Skip to content

GSOC-2026.md

Latest commit

 

History

History
84 lines (62 loc) · 3.61 KB

GSOC-2026.md

File metadata and controls

84 lines (62 loc) · 3.61 KB
Raw

GSoC 2026 Project Ideas

Windows PE Binary-to-Binary Obfuscation Pipeline

Summary

Implement a working binary-to-binary obfuscation pipeline for Windows PE executables. The pipeline will lift binaries to LLVM IR, apply obfuscation passes, and recompile to an obfuscated PE binary.

Problem

Currently oaas only supports source-to-binary obfuscation. Many real-world scenarios require obfuscating existing binaries where source code is unavailable:

  • Legacy software protection
  • Third-party library hardening
  • Security research and CTF challenges
  • Protecting pre-compiled dependencies

Starting Point

The pipeline architecture is documented in docs/PIPELINES.md (Section 2: Windows Binary Lifting Pipeline). The planned stages are:

  1. Stage 1 - Safe Windows Build (binary_obfuscation_pipeline/windows_build/)

    • Validate binary for unsupported constructs
    • Reference: MinGW-w64 toolchain with -O0 -g -fno-inline -fno-exceptions

  2. Stage 2 - Ghidra CFG Export (binary_obfuscation_pipeline/mcsema_impl/ghidra_lifter/)

  3. Stage 3 - Binary Lifting (binary_obfuscation_pipeline/mcsema_impl/lifter/)

    • Lift CFG to LLVM IR using McSema or alternative (RetDec, rev.ng)
    • Upgrade bitcode to LLVM 22 dialect for compatibility with existing passes

  4. Stage 4 - OLLVM Pass Application (binary_obfuscation_pipeline/mcsema_impl/ollvm_stage/)

    • Apply safe subset of passes: substitution, linear_mba, limited flattening
    • Integrate with existing pass infrastructure in cmd/llvm-obfuscator/plugins/

  5. Stage 5 - Recompilation

    • Compile obfuscated LLVM IR back to PE binary
    • Integrate with existing CLI via new --input-binary flag

Scope

  • Implement end-to-end pipeline for simple C binaries (no exceptions, no complex C++)
  • Dockerized environment for reproducible builds
  • CLI integration with existing obfuscate command
  • Test suite with sample PE binaries
  • Documentation on limitations and supported constructs

Deliverables

Deliverable Description
Working pipeline PE binary in, obfuscated PE binary out
Ghidra scripts Headless CFG extraction for PE files
Lifting stage McSema/RetDec integration with LLVM 22
CLI integration --input-binary flag for binary input
Test suite Sample binaries with validation
Documentation Usage guide and known limitations

Technical Details

Attribute Value
Skill level Intermediate
Languages Python, C++, Bash
Size Medium (~175 hours)
Prerequisites Familiarity with PE format, basic reverse engineering, LLVM IR concepts
Mentors TBD

Relevant Links

  • McSema - Binary lifter (LLVM 10-17)
  • RetDec - Retargetable decompiler with LLVM backend
  • rev.ng - Modern binary analysis platform
  • Ghidra - NSA's reverse engineering framework
  • LIEF - Library for PE/ELF parsing and modification

Getting Started

  1. Read docs/PIPELINES.md and docs/ARCHITECTURE.md
  2. Set up the development environment per CONTRIBUTING.md
  3. Experiment with Ghidra headless analysis on a simple PE binary
  4. Try lifting a minimal binary with McSema or RetDec
  5. Open an issue to discuss your approach before starting implementation