Questions tagged [deobfuscation]
Techniques to remove obfuscation from a piece of program.
157
questions
0
votes
1
answer
125
views
How do I deobfuscate this JavaScript? [closed]
link to the code:
https://drive.google.com/file/d/1Y-M-gkYpzkrECh6gpsVyo_ZMO5ZMgdiW/view
I tried using this site (https://lelinhtinh.github.io/de4js/), but it still accomplishes almost nothing
youtube ...
- 1
0
votes
1
answer
96
views
i need software to decode this subtitle xml file, anyone know what it encodes with?
This is a subtitle file encoded by xml, is there any way to decode this xml file to srt?
Subtitle link xml
0
votes
1
answer
130
views
Deobfuscating big files
I'm trying to deobfuscate JS file, but it's to big for online services, like deobfuscate.io. I just can't copy content of file, because it have ~4M symbols. All deobfuscate services proccess file in ...
- 1
0
votes
0
answers
107
views
What obfuscator do this?
So, first if i try to use DnSpy all the methods are empty and some of them returns decompiler exceptions like
System.ArgumentOutOfRangeException: Non-negative number required. (Parameter 'length')
...
1
vote
1
answer
95
views
How can i remove dead code and opaque predicates?
I have the following problem on my agenda: There is an obfuscated .exe (this is a virus that I am investigating) in addition to having an MBA, etc. bullshit, he has Opaque predicates and dead code, I ...
- 11
1
vote
1
answer
536
views
How can I extract the password from an installer/self-extracting archive?
I have an installer/self-extracting archive. The executable file has an embedded ZIP archive into it (like many other installers). The ZIP archive is encrypted with a password.
The installer DOES NOT ...
- 119
2
votes
1
answer
201
views
Deobfuscating IOS dll file (I think arm64)
I am just starting out my journey with modding IAP files. I use dnSPY to find the offsets of the methods I want to change and then use an arm64 to hex converter to then apply these changes.
I have ...
4
votes
0
answers
60
views
Decyphering 8kbps audio file format used in Solar Chanting Lotus
I'm trying to reverse engineer a solar powered chanting lotus flower so that I might replace the built in audio with something more interesting. The main chip (JL16B-083A - haven't been able to find ...
1
vote
0
answers
84
views
Program Analysis on a Wargame Binary
I've recently took it upon myself to research more about reverse engineering, I'm currently testing my intermediate skills on various CTF hosting sites. Interestingly enough I have come across a ...
- 11
2
votes
0
answers
125
views
How can i Lifting x86_64 assembly code to LLVM-IR
I'm researching of virus and I'm faced with the task of deobfuscating its virtual machine. I chose to do this through LLVM and I had a question, where can I see a simple example of lifting ...
- 21
1
vote
0
answers
242
views
deobfuscate Dexgaurd obfuscated code
I was reversing an apk. the code detects whether the apk is running on a rooted device or not. if it is rooted or an emulator it will stop and close out. so this is the snippet code which I think it ...
- 309
4
votes
0
answers
86
views
Decrypt Keybindings for EVE Online
I've had this idea for a while for a tool I'd like to make to assist people in getting used to keybinds in EVE Online. Not sure how useful it'd actually be, but seems like a fun project nonetheless.
I'...
- 41
2
votes
1
answer
191
views
Automatic deobfuscation of Java class/method/parameter names with access to old non obfuscated sources
I am currently trying to de-obfuscate a Java program (i.e. find each class name and namespace, each method name and each method parameter name).
To do so, I started by using Enigma (the fork from ...
- 123
1
vote
0
answers
215
views
x32dbg : exe with different code address when running
I have a 32 bits exe that works only when there is a specific usb flash disk inserted. On my new laptop, I only have a single USB port, so I want to make it works without the original key, or from a &...
- 141
1
vote
1
answer
90
views
How to debug an obfuscated self hashing program?
I need to understand what the following obfuscated application does:
interpreter.py:
string = "lambda x : obfuscated_code_to_interpret_variable_x"
interpreter = eval(string)
...
- 111
2
votes
0
answers
124
views
De-Obfuscating/unminifying a JS code [not duplicate]
I have come across a lot of similar questions on the same heading but unfortunately, none of them provided me with the intended results.
I have a piece of code which, initially I am trying to ...
