The 2008 Pwnie Winner For Most Innovative Research

Defeating a VM packer with a decompiler written in OCaml

Rolf Rolles

This work describes an innovative attack on virtualizing protections. The idea is to create a compiler with a poly/metamorphic front-end that deobfuscates and recompiles the proprietary bytecode back into x86. The compiler was implemented in OCaml and successfully defeated multiple virtualizing protectors.