Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [deobfuscation]

Techniques to remove obfuscation from a piece of program.

0
votes
0answers
51 views

Decode Rolling Code

I have a motorized curtain, which uses a 433Mhz RF Control. I'm trying to figure out how is it encoded. I could already get the times and converted to HEX representation. Below has 10 samples for ...
0
votes
0answers
35 views

Reversing custom JavaScript obfuscation/encryption

I have a js file with no external dependencies. It has two parts, one looking like this: { b: "IxIjACMBQzM=", U: [0], G: [0], k: [1, 18] }, { b: "IxFMTgH+...
1
vote
1answer
91 views

What's this obfuscation technique?

I'm reverse-engineering a particular dylib on Mac OS X. The dylib is highly obfuscated, but I suspect it's from some well-known technique that I'm not aware of. I'd like to describe it in the hope ...
1
vote
0answers
65 views

How to decompile a obfuscated mach-o dylib?

I am trying to decompile a dylib called libConfigurer64.dylib, which is loaded from the environment variable "DYLD_INSERT_LIBRARIES" I want to analyze what it really does, so I dragged it in to IDA,...
6
votes
1answer
279 views

Simplifying assembly

I'm analysing some binary trace, it's pretty much obfuscated. What I need to do is to understand work flow of its alghoritms. However I cannot find any reliable tool which would help me with that. I ...
1
vote
2answers
355 views

(de4dot) The file isn't a .NET PE file

Probably, many of you have ever seen the message from de4dot while trying to deobfuscate app/dll: WARNING: The file isn't a .NET PE file: What steps to take in such cases to proceed? How to make the ...
0
votes
0answers
156 views

How to detect obfuscator (de4dot shows: Detected unknown obfuscator)

Generally, I use de4dot to detect obfuscator or deobfuscate. But some files are protected as they show: Detected unknown obfuscator What are ways to detect the obfuscator of .exe?
2
votes
1answer
85 views

Find out string encoding/shift of proprietary binary file format

I'm trying to reverse-engineer a proprietary file format to be able to extract certain strings from files in this format. I have the application, that writes the files, at hand. By trial-and-error I ...
3
votes
0answers
162 views

Deobfuscate PHP that contains - goto

I've found a bunch of obfuscated PHP scripts in my server but it seems I cannot deobfuscate them to follow the code flow. I came to the conclusion that the files have been obfuscated with https://www....
1
vote
0answers
362 views

Can de4dot deobfuscate Dotfuscator Professional?

I ran de4dot on a Xamarin app obfuscated using Dotfuscator Professional. However, there's still the random switches and strange ints everywhere. Can de4dot decode this? If not, is there another tool ...
4
votes
3answers
136 views

Obfuscated code analysis - can unused variables be ignored?

I am analyzing a malicious javascript. The code is encoded and obfuscated in a way that I did not manage to even partially deobfuscate yet and it is filled with long strings. In order to simplify the ...
1
vote
1answer
577 views

Is deobfuscation of my javascript code hard or easy?

I am trying to protect my app code from theft. Since most of it is written in javascript I had to use many obfuscation techniques to make it incomprehensible. I have written a very small piece of ...
-1
votes
0answers
421 views

BeeByte Deobfuscation

I am a recent graduate trying to reverse engineer my way into a video game studio. I am working on fully understanding their code from the .DLL's but some parts of it are obfuscated through a Unity ...
-3
votes
1answer
1k views

How do I decode this JavaScript code? [duplicate]

Each file starts with the same function: (function(_0x128f83, _0x1ae5b9) { var _0x1b5471 = function(_0x339be5) { while (--_0x339be5) { _0x128f83['push'](_0x128f83['shift']()); ...
-1
votes
1answer
585 views

How decrypt hexadecimal javascript code? [closed]

Someone here already had success to deobfuscate 100% a "hexadecimal" Javascript code? E.g.: var _0x22bc92 = function() { var _0x26938d = !![]; return function(_0x100751, _0x54d399) { ...
0
votes
0answers
169 views

