정보보호대학원에서는 9월 29일 오후 4시에 아래와 같이 세미나를 개최하고자 합니다. 많은 참석 부탁드립니다.

일 시: 26.9.29 (화) 16:00∼

제 목: Binary Obfuscation and Deobfuscation with AI Agents

강 사: 최석우 실장 (국가보안기술연구소)

장 소: N1 201호

※ 세미나 시작시간 5분전에 준비하여 주세요.

 

 

ㅡㅡㅡ

 

 

♣Title: Binary Obfuscation and Deobfuscation with AI Agents

 

 

♣Abstract:

Binary obfuscation remains a major challenge in malware analysis. Traditionally, reverse engineers have addressed control-flow flattening, packing, and code virtualization through manual analysis and specialized techniques such as symbolic execution, emulation, and binary transformation. The emergence of frontier AI models and tool-using AI agents is beginning to change this workflow.

 

This talk explores how AI agents are changing practical binary deobfuscation through malware-analysis case studies. First, using malware protected with an OLLVM variant, we compare conventional approaches to control-flow flattening with an AI-agent-based approach for identifying flattened control-flow structures and recovering the original control flow.

 

We then examine commercial protectors such as VMProtect and Themida. Drawing on our recent study across multiple protector versions, we present the use of Heaven’s Gate and demonstrate how AI agents can assist in implementing cross-architecture tracing for unpacking protected binaries.

 

Finally, we explore VMProtect virtualization and examine how current frontier models analyze virtualized malware. We contrast black-box, behavior-oriented deobfuscation with staged code transformation that progressively recovers program semantics. The talk concludes with the challenges posed by stronger virtualization techniques and discusses how obfuscation may evolve to resist AI-agent-driven reverse engineering.

 

♣Bio:

Seokwoo Choi is a Principal Researcher and Section Manager at the National Security Research Institute (NSRI) in South Korea. He received his Ph.D. in Computer Science from KAIST. His research interests include malware analysis, binary deobfuscation, anti-reverse engineering techniques, and AI-assisted reverse engineering. He has conducted research on practical binary analysis and deobfuscation techniques for more than 15 years, covering binary similarity, API deobfuscation, program synthesis-based deobfuscation, and analysis of hardened applications. His recent research focuses on applying AI and AI agents to malware analysis and reverse engineering, with particular emphasis on automated deobfuscation and the analysis of complex software protection techniques.