#MixedBooleanArithmetics is the process of using the integers returned from arithmetic operators, with bitwise operators such as AND, OR, XOR, NEGATE, etc. It has many practical applications, including creating #OpaquePredicates, #ObfuscatingPointers, #OrdinalObfuscation before deobfuscating it in a LoadLibraryW -> GetProcAddress() function, or running #junkcode to fool sandboxes. The latter is particularly interesting because instead of merely exiting, we can keep testing for sandbox conditions
#mixedbooleanarithmetics #opaquepredicates #obfuscatingpointers #ordinalobfuscation #junkcode