Code obfuscation makes it harder for a security analyst to understand the malicious payload of a program. In most cases an analyst needs to study the program at the machine code level, with little or no extra information available, apart from his experience. An unexperienced analyst is confronted with a steep learning curve, as understanding unobfuscated machine code already requires some skills. We have built LOCO, a graphical, interactive environment to help a security analyst improving his skills in understanding obfuscated code.
Citation:
Matias Madou, Ludo Van Put, Koen De Bosschere, "Understanding Obfuscated Code," icpc, pp.268-274, 14th IEEE International Conference on Program Comprehension (ICPC'06), 2006