Deobfuscate shared object file

I was analyzing an Android app and I came across a shared object file that is obfuscated. IDA Pro couldn't fully disassemble it and IDA Pro 7.0 will freeze during disassembling. Luckily I have old ...
0
votes
0answers
53 views

javascript try catch throw construct

I am currently deobfuscating some javascript code and came across this construct: try { ... some JS code ... } catch (x) { throw x } Can anybody tell me what this is? To me this try-catch ...
1
vote
1answer
207 views

Map an obfuscated javascript file to the original

Among other approaches, there are ways to "prettify" obfuscated javascript. But most of such approaches are geared towards someone trying to understand code that's not their own (e.g. from a website, ...
3
votes
2answers
92 views

Hardcoded addresses in dumped PEs

I have taken a dump of a game using Explorer Suite, and while looking at some obfuscated parts of the game PE's text section in IDA, I've seen code that follows this form: mov rbp, 7FF633CE2790h jmp ...
1
vote
1answer
300 views

IDA 7.0 (freeware) auto-analysis gets stuck in a loop

I am trying to create a graph so that I can visualize the flow of a particular function in a game that I am interested in. I was initially using Cheat Engine to follow the flow of the function, but ...
-1
votes
4answers
337 views

Decrypting authorization PHP script

Description I asked for help on freelancing, for the finalization of the project in PHP. All this worked well until I needed to edit the authorization mechanism. Having opened the file, I found that ...
0
votes
0answers
237 views

De Obfuscate Beebytes

I have tried two tools to de-obfuscate an assembly c-sharp.dll file. By decompiling the .dll file I was able to find the class describing the obfuscation as Beebytes, the the two programs were the ...
1
vote
1answer
112 views

De-obfuscation - Emulation-oriented vs Script-oriented

What are the advantages of each method when employing de-obsfucation of potentially malicious code? I've been told to always use emulators like x86emu since it doesn't actually run the code when ...
3
votes
1answer
409 views

How to deal with heavy control flow flattening?

I am trying to reverse engineer an executable that uses a lot of control flow flattening obfuscation (i.e, lots of subroutines that end with something like jmp esi, jmp eax) IDA Pro isn't able to ...
1
vote
1answer
221 views

deobfuscating javascript injected into Wordpress

Found a WP site (not mine) with lovely obfuscated code injected into the footer so I've been trying to de-obfuscate it. I ran it through unpacker, then converted hex to ASCII, then un-minified to ...
1
vote
0answers
289 views

Decode RubyEncoder

I was trying out some things when I came across some RubyEncoder encoded code. After searching the web, I found basically nothing useful on how to reverse them (Except this and [this][2], but I had no ...
1
vote
0answers
1k views

Tool for JavaScript deobfuscation

I'd like to reverse engineer a JavaScript program by manually renaming minimified variable, parameter and function names. However, updating my reverse-engineered code to a newer version would be very ...
1
vote
2answers
397 views

how to deobfuscate Autoit strings?

The code is: https://pastebin.com/ZwvySjgy Is it possible to deobfuscate the strings protected with STRINGDEC?
0
votes
1answer
282 views

Unpacking ROM dump

I have a ROM dump from an unknown controller, which must be reversed (as a task). It looks like encrypted, packed or obfuscated. Binwalk did not give any information("cisco os experimental microcode ...
3
votes
1answer
386 views

Animal Crossing: Pocket Camp .zdat File

Hello I am trying to obtain the music from the new game Animal Crossing: Pocket Camp. The music is contained in files like these: https://download-cdn-ac-pocketcamp.akamaized.net/assets/...
1
vote
0answers
582 views

de4dot and Dotfuscator: IL looks different, not DotPeek decompiled code

From the obfuscated to the deobfuscated assemblies, IL code looks different using ILDASM; however, DotPeek decompiled C# code looks exactly the same for both. Any clue why? The obfuscation software ...
-1
votes
0answers
123 views

Determining checksum parameters

I have some data from a game which appears to possibly contain a checksum or CRC implementation. The game has different arenas with a "share" link for each team in the arena (and there are 4 teams). ...
2
votes
2answers
132 views

How to call an item of a Javascript array?

Say I have the following Javascript array: var _0xe984=[ '\x61\x70\x70\x6c\x79', '\x72\x65\x74\x75\x72\x6e\x20\x28\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x28\x29\x20', '\x7b\x7d\x2e\x63\x6f\x6e\x73\...
0
votes
1answer
99 views

How does the different types of executable packing work?