- 21
0
votes
1
answer
385
views
Decompile obfuscated jar file
Tried java-deobfuscator and other things, detect said it was allatori protected so tried the relevant transformers but to no avail.
Please can someone help, I'm happy to tip for your help :)
https://...
2
votes
0
answers
4k
views
How do I reverse engineer an Electron compiled file?- a JSC Bytenode file
I have a bytenode JSC file - which is described as:
This tool truly compiles your JavaScript code into V8 bytecode, so
that you can protect your source code. It can be used with Node.js, as
well as ...
- 103
0
votes
1
answer
1k
views
Deobfuscator and decompiler for .NET [closed]
Which are the most common and useful deobfuscators and decompilers for .NET .dll files?
- 11
0
votes
2
answers
433
views
Reversing an obfuscation through a long linear switch statement
I have a program (ELF, 32 bits) that is probably quite short and simple, but which have been obfuscated with the following construction:
i = 0
switch(i):
case 0:
one small instruction
...
- 11
0
votes
0
answers
448
views
How to deobfuscate Java application
Hi i am unable to deobfuscate the Advanced String Obfuscation Jar on tryHackMe
I tried
dumping the classes using a dumper javaagent
deobfuscate the jar with java-deobfuscator
threadtear functions
...
1
vote
0
answers
192
views
ZKM 15 Deobfuscation (Jar file) [closed]
Hello I am looking for someone who can deobfuscate a ZKM 15 obfuscated jar file for me.
I am willing to pay money for this.
I mostly just need Strings from the jar file. It doesn't need to be perfect.
...
- 11
1
vote
0
answers
148
views
How can I decode this Malicious php code?
I found this backdoor on a client's website.
https://github.com/baogiaphucthinh/Malicious-php/blob/main/1259da6sc.php (original file)
I have gotten rid of it and realise it's an obfuscated script but ...
- 11
1
vote
0
answers
61
views
RE on firmware images that seem to use weak encryption/obfuscation. Robot vacuum
I have been playing with some robot vacuums that utilize very basic navigation, and I am wanting to play around with my own provisioning along with adding a Rpi to augment features.
These vacuums are ...
- 41
0
votes
0
answers
66
views
Determining a password-hashing function knowing plaintext + output
I have a password that has been stored and I'd like to figure out how it's been 'transformed' to be stored in my database.
The plaintext password is:
k4oK203$
And the password as it is stored 'crypted'...
- 101
1
vote
2
answers
3k
views
Any good places to learn about JS de-obfuscation?
I am trying to make a bot on a specific website, so I have to reverse a lot of JS scripts. The reversing it self is not that hard but the de-obfuscation is. Lots of the scripts are obfuscated with ...
- 11
0
votes
1
answer
175
views
How to clean obfuscated code from fake if statements?
I am trying to deobfuscate javascript code. Firstly I extracted strings from big array. Then I saw many parts like this
There is only one line of code which makes sense. Is there any Node.js cleaner ...
1
vote
1
answer
705
views
devirtualize? or what is this obfuscator? and how to get rid of this
from previous question i still dont get any info or any process at all... now i asking again with this question is this virtualize code or something? i try many thing and it still didnt work [i unpack ...
- 15
1
vote
1
answer
716
views
Is there a way in ida pro to see the address where I have explicitly marked them as code or data, etc?
I'm analyzing an obfuscated binary. IDA did a pretty good job of doing the initial auto-analysis. Later, I went through and marked some sections as undefined, or code, etc. Now IDA can't re-create ...
- 11
2
votes
1
answer
355
views
$$Lambda$(number) when decompiled Java bytecode
Why when I decompile a Java bytecode (which further was decompiled from .dex), I get $$Lambda$(number), in Java files, and it's not possible to build project with these java codes as it's insufficient ...
- 21
1
vote
1
answer
271
views
How to deal with IDA auto-analysis analyzing invalid paths?
Obfuscation techniques such as opaque predicates often trick IDA's auto-analysis into creating incorrect or contradicting interpretations of the code under analysis.
There is some mention of ...
- 180
1
vote
1
answer
586
views
IDA refuses to recognize basic block as part of function that jumps to it
I have a function MyFunc in an obfuscated program as follows:
Start address: .text:000000014219FC5D
End address: .text:000000014219FD0E
MyFunc starts off by jumping to .text:000000014143C159, which ...
- 180
2
votes
1
answer
2k
views
How to decompile heavily obfuscated classes mixed with Arabic/Chinese/Korean characters?
