Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [deobfuscation]

Techniques to remove obfuscation from a piece of program.

0
votes
1answer
40 views

(de4dot) The file isn't a .NET PE file

Probably, many of you have ever seen the message from de4dot while trying to deobfuscate app/dll: WARNING: The file isn't a .NET PE file: What steps to take in such cases to proceed? How to make the ...
0
votes
0answers
30 views

How to detect obfuscator (de4dot shows: Detected unknown obfuscator)

Generally, I use de4dot to detect obfuscator or deobfuscate. But some files are protected as they show: Detected unknown obfuscator What are ways to detect the obfuscator of .exe?
0
votes
0answers
84 views

Converting assembly to LLVM IR

What is the best way to convert some assembly code to LLVM IR? Code doesn't contain any jumps/calls/returns. Only arithmetical and stack operations. I have tried McSema but I couldn't get it to work. ...
2
votes
1answer
72 views

Find out string encoding/shift of proprietary binary file format

I'm trying to reverse-engineer a proprietary file format to be able to extract certain strings from files in this format. I have the application, that writes the files, at hand. By trial-and-error I ...
3
votes
0answers
98 views

Deobfuscate PHP that contains - goto

I've found a bunch of obfuscated PHP scripts in my server but it seems I cannot deobfuscate them to follow the code flow. I came to the conclusion that the files have been obfuscated with https://www....
0
votes
0answers
70 views

Beautify and or Deobfuscating large javascript files

I have tried a few deobfuscators and beautifiers but i cannot do anything to it as it causes memory errors. The code is here https://mega.nz/#!EaYSwQQD!AAfhgMkIIsyfHHxf0QMdboX0Od3SwBRW_FMg9pWd1b0 I ...
1
vote
0answers
226 views

Can de4dot deobfuscate Dotfuscator Professional?

I ran de4dot on a Xamarin app obfuscated using Dotfuscator Professional. However, there's still the random switches and strange ints everywhere. Can de4dot decode this? If not, is there another tool ...
4
votes
3answers
120 views

Obfuscated code analysis - can unused variables be ignored?

I am analyzing a malicious javascript. The code is encoded and obfuscated in a way that I did not manage to even partially deobfuscate yet and it is filled with long strings. In order to simplify the ...
1
vote
1answer
308 views

Is deobfuscation of my javascript code hard or easy?

I am trying to protect my app code from theft. Since most of it is written in javascript I had to use many obfuscation techniques to make it incomprehensible. I have written a very small piece of ...
0
votes
0answers
291 views

BeeByte Deobfuscation

I am a recent graduate trying to reverse engineer my way into a video game studio. I am working on fully understanding their code from the .DLL's but some parts of it are obfuscated through a Unity ...
-3
votes
1answer
543 views

How do I decode this JavaScript code? [duplicate]

Each file starts with the same function: (function(_0x128f83, _0x1ae5b9) { var _0x1b5471 = function(_0x339be5) { while (--_0x339be5) { _0x128f83['push'](_0x128f83['shift']()); ...
-1
votes
1answer
373 views

How decrypt hexadecimal javascript code? [closed]

Someone here already had success to deobfuscate 100% a "hexadecimal" Javascript code? E.g.: var _0x22bc92 = function() { var _0x26938d = !![]; return function(_0x100751, _0x54d399) { ...
0
votes
0answers
137 views

Deobfuscate shared object file

I was analyzing an Android app and I came across a shared object file that is obfuscated. IDA Pro couldn't fully disassemble it and IDA Pro 7.0 will freeze during disassembling. Luckily I have old ...
0
votes
0answers
49 views

javascript try catch throw construct

I am currently deobfuscating some javascript code and came across this construct: try { ... some JS code ... } catch (x) { throw x } Can anybody tell me what this is? To me this try-catch ...
1
vote
1answer
175 views

Map an obfuscated javascript file to the original

Among other approaches, there are ways to "prettify" obfuscated javascript. But most of such approaches are geared towards someone trying to understand code that's not their own (e.g. from a website, ...
3
votes
2answers
86 views

Hardcoded addresses in dumped PEs

I have taken a dump of a game using Explorer Suite, and while looking at some obfuscated parts of the game PE's text section in IDA, I've seen code that follows this form: mov rbp, 7FF633CE2790h jmp ...
1
vote
1answer
225 views

