Not at all,this helps analyze malware not create it. There is no security obtained by preventing reverse engineering of a binary. If anything this makes adversaries ability to hide their methodoligies harder,a strategic advantage for someone like the US government.
I am not sure I completely agree. If I know how my adversary detects and studies stealth code, I may be able to design better stealth code that is better at evading their methods of detection.
I mean the evolution of stealth tech in military has followed a similar path. As radar systems improve over decades, they keep on working on new ways to evade detection for aviation/missile tech.
I understand the high level point of good tools being more widely available to the white hat crowd, but I am trying to understand the argument that this is 100% better in all cases and there are no downsides.
It's just another disassembler. There are a bunch of them already. It is, to the state of the art of reverse engineering, about as big a deal as the first release of Sublime Text was for programmers. It's hard to think of a "downside", or at least one that wouldn't be equivalent to "Sublime Text made it easier for people to code malware".
The main cat-and-mouse game with malware isn't in making disassembly/decompilation hard--quite frankly, the problem is simply too trivial--it's in trying to keep the malware analysis people from finding the malware in the first place. The "I'm being run in a VM for malware analysis, so don't trigger my payload in the first place" game.
Nothing is ever 100% better with no downsides, except maybe drinking water. That's a silly standard.
The upsides of people getting it who aren't willing to break the law outweigh the downsides of bad people getting it more easily. Probably. That's the best you can expect with security tools.