I recently downloaded a jar file and was curious to see if it was malicious, so I ran it through FernFlower and it wasn't able to deobfuscate it. When I unzipped the jar, I looked inside it and saw ...
2
votes
0
answers
54
views
How to use smalivm and simplify to find a certain static constant from APK or remove confusion?
smalivm: Provides a virtual machine sandbox for executing Dalvik methods. After executing a method, it returns a graph containing all possible register and class values for every execution path.
I ...
- 21
-2
votes
1
answer
696
views
What obfuscator is used?
In version 3.7.3.7 I was able to modify some parts of the code using dnSpy. The language is C#. But in the new(next) version, I did not succeed and I guess the code is obfuscated. De4dot did not help. ...
- 1
-2
votes
1
answer
389
views
How to deobfuscate Java application protected by Java Antidecompiler [closed]
Here is some infomation I found from MANIFEST.MF
Archiver-Version: Plexus Archiver
Built-By: boonb
Created-By: Apache Maven
Build-Jdk: 1.8.0_231
Main-Class: JavaLauncher
Modified-By: 9.4 (BIS Guard &...
- 1
1
vote
2
answers
2k
views
How can I de-obfuscate a VBScript (.vbs) file?
I have a VBScript (.vbs) file that is a malware dropper. It executes correctly in a commercial malware sandbox. but does not act the same in my manual analysis lab, and I need to figure out why. The ...
- 151
5
votes
0
answers
13k
views
Deobfuscating Unknown C# obfuscator?
Hello,
I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my ...
- 51
2
votes
0
answers
1k
views
How To Deobfuscate ConfuserEx .NET Assembly?
No matter what I try I cannot deobfuscate this crackme https://crackmes.one/crackme/5d6c847433c5d46f00e2c390.
I have tried each & every tutorial on youTube of which this one is the best https://...
- 31
1
vote
0
answers
216
views
Looking for obfuscation patterns within jumps
I'm working on an obfuscated binary. I recognized some patterns used to confuse the disassembler, some used to obfuscate function calls, some other for conditional jumps and so on.
The idea was to ...
- 11
0
votes
2
answers
1k
views
Decode xor data in IDA
I have code that looks like this:
byte_100031BA4 = v41;
byte_100031BA5 ^= 0x3Eu;
byte_100031BA6 ^= 0x47u;
LOBYTE(a1) = -9;
byte_100031BA7 ^= 0xF7u;
byte_100031BA8 ^= 0xA9u;
byte_100031BA9 ^= 0xE8u;
...
- 1
3
votes
0
answers
795
views
How can I practically approach VM-obfuscated code with symbolic analysis/execution?
Dealing with VM-obfuscated code and started learning about symbolic analysis but having a hard time wrapping my head around how to practically apply it to a problem. If someone can give me some ...
- 143
-1
votes
1
answer
147
views
How can I analyze this code? [closed]
I wanted to analyse the code for some functionality.
in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using ...
- 309
1
vote
0
answers
2k
views
Reversing PyArmor + Pyinstaller
Created an application, protected by PyArmor and used pyinstaller. I'm trying to reverse engineer it. So far I've decompiled the exe into pyc files but it's still pyarmor encrypted I can only see the ...
- 19
2
votes
2
answers
1k
views
Dealing with obfuscated PUSH PUSH RET instructions
I wanted to run an app on a VM but there are PUSH PUSH RETs stopping me from looking at their anti VM code. There is a messagebox when I run it on a VM. I set a breakpoint at MessageBoxA and it gets ...
- 153
4
votes
0
answers
10k
views
Reversing Pyarmor Discussion
Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
- 51
3
votes
2
answers
722
views
Guidelines for dealing with obfuscated code
I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
- 145
2
votes
2
answers
3k
views
Virtual machine code obfuscation implementation details
I want to implement a VM based simple proof-of-concept obfuscator. It should take an exe file as input and produce a new pe file with appended vm section. For simplicity let's say the exe file is ...
- 123
1
vote
2
answers
535
views
Working with strong obfuscated Java
I've got a jar file, that is strong obfuscated.
When I tried to put it into decompilers such as bytecode-viewer and luyten I seen many lines of traps and Chinese letters.
I tried to deobfuscate it ...
- 11
3
votes
0
answers
899
views
How to use Ghidra to work with VM obfuscated binaries?
By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
- 474