IDA 7.0 (freeware) auto-analysis gets stuck in a loop

I am trying to create a graph so that I can visualize the flow of a particular function in a game that I am interested in. I was initially using Cheat Engine to follow the flow of the function, but ...
-1
votes
4answers
200 views

Decrypting authorization PHP script

Description I asked for help on freelancing, for the finalization of the project in PHP. All this worked well until I needed to edit the authorization mechanism. Having opened the file, I found that ...
0
votes
0answers
207 views

De Obfuscate Beebytes

I have tried two tools to de-obfuscate an assembly c-sharp.dll file. By decompiling the .dll file I was able to find the class describing the obfuscation as Beebytes, the the two programs were the ...
1
vote
1answer
88 views

De-obfuscation - Emulation-oriented vs Script-oriented

What are the advantages of each method when employing de-obsfucation of potentially malicious code? I've been told to always use emulators like x86emu since it doesn't actually run the code when ...
3
votes
1answer
311 views

How to deal with heavy control flow flattening?

I am trying to reverse engineer an executable that uses a lot of control flow flattening obfuscation (i.e, lots of subroutines that end with something like jmp esi, jmp eax) IDA Pro isn't able to ...
0
votes
0answers
68 views

Reverse engineer 6 bit checksum algorithm

I'm trying to understand the algorithm behind a 6 bit checksum calculated from a single byte value. I have collected several samples to study: 00 => 000000 01 => 110010 05 => 011110 0b => ...
1
vote
1answer
192 views

deobfuscating javascript injected into Wordpress

Found a WP site (not mine) with lovely obfuscated code injected into the footer so I've been trying to de-obfuscate it. I ran it through unpacker, then converted hex to ASCII, then un-minified to ...
1
vote
0answers
241 views

Decode RubyEncoder

I was trying out some things when I came across some RubyEncoder encoded code. After searching the web, I found basically nothing useful on how to reverse them (Except this and [this][2], but I had no ...
1
vote
0answers
941 views

Tool for JavaScript deobfuscation

I'd like to reverse engineer a JavaScript program by manually renaming minimified variable, parameter and function names. However, updating my reverse-engineered code to a newer version would be very ...
1
vote
2answers
339 views

how to deobfuscate Autoit strings?

The code is: https://pastebin.com/ZwvySjgy Is it possible to deobfuscate the strings protected with STRINGDEC?
0
votes
1answer
250 views

Unpacking ROM dump

I have a ROM dump from an unknown controller, which must be reversed (as a task). It looks like encrypted, packed or obfuscated. Binwalk did not give any information("cisco os experimental microcode ...
3
votes
1answer
359 views

Animal Crossing: Pocket Camp .zdat File

Hello I am trying to obtain the music from the new game Animal Crossing: Pocket Camp. The music is contained in files like these: https://download-cdn-ac-pocketcamp.akamaized.net/assets/...
1
vote
0answers
524 views

de4dot and Dotfuscator: IL looks different, not DotPeek decompiled code

From the obfuscated to the deobfuscated assemblies, IL code looks different using ILDASM; however, DotPeek decompiled C# code looks exactly the same for both. Any clue why? The obfuscation software ...
0
votes
0answers
123 views

Determining checksum parameters

I have some data from a game which appears to possibly contain a checksum or CRC implementation. The game has different arenas with a "share" link for each team in the arena (and there are 4 teams). ...
2
votes
2answers
128 views

How to call an item of a Javascript array?

Say I have the following Javascript array: var _0xe984=[ '\x61\x70\x70\x6c\x79', '\x72\x65\x74\x75\x72\x6e\x20\x28\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x28\x29\x20', '\x7b\x7d\x2e\x63\x6f\x6e\x73\...
0
votes
1answer
85 views

How does the different types of executable packing work?

Reference to this thread: What are the different types of packers? Q1: How do packing methods like compression, protection, and encryption work, how do they differ, and which is more secure? Q2: ...
3
votes
1answer
521 views

Understanding AutoIT “compilation”

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
0
votes
0answers
1k views

How to decompile obfuscated APK file and get specific information

Suppose there is an apk file download link : http://www.wandoujia.com/apps/com.cmcc.migutvtwo/download?pos=detail-ndownload-com.cmcc.migutvtwo I can install it and use Http Traffic sniffing tool to ...
1
vote
1answer
2k views

Decompiling and deobfuscating APK file

Let's suppose that I have an APK file. I decompiled it but I have very obfuscated code. Is it possible to analize this APK in such way that application will be executed step by step (instruction after ...
1
vote
1answer
890 views

How to run and reconstruct a packed DLL in IDA Pro?

