Reversing With Dynamic Data Resolver

Malware Blue Team Village1 hrOpen on YouTube ↗

Demonstrates Dynamic Data Resolver, an IDA Pro plugin leveraging DynamoRIO to unpack and analyze obfuscated malware.

Summary

Binary Instrumentation with Dynamic Data Resolver

Dynamic Data Resolver (DDR) is a plugin for IDA Pro that leverages the DynamoRIO dynamic binary instrumentation framework to monitor and analyze running binaries.

Overcoming Complex Malware Obfuscation

Modern malware often employs multi-layered packing, encrypted payloads, and dynamic API resolving to frustrate static analysis, requiring dynamic visibility into memory execution.

Automating Unpacking and Analysis in IDA Pro

The presentation demonstrates practical workflows for instrumenting hostile binaries, extracting decrypted strings and payloads from memory, and feeding resolved symbols directly back into the IDA workspace.

Related talks

Main Stage·1 hr 16 min

DEF CON
Malware
Date: Jul 2004
Location: Las Vegas

Attacking Obfuscated Code: Automated Deobfuscation Techniques

Chris Eagle

Chris Eagle explores attacking obfuscated code: automated deobfuscation techniques at DEF CON 12, examining reverse-engineering and practical defenses.

reverse-engineeringdeobfuscationbinary-analysis+1

Blue Team Village·43 min

DEF CON
Malware
Date: Aug 2022
Location: Las Vegas

Project Obsidian: Reverse Engineering Malware - Analyzing Obfuscated PowerShell

Project Obsidian

Project Obsidian explores methods for decoding and analyzing heavily obfuscated PowerShell scripts used in initial access payloads.

powershelldeobfuscationmalware-analysis+2

Creator Stage·48 min

DEF CON
Malware
Date: Aug 2025
Location: Las Vegas

Go Malware Meets IoT: Challenges, Blind Spots, and Botnets

Asher Davila

Examines the challenges of analyzing Go-based IoT malware and demonstrates reversing techniques using the Pumabot surveillance botnet as a case study.

malwaregolangiot+2