On: Blackrota: obfuscated backdoor written in Go

[azalemeth]

> 'Having worked on really "heavily obfuscated" code (flattened control flow, functions implemented in obfuscated VMs, custom incompatible ABI, cryptographic encryption of code, etc.), this gobfuscator looks comparatively easy :) '

For any HN readers who have not already encountered the MOVfuscator [1] I cannot recommend this Blackhat talk highly enough -- the x86 MOV instruction is turing complete, and it flattens arbitrary code to MOVs. It's also the only time I've ever seen brainfuck being used as a seriously sensible intermediate language ;-)

[1] https://www.youtube.com/watch?v=R7EEoWg6Ekk [I think this is the preferred link!]

[simcop2387 → azalemeth]

It of course also runs doom. Sort of. https://github.com/xoreaxeaxeax/movfuscator/tree/master/vali...

[eknkc → simcop2387]

The "sort of" part is fantastic:

The mov-only DOOM renders approximately one frame every 7 hours, so playing this version requires somewhat increased patience.

[azalemeth → eknkc]

I might finally beat nightmare!