REpsych: Turning Code Logic Into Visual Distractions for Reverse Engineers

Christopher Domas has developed REpsych, a proof-of-concept toolset that generates functioning programs designed to render their control flow graphs (CFGs) as specific images. By treating the structural logic of a binary as a canvas, the tool allows developers to embed visual "easter eggs" or distractions that appear only when the code is viewed through specialized analysis software.

According to the project's GitHub repository, REpsych works by translating 24 BPP bitmap images into executable programs. In this process, each individual pixel of the source image is converted into a basic block, which serves as a node within the program's CFG. The tool was designed for high reliability with IDA Pro, though Domas notes it also works semi-reliably with other industry viewers such as radare2, BinNavi, and Hopper. The technique was first detailed during a presentation at DEF CON 2015.

The Role of CFGs in Analysis

Reverse engineering typically relies heavily on Control Flow Graphs to decode the internal logic of a binary. These graphs provide a visual map of how a program transitions from one block of code to another, allowing an analyst to quickly identify loops, conditional branches, and overall program architecture. By exploiting the way these graphs are rendered by software, REpsych turns the very tool analysts use for clarity into a medium for visual manipulation.

A Psychological Vector

While REpsych was presented as a non-serious demonstration, it highlights a distinct psychological vector in the field of software protection. The ability to create visually overwhelming or misleading CFGs introduces a form of "psychological warfare" into the reverse engineering process. By forcing an analyst to encounter meaningless visual patterns or intentionally confusing structures, a developer can frustrate the researcher and significantly slow down the analysis process.

Implications for Software Protection

This approach shifts the focus from traditional obfuscation—which typically aims to make code logically incomprehensible—to a method that targets the human analyst's perception. Rather than hiding the logic, the developer creates a visual environment that wastes the analyst's time and mental energy.

What's Next

As a proof-of-concept, REpsych serves as a reminder that the tools used to analyze software are themselves subject to manipulation. While the current implementation focuses on rendering static images, the project opens the door to further exploration of how visual representation can be used to mislead or deceive those attempting to audit binary code.