Skip to main content

Questions tagged [deobfuscation]

Techniques to remove obfuscation from a piece of program.

Filter by
Sorted by
Tagged with
1 vote
1 answer
102 views

How to detect obfuscator and where to dig?

I have an .net assembly application written on c# Its target framework version is 4.5.2 Trying to decompile with ILSpy, mostly all files looks like this: using MyApp.Controller; using MyApp....
Alex's user avatar
  • 11
0 votes
0 answers
83 views

Decompiling very heavily obfuscated JAR

I have a very very obfuscated jar. I tried using Krakatau and CFR and it won't decompile. With CFR some of the important classes / methods fail to decompile and with krak it says it is writing data to ...
tritheo's user avatar
0 votes
0 answers
81 views

Deobfuscating WPF obfuscated code

The project uses WPF : What should i do for XAML links de4dot supporting that ? I have been trying to deobfuscate an encrypted code for days but no matter what I did, I bypassed the debugger ...
Waltcher's user avatar
0 votes
0 answers
70 views

What is this .Net Obfuscator?

I'm analysing a .Net executable and de4dot doesn't detect its obfuscator. Class/Method/Property names start with #=. Does anybody know what obfuscator this is? // Token: 0x0600EE8B RID: 61067 RVA: ...
Gudarzi's user avatar
  • 123
0 votes
0 answers
47 views

WebAssembly Unity base64 decipher

When in game (taming.io) going to leaderboard and searching a player id lets say: 1. It renders player data retrieved from here just fine: https://account.taming.io/player?id=1 If I type this url (get ...
Ion Iascerinschi's user avatar
0 votes
1 answer
174 views

How do I deobfuscate this JavaScript? [closed]

link to the code: https://drive.google.com/file/d/1Y-M-gkYpzkrECh6gpsVyo_ZMO5ZMgdiW/view I tried using this site (https://lelinhtinh.github.io/de4js/), but it still accomplishes almost nothing youtube ...
CiNoP's user avatar
  • 1
0 votes
1 answer
361 views

i need software to decode this subtitle xml file, anyone know what it encodes with?

This is a subtitle file encoded by xml, is there any way to decode this xml file to srt? Subtitle link xml
Đức Nguyễn's user avatar
0 votes
1 answer
529 views

Deobfuscating big files

I'm trying to deobfuscate JS file, but it's to big for online services, like deobfuscate.io. I just can't copy content of file, because it have ~4M symbols. All deobfuscate services proccess file in ...
Peter's user avatar
  • 1
0 votes
0 answers
135 views

What obfuscator do this?

So, first if i try to use DnSpy all the methods are empty and some of them returns decompiler exceptions like System.ArgumentOutOfRangeException: Non-negative number required. (Parameter 'length') ...
SilverStitch's user avatar
1 vote
1 answer
165 views

How can i remove dead code and opaque predicates?

I have the following problem on my agenda: There is an obfuscated .exe (this is a virus that I am investigating) in addition to having an MBA, etc. bullshit, he has Opaque predicates and dead code, I ...
Swoke's user avatar
  • 11
1 vote
1 answer
717 views

How can I extract the password from an installer/self-extracting archive?

I have an installer/self-extracting archive. The executable file has an embedded ZIP archive into it (like many other installers). The ZIP archive is encrypted with a password. The installer DOES NOT ...
ARGYROU MINAS's user avatar
2 votes
1 answer
344 views

Deobfuscating IOS dll file (I think arm64)

I am just starting out my journey with modding IAP files. I use dnSPY to find the offsets of the methods I want to change and then use an arm64 to hex converter to then apply these changes. I have ...
NOT Mike Oxmall epic duel's user avatar
4 votes
0 answers
65 views

Decyphering 8kbps audio file format used in Solar Chanting Lotus

I'm trying to reverse engineer a solar powered chanting lotus flower so that I might replace the built in audio with something more interesting. The main chip (JL16B-083A - haven't been able to find ...
Captain Lavender's user avatar
1 vote
0 answers
92 views

Program Analysis on a Wargame Binary

I've recently took it upon myself to research more about reverse engineering, I'm currently testing my intermediate skills on various CTF hosting sites. Interestingly enough I have come across a ...
Gregory's user avatar
  • 11
2 votes
0 answers
173 views

How can i Lifting x86_64 assembly code to LLVM-IR

I'm researching of virus and I'm faced with the task of deobfuscating its virtual machine. I chose to do this through LLVM and I had a question, where can I see a simple example of lifting ...
OSPFv3's user avatar
  • 21
1 vote
0 answers
319 views

deobfuscate Dexgaurd obfuscated code

I was reversing an apk. the code detects whether the apk is running on a rooted device or not. if it is rooted or an emulator it will stop and close out. so this is the snippet code which I think it ...
hanan's user avatar
  • 309
4 votes
0 answers
90 views

