View source for Obfuscation and Data Encoding

==Technique Description==
__NOTOC__ 
Malware uses obfuscation and data encoding to mask its malicious activities, to fully understand the malware we have to understand these techniques. Sometimes, they will choose simple ciphers or basic encoding functions that are easy to code and provide enough protection. Other times, they will use sophisticated cryptographic ciphers or custom encryption to make identification and reverse-engineering more difficult.

==Techniques==

Below is a list of all the obfuscation and data encoding techniques in {{SITENAME}}:

{| class="wikitable"
!colspan="20"|Obfuscation & Data Encoding
|-
!colspan="2"|Techniques
!Description
|-
!colspan="2"|XOR
|The XOR operation is the most common use by malware. This is because it is really easy to use and hide data. Basically a key is used and create the cipher text. XOR is a reversible function that means it uses the same function to encode and decode.
|-
!colspan="2"|Base64
|Base64 is used to represent binary data in an ASCII string. This is a simple encoding and commonly found into malware.
|-
!colspan="2"|Cesar/ROT
|The Caesar Cipher is a simply encoding algorithm used during the Roman Empire to hide secret message. 
|-
!colspan="2"|ROL
|Similar to Cesar cipher, which are simple rotation of the original strings. 
|-
!colspan="2"|Crypto
|Cryptography is often use in malware to protect against analysis or to perform malicious action (e.g: ransomware). 
|-
!colspan="2"|Custom
|Malware often uses custom encoding schemes. it could a complete custom one or a different layer of known algorithm (e.g: XOR+Base64).
|-
|}

==References==
Practical Reverse Engineering: http://amzn.to/2nY3W9e <br />