TECH Signal 603 2 feeds carried it
Psychological Warfare in Reverse Engineering
REpsych shows how to encode an image into a program's control flow graph so that the graph visually reproduces the image.
Engineers who depend on control flow graph visualizations to understand binary behavior now see that such visualizations can be deliberately altered to obscure or mislead analysis. This highlights a potential obfuscation technique that raises the effort required for reverse engineering, especially when analysts rely on automated CFG rendering. Using the method requires generating special binaries and configuring CFG viewers to handle many nodes, which adds build and analysis overhead.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
REpsych converts a bitmap image into a program whose control flow graph nodes correspond to image pixels.
The generated binaries work reliably with IDA Pro and less consistently with other CFG viewers such as Hopper, BinNavi, and radare2.
Practical use is limited to small images (under 100×100 pixels) and may require increasing the node limit in the CFG viewer.
THE READ
What the cluster adds up to.
The REpsych toolset introduces a way to manipulate the control flow graph of a binary so that its graphical rendering matches an arbitrary input image. By treating each pixel as a basic block, the tool builds a program whose CFG, when displayed, looks like the picture. This demonstrates that CFG visual output is not a fixed property of the code but can be shaped deliberately.
To use REpsych an engineer saves a 24-bit bitmap in the project's gfx/ folder, runs "make image" (where image is the file name without extension), and obtains two program variants that implement different CFG layout strategies. The process assumes the analyst will view the resulting binaries with a CFG viewer capable of handling thousands of nodes, which may require raising the viewer's internal limit.
The technique works reliably with IDA Pro but only semi-reliably with alternative viewers like Hopper, BinNavi, and radare2, indicating that success depends on the specific rendering engine. Because each pixel becomes a node, the approach is practical only for relatively small images; larger pictures exceed typical node limits and produce unwieldy binaries. The method also adds to binary size and can slow down loading in the viewer.
Although the authors describe REpsych as a proof-of-concept with no claimed serious application, it illustrates a class of control-flow-based obfuscation that could be adapted or combined with other techniques. The underlying idea is detailed in the DEF CON presentation referenced in the material, and the work is credited to Christopher Domas.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER