strings.1.html (hidden strings in YOUR toy) IDA decompiler — https://docs.hex-rays.com/ (deobfuscation literacy on authorized targets)
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (binutils) Built-in (vim-common / xxd)
Command — copy this
sudo apt install binutils
macOS: Built-in (Xcode CLI) or brew install binutils
Windows: Use WSL or install binutils Use WSL or Git Bash xxd Use WSL binutils
═══ LINUX / macOS ═══
Command — copy this
export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
cat > "$LAB_RE/src/obfusc.c" <<'EOF'
#include <stdio.h>
static const char k[] = { 's','e','c','r','e','t','-','l','a','b',0 };
int main(void) {
char buf[16];
for (int i = 0; k[i]; ++i) buf[i] = (char)(k[i] ^ 0x5a);
for (int i = 0; k[i]; ++i) buf[i] ^= 0x5a;
printf("token=%s (YOUR obfuscated toy)
", buf);
return 0;
}
EOFCommand — copy this
gcc -Wall -O0 -g -o "$LAB_RE/bin/obfusc" "$LAB_RE/src/obfusc.c" strings "$LAB_RE/bin/obfusc" | grep -E 'token|secret' || echo 'strings miss XOR array — check xxd/objdump' xxd "$LAB_RE/bin/obfusc" | grep -E '73 65 63 72 65 74' | head -3 objdump -d "$LAB_RE/bin/obfusc" | grep -A10 '<main>:' | head -12
Primary tools to practice this lesson: strings, xxd, objdump. Reference sites: Obfuscation literacy (https://docs.binary.ninja/); strings limits (https://man7.org/linux/man-pages/man1/strings.1.html); IDA decompiler (https://docs.hex-rays.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Analyst response
Name pattern in notes; dynamic on decrypt function; do not automate deobfuscator weaponization.
Cross-link anti-debug — obfuscated crackmes often pair both on $RE_LAB.
3. Ethics
Recognition for CTF writeup and malware class — not DRM crack pipeline.
Refuse homework to obfuscate real malware or piracy loaders.
4. What you ship: obfuscation named card
Four pattern names + Ghidra graph clue + dynamic decrypt note + refuse weaponize.
5. What you record before the next lesson
Obfuscation named card path.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Build obfuscated ransomware loader for 'advanced lab.'
Right
Obfuscation named card from $RE_LAB CTF. Next: Anti Lab.
Mission: obfuscation named card
1) Define four obfuscation patterns. 2) Ghidra clue for flattening. 3) Dynamic strategy for string decrypt. 4) Refuse malware obfuscator line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Flattening vs junk code — quick tell?”
Knowledge Check
APPLY: Obfuscation literacy on Cyberlium:
Multiple choice
Knowledge Check
APPLY: True or False: Obfuscate piracy tools for homework.
True or False
Knowledge Check
APPLY: Control-flow flattening shows:
Multiple choice