Hacker News Reader

Comment by IiydAbITMvJkqKf | Hacker News Reader

Devirtualization is not the correct term. Devirt is a common compiler optimization, where a call through a function pointer is replaced with a direct call to the only possible target.

View on HN

While I think you are right about devirtualization being used to mean that in the world of compilers, in the realm of code protection/obfuscation, obfuscating code by making in run in an embedded virtual machine is called virtualization, with the reverse being called devirtualization.

It's hard to put a exact date on the origin of "[de]virtualization" being used to refer to code obfuscation, but it's definitely been used since at _least_ 2007 in related academia. [0],

[0]: Kang, Min Gyung, Pongsin Poosankam, and Heng Yin. "Renovo: A hidden code extractor for packed executables." Proceedings of the 2007 ACM workshop on Recurring malcode. 2007

I also hate it when technical terms are needlessly overloaded, and I can only assume it's often because our field is fractured enough that even widely known terminology might not be known in every little niche. But one has to wonder... don't people use Google when they invent new terms?

Either way, I found this paper that describes a certain obfuscation technique as virtualization [1]. I can only assume that devirtualization is meant as the corresponding deobfuscation technique. So maybe it is the correct, if unfortunate, term. Quote:

> Virtualization-obfuscation replaces native code in a binary with semantically equivalent and self-defined bytecode, which, upon ex- ecution, is interpreted by a custom virtual machine.

[1] https://cis.temple.edu/~qzeng/papers/deobfuscation-icics2017...

These Lua communities are often where people start learning programming (me included). So a lot of terminology is often community made. I remember we referred to this as obfuscation in the garrysmod community, but it doesn't really surprise me these people call it "devirtualization".

I remember relearning all of these terms were a big challenge when stepping outside of Lua.

You are incorrect. I work with malware professionally, defeating a VM obfuscator is often called devirtualizing. There is also the compiler optimization term as you say, but terms can mean more than one thing...

While I was initially confused by the terminology, I think it kinda makes sense. As an example of other people using the term in this way, see the Tigress obfuscator:

https://tigress.wtf/introduction.html

Reply on news.ycombinator.com