Reference to this thread: What are the different types of packers? Q1: How do packing methods like compression, protection, and encryption work, how do they differ, and which is more secure? Q2: ...
3
votes
1answer
620 views

Understanding AutoIT “compilation”

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
1
vote
1answer
2k views

Decompiling and deobfuscating APK file

Let's suppose that I have an APK file. I decompiled it but I have very obfuscated code. Is it possible to analize this APK in such way that application will be executed step by step (instruction after ...
1
vote
1answer
964 views

How to run and reconstruct a packed DLL in IDA Pro?

I have a packed DLL. It has an entry point. If I call LoadLibrary it gets unpacked with the entry point code. Then I can attach a debugger to the .exe that called LoadLibrary and see the unpacked dll ...
1
vote
2answers
1k views

Renaming entitites in obfuscated java bytecode

I'm working with an SDK for developing apps that's distributed as an AAR, and has been obfuscated with ProGuard. I'm just trying to reverse a few things it does. The classes, methods and variables ...
2
votes
3answers
3k views

Extracting classes from running JVM

I'm trying to RE a Java application that uses an obfuscated loader program to load classes from a second, obfuscated archive-like file. I'm trying to get at these loaded classes for further analysis, ...
0
votes
0answers
283 views

Reversing (well known) obfuscated ARM function

I am working quite some time on a binary which uses the below function. Furternatly the function should be well known, but I cannot seem to find the name of it. It takes a uchar* as input and somehow ...
1
vote
1answer
475 views

How to get address where MakeFunction() failed in IDA Pro

I am analysing obfuscated code which contains code paths leading to dummy instructions. These dummy instructions prevent IDA from creating functions. However, I need these functions to do a function ...
2
votes
0answers
724 views

Do any known deobfuscateors work on Agile.net 6.4?

As a company we are going to start obfuscating our released binaries, so far the best front runner we have found has been Agile.net 6.4. I took one of our binaries we obfuscated with the trial ...
1
vote
1answer
1k views

Are .NET DLLs, even the best obfuscated ones, less secure than C++ DLLs?

From what I understand about .NET code, it is first compiled to Microsoft Common Intermediate Language (MSIL) before being translated to machine code at runtime. Whereas C++ code is compiled directly ...
0
votes
0answers
101 views

Reassemble function that has its control flow chopped so that it can be decompiled by IDA

I try to decompile a function that is obfuscated by having split up the controlflow into asmblocks scattered around the .text section and connected by "jmpq" jumps. <func1>: 0: insn.. 1: ...
3
votes
2answers
824 views

Automating pattern-based de-obfuscation of x64 code using IDA plugins

Trying to deobfuscate x64 code. You can skim/skip most of this, since it mainly exists to prove I have tried and exhausted all avenues. Burning Purpose To massively automate the deobfuscation within ...
3
votes
1answer
429 views

Reversal of unknown obfuscation or encryption with known plaintext

Introduction For academical reasons I am reversing a firmware for an embedded device. I have already created a perl script which is able to parse the firmware structure and extract files from it (its ...
1
vote
1answer
852 views

Cannot detect obfuscator of the obfuscated DLL

I want to do a reverse-engineering of an obfuscated Unity DLL assembly, but de4dot doesn't work. It says "Unknown Obfuscator". Also tried iMPROVE and it says that there is a 97% chance that it is a ...
0
votes
0answers
173 views

How to pass Obfuscated Elf binary to gcc optimization end

Currently I have a 2000+Line function to reverse engineer with many redundancies and appears to be obfuscated. It their a way to pass to pass this binary to gcc or clang to reassemble it and optimize ...
1
vote
1answer
1k views

Decompiled Java classes span multiple files

I've been playing around with decompiling Android apps from dex/jar files to java source code, with varying success. I've tried the usual suspects - JD-GUI, procyon, cfr, krakatau and jadx. I'm having ...
1
vote
0answers
259 views

Discovering byte array obfuscation function

I'm in the middle of reverse engineering SafeNet (formerly Rainbow) iKey 1