0

I'm trying to reverse a binary with IDA and it seems to be obfuscated, I have a variable: "EnableTeleportEffect" that I want to modify the values of later.

When jumping from the strings window, this is what I get:

.rdata:00007FF7C386F488 aEnableteleport:                        ; DATA XREF: sub_7FF7C1766A90+1533↑o
.rdata:00007FF7C386F488                 text "UTF-16LE", 'EnableTeleportEffect',0
.rdata:00007FF7C386F4B2                 align 8

When I jump to the xref, this is what I get:

.text:00007FF7C1767F97 loc_7FF7C1767F97:                       ; CODE XREF: sub_7FF7C1766A90+952↑j
.text:00007FF7C1767F97                 lea     rcx, dword_7FF7C4378B40
.text:00007FF7C1767F9E                 call    _Init_thread_header
.text:00007FF7C1767FA3                 cmp     cs:dword_7FF7C4378B40, 0FFFFFFFFh
.text:00007FF7C1767FAA                 jnz     loc_7FF7C17673E8
.text:00007FF7C1767FB0                 call    sub_7FF7C17D2AB0
.text:00007FF7C1767FB5                 mov     rbx, rax
.text:00007FF7C1767FB8                 call    sub_7FF7C17D2AB0
.text:00007FF7C1767FBD                 mov     r8d, 1
.text:00007FF7C1767FC3                 lea     rdx, aEnableteleport ; "EnableTeleportEffect"
.text:00007FF7C1767FCA                 lea     rcx, [rbp+arg_10]
.text:00007FF7C1767FCE                 call    sub_7FF7C1AE2B90
.text:00007FF7C1767FD3                 mov     rcx, rbx
.text:00007FF7C1767FD6                 mov     rdx, [rax]
.text:00007FF7C1767FD9                 call    sub_7FF7C152C1F0
.text:00007FF7C1767FDE                 lea     rcx, dword_7FF7C4378B40
.text:00007FF7C1767FE5                 mov     cs:qword_7FF7C4378B38, rax
.text:00007FF7C1767FEC                 call    _Init_thread_footer
.text:00007FF7C1767FF1                 jmp     loc_7FF7C17673E8

And when I jump to that xref, i get this:

.text:00007FF7C17673D9 loc_7FF7C17673D9:                       ; CODE XREF: sub_7FF7C1766A90+8A6↑j
.text:00007FF7C17673D9                 mov     eax, [r14]
.text:00007FF7C17673DC                 cmp     cs:dword_7FF7C4378B40, eax
.text:00007FF7C17673E2                 jg      loc_7FF7C1767F97
.text:00007FF7C17673E8

And it keeps going for quite a bit.

This is code obfuscation right?

Improve this question

1 Answer 1

Reset to default
2

At first glance it does not look like code obfuscation, just like normal complexity. From the snippet I cannot tell you where the actual value is that you want to modify. Maybe the string is a key in a map, maybe it is just used for parsing and/or printing.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.