I have a packed DLL. It has an entry point. If I call LoadLibrary it gets unpacked with the entry point code. Then I can attach a debugger to the .exe that called LoadLibrary and see the unpacked dll ...
1
vote
2answers
1k views

Renaming entitites in obfuscated java bytecode

I'm working with an SDK for developing apps that's distributed as an AAR, and has been obfuscated with ProGuard. I'm just trying to reverse a few things it does. The classes, methods and variables ...
2
votes
3answers
2k views

Extracting classes from running JVM

I'm trying to RE a Java application that uses an obfuscated loader program to load classes from a second, obfuscated archive-like file. I'm trying to get at these loaded classes for further analysis, ...
0
votes
0answers
273 views

Reversing (well known) obfuscated ARM function

I am working quite some time on a binary which uses the below function. Furternatly the function should be well known, but I cannot seem to find the name of it. It takes a uchar* as input and somehow ...
1
vote
1answer
421 views

How to get address where MakeFunction() failed in IDA Pro

I am analysing obfuscated code which contains code paths leading to dummy instructions. These dummy instructions prevent IDA from creating functions. However, I need these functions to do a function ...
2
votes
0answers
655 views

Do any known deobfuscateors work on Agile.net 6.4?

As a company we are going to start obfuscating our released binaries, so far the best front runner we have found has been Agile.net 6.4. I took one of our binaries we obfuscated with the trial ...
1
vote
1answer
976 views

Are .NET DLLs, even the best obfuscated ones, less secure than C++ DLLs?

From what I understand about .NET code, it is first compiled to Microsoft Common Intermediate Language (MSIL) before being translated to machine code at runtime. Whereas C++ code is compiled directly ...
0
votes
0answers
98 views

Reassemble function that has its control flow chopped so that it can be decompiled by IDA

I try to decompile a function that is obfuscated by having split up the controlflow into asmblocks scattered around the .text section and connected by "jmpq" jumps. <func1>: 0: insn.. 1: ...
3
votes
2answers
780 views

Automating pattern-based de-obfuscation of x64 code using IDA plugins

Trying to deobfuscate x64 code. You can skim/skip most of this, since it mainly exists to prove I have tried and exhausted all avenues. Burning Purpose To massively automate the deobfuscation within ...
4
votes
1answer
391 views

Reversal of unknown obfuscation or encryption with known plaintext

Introduction For academical reasons I am reversing a firmware for an embedded device. I have already created a perl script which is able to parse the firmware structure and extract files from it (its ...
1
vote
1answer
807 views

Cannot detect obfuscator of the obfuscated DLL

I want to do a reverse-engineering of an obfuscated Unity DLL assembly, but de4dot doesn't work. It says "Unknown Obfuscator". Also tried iMPROVE and it says that there is a 97% chance that it is a ...
0
votes
0answers
161 views

How to pass Obfuscated Elf binary to gcc optimization end

Currently I have a 2000+Line function to reverse engineer with many redundancies and appears to be obfuscated. It their a way to pass to pass this binary to gcc or clang to reassemble it and optimize ...
1
vote
1answer
1k views

Decompiled Java classes span multiple files

I've been playing around with decompiling Android apps from dex/jar files to java source code, with varying success. I've tried the usual suspects - JD-GUI, procyon, cfr, krakatau and jadx. I'm having ...
1
vote
0answers
246 views

Discovering byte array obfuscation function

I'm in the middle of reverse engineering SafeNet (formerly Rainbow) iKey 1000 USB dongle protocol, in order to create Linux driver for it. I'm using Windows as guest in virtual machine on Linux host ...
1
vote
1answer
538 views

I'm decompiling an apk file to learn how the creator designed the UI for their app. Are these layout files obfuscated?

I'm new to decompiling apps. Most of the apps I decompile aren't very popular, so obfuscation hasn't been a problem yet. I'm not entirely sure what obfuscation looks like. The current app I'm looking ...