Binary obfuscation is a way for developers to make the code of a program difficult to understand or reverse. It is also used to hide data from being seen easily. It can be categorized as an anti-reversing technique that increases the processing time for reversing. Obfuscation can also use encryption and decryption algorithms, along with its hardcoded or code-generated cipher key.

In this chapter, we will discuss ways how data and code are obfuscated. We are going to show how obfuscation is applied in examples including simple XORs, simple arithmetic, building data in the stack, and discussions about polymorphic and metamorphic code.  

In the malware world, binary obfuscation is a common technique used by viruses aiming to defeat signature-based anti-virus software. As a virus infects files, it obfuscates its code using polymorphism or metamorphism.

In this chapter, we will achieve the following learning outcomes:

• Identifying data being assembled on the stack
• Identifying data being XORed or deobfuscated prior to use
• Modifying data in text or other segments, and assembling on the heap