GCC Code Obfuscation Plugins GOAT - Part 2 (Munger)

GOAT munger is a GCC plugin to encode all ASCII strings and decode them at run-time.

Setup
~~~~~~~~~~~~~~
$ sudo apt-get install software-properties-common

Install older GCC toolchain:
$ sudo add-apt-repository ppa:ubuntu-toolchain-r/test
$ sudo apt-get update
$ sudo apt-get install g++-4.9
$ sudo apt-get install gcc-4.9-plugin-dev

Get GOAT tools:
$ git clone https://github.com/enferex/GOAT-Plugs.git

Manage local GCC versions:
$ rm /usr/bin/gcc
$ rm /usr/bin/g++

$ ln -s /usr/bin/gcc-4.9 /usr/bin/gcc
$ ln -s /usr/bin/g++-4.9 /usr/bin/g++

$ gcc -v
$ g++ -v

References
~~~~~~~~~~~~~~
GCC plugins API
https://gcc.gnu.org/onlinedocs/gccint/Plugin-API.html

GCC Obfuscation Augmentation Tools
https://github.com/enferex/GOAT-Plugs

Experiments with GCC plugins
https://github.com/rofirrim/gcc-plugins

A simple plugin for GCC – 3 Parts
https://thinkingeek.com/2015/08/16/a-simple-plugin-for-gcc-part-1/
https://thinkingeek.com/2015/08/16/simple-plugin-gcc-part-2/
https://thinkingeek.com/2015/08/17/simple-plugin-gcc-part-3/

GCC Internals manual
https://gcc.gnu.org/onlinedocs/gccint/
---------------------------------------------------------------------------------------------------
Follow us on Twitter : https://twitter.com/reversinghub
Github : https://github.com/reversinghub

If you liked this video and you want to learn hands-on how to analyse malware, with real samples and practical exercises, find us on Udemy :

https://www.udemy.com/course/reverse-engineering-essentials/?referralCode=D738F461C93A2CD029FB

---------------------------------------------------------------------------------------------------

Want to support us continue to make great content? Buy us a coffee :
https://ko-fi.com/reversinghub

Thank you ?