is the process of using the integers returned from arithmetic operators, with bitwise operators such as AND, OR, XOR, NEGATE, etc. It has many practical applications, including creating , , before deobfuscating it in a LoadLibraryW -> GetProcAddress() function, or running to fool sandboxes. The latter is particularly interesting because instead of merely exiting, we can keep testing for sandbox conditions

#mixedbooleanarithmetics #opaquepredicates #obfuscatingpointers #ordinalobfuscation #junkcode

Last updated 2 years ago