Decrypt Keybindings for EVE Online

I've had this idea for a while for a tool I'd like to make to assist people in getting used to keybinds in EVE Online. Not sure how useful it'd actually be, but seems like a fun project nonetheless. I'...
Dealman's user avatar
  • 41
2 votes
1 answer
243 views

Automatic deobfuscation of Java class/method/parameter names with access to old non obfuscated sources

I am currently trying to de-obfuscate a Java program (i.e. find each class name and namespace, each method name and each method parameter name). To do so, I started by using Enigma (the fork from ...
Adrien Suau's user avatar
1 vote
0 answers
275 views

x32dbg : exe with different code address when running

I have a 32 bits exe that works only when there is a specific usb flash disk inserted. On my new laptop, I only have a single USB port, so I want to make it works without the original key, or from a &...
JayMore's user avatar
  • 141
1 vote
1 answer
102 views

How to debug an obfuscated self hashing program?

I need to understand what the following obfuscated application does: interpreter.py: string = "lambda x : obfuscated_code_to_interpret_variable_x" interpreter = eval(string) ...
mercury0114's user avatar
2 votes
0 answers
156 views

De-Obfuscating/unminifying a JS code [not duplicate]

I have come across a lot of similar questions on the same heading but unfortunately, none of them provided me with the intended results. I have a piece of code which, initially I am trying to ...
Supraja's user avatar
  • 21
0 votes
1 answer
566 views

Decompile obfuscated jar file

Tried java-deobfuscator and other things, detect said it was allatori protected so tried the relevant transformers but to no avail. Please can someone help, I'm happy to tip for your help :) https://...
Hanbury Barry's user avatar
2 votes
0 answers
5k views

How do I reverse engineer an Electron compiled file?- a JSC Bytenode file

I have a bytenode JSC file - which is described as: This tool truly compiles your JavaScript code into V8 bytecode, so that you can protect your source code. It can be used with Node.js, as well as ...
MendelG's user avatar
  • 53
0 votes
1 answer
2k views

Deobfuscator and decompiler for .NET [closed]

Which are the most common and useful deobfuscators and decompilers for .NET .dll files?
REpro1337's user avatar
0 votes
2 answers
499 views

Reversing an obfuscation through a long linear switch statement

I have a program (ELF, 32 bits) that is probably quite short and simple, but which have been obfuscated with the following construction: i = 0 switch(i): case 0: one small instruction ...
Katoptriss's user avatar
0 votes
0 answers
554 views

How to deobfuscate Java application

Hi i am unable to deobfuscate the Advanced String Obfuscation Jar on tryHackMe I tried dumping the classes using a dumper javaagent deobfuscate the jar with java-deobfuscator threadtear functions ...
altsphaantm's user avatar
1 vote
0 answers
223 views

ZKM 15 Deobfuscation (Jar file) [closed]

Hello I am looking for someone who can deobfuscate a ZKM 15 obfuscated jar file for me. I am willing to pay money for this. I mostly just need Strings from the jar file. It doesn't need to be perfect. ...
Bryan Jeetun's user avatar
1 vote
0 answers
164 views

How can I decode this Malicious php code?

I found this backdoor on a client's website. https://github.com/baogiaphucthinh/Malicious-php/blob/main/1259da6sc.php (original file) I have gotten rid of it and realise it's an obfuscated script but ...
Joey Doe's user avatar
1 vote
0 answers
65 views

RE on firmware images that seem to use weak encryption/obfuscation. Robot vacuum

I have been playing with some robot vacuums that utilize very basic navigation, and I am wanting to play around with my own provisioning along with adding a Rpi to augment features. These vacuums are ...
AltxF4's user avatar
  • 41
0 votes
0 answers
68 views

Determining a password-hashing function knowing plaintext + output

I have a password that has been stored and I'd like to figure out how it's been 'transformed' to be stored in my database. The plaintext password is: k4oK203$ And the password as it is stored 'crypted'...
carl.hiass's user avatar
1 vote
2 answers
4k views

Any good places to learn about JS de-obfuscation?

I am trying to make a bot on a specific website, so I have to reverse a lot of JS scripts. The reversing it self is not that hard but the de-obfuscation is. Lots of the scripts are obfuscated with ...
MoTheGreat's user avatar
0 votes
1 answer
213 views

How to clean obfuscated code from fake if statements?

I am trying to deobfuscate javascript code. Firstly I extracted strings from big array. Then I saw many parts like this There is only one line of code which makes sense. Is there any Node.js cleaner ...
Владимир Говорухин's user avatar
1 vote
1 answer
778 views

devirtualize? or what is this obfuscator? and how to get rid of this

from previous question i still dont get any info or any process at all... now i asking again with this question is this virtualize code or something? i try many thing and it still didnt work [i unpack ...
EntryEmb's user avatar
1 vote
1 answer
933 views

Is there a way in ida pro to see the address where I have explicitly marked them as code or data, etc?

I'm analyzing an obfuscated binary. IDA did a pretty good job of doing the initial auto-analysis. Later, I went through and marked some sections as undefined, or code, etc. Now IDA can't re-create ...
Gauss Euler's user avatar
2 votes
1 answer
422 views

$$Lambda$(number) when decompiled Java bytecode

Why when I decompile a Java bytecode (which further was decompiled from .dex), I get $$Lambda$(number), in Java files, and it's not possible to build project with these java codes as it's insufficient ...
pishies's user avatar
  • 21
1 vote
1 answer
300 views

How to deal with IDA auto-analysis analyzing invalid paths?

Obfuscation techniques such as opaque predicates often trick IDA's auto-analysis into creating incorrect or contradicting interpretations of the code under analysis. There is some mention of ...
P. Private's user avatar
1 vote
1 answer
692 views

IDA refuses to recognize basic block as part of function that jumps to it

I have a function MyFunc in an obfuscated program as follows: Start address: .text:000000014219FC5D End address: .text:000000014219FD0E MyFunc starts off by jumping to .text:000000014143C159, which ...
P. Private's user avatar
2 votes
1 answer
2k views

How to decompile heavily obfuscated classes mixed with Arabic/Chinese/Korean characters?

I recently downloaded a jar file and was curious to see if it was malicious, so I ran it through FernFlower and it wasn't able to deobfuscate it. When I unzipped the jar, I looked inside it and saw ...
reversesigmathx's user avatar
2 votes
0 answers
60 views

How to use smalivm and simplify to find a certain static constant from APK or remove confusion?

smalivm: Provides a virtual machine sandbox for executing Dalvik methods. After executing a method, it returns a graph containing all possible register and class values for every execution path. I ...
user69485's user avatar
-2 votes
1 answer
867 views

What obfuscator is used?

In version 3.7.3.7 I was able to modify some parts of the code using dnSpy. The language is C#. But in the new(next) version, I did not succeed and I guess the code is obfuscated. De4dot did not help. ...
turb1te's user avatar
-2 votes
1 answer
434 views

How to deobfuscate Java application protected by Java Antidecompiler [closed]

Here is some infomation I found from MANIFEST.MF Archiver-Version: Plexus Archiver Built-By: boonb Created-By: Apache Maven Build-Jdk: 1.8.0_231 Main-Class: JavaLauncher Modified-By: 9.4 (BIS Guard &...
vulongc3's user avatar
1 vote
2 answers
2k views

How can I de-obfuscate a VBScript (.vbs) file?

I have a VBScript (.vbs) file that is a malware dropper. It executes correctly in a commercial malware sandbox. but does not act the same in my manual analysis lab, and I need to figure out why. The ...
Sean W.'s user avatar
  • 151
5 votes
0 answers
15k views

Deobfuscating Unknown C# obfuscator?

Hello, I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my ...
mo5br's user avatar
  • 51
2 votes
0 answers
1k views

How To Deobfuscate ConfuserEx .NET Assembly?

No matter what I try I cannot deobfuscate this crackme https://crackmes.one/crackme/5d6c847433c5d46f00e2c390. I have tried each & every tutorial on youTube of which this one is the best https://...
Dalski's user avatar
  • 31
1 vote
0 answers
244 views

Looking for obfuscation patterns within jumps

I'm working on an obfuscated binary. I recognized some patterns used to confuse the disassembler, some used to obfuscate function calls, some other for conditional jumps and so on. The idea was to ...
stokdam's user avatar
  • 11
0 votes
2 answers
2k views

Decode xor data in IDA

I have code that looks like this: byte_100031BA4 = v41; byte_100031BA5 ^= 0x3Eu; byte_100031BA6 ^= 0x47u; LOBYTE(a1) = -9; byte_100031BA7 ^= 0xF7u; byte_100031BA8 ^= 0xA9u; byte_100031BA9 ^= 0xE8u; ...
park joh's user avatar
3 votes
0 answers
1k views

How can I practically approach VM-obfuscated code with symbolic analysis/execution?

Dealing with VM-obfuscated code and started learning about symbolic analysis but having a hard time wrapping my head around how to practically apply it to a problem. If someone can give me some ...
patchrail's user avatar
  • 143
-1 votes
1 answer
149 views

How can I analyze this code? [closed]

I wanted to analyse the code for some functionality. in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using ...
hanan's user avatar
  • 309
1 vote
0 answers
2k views

Reversing PyArmor + Pyinstaller

Created an application, protected by PyArmor and used pyinstaller. I'm trying to reverse engineer it. So far I've decompiled the exe into pyc files but it's still pyarmor encrypted I can only see the ...
Cromen's user avatar
  • 19
2 votes
2 answers
1k views

Dealing with obfuscated PUSH PUSH RET instructions

I wanted to run an app on a VM but there are PUSH PUSH RETs stopping me from looking at their anti VM code. There is a messagebox when I run it on a VM. I set a breakpoint at MessageBoxA and it gets ...
nop's user avatar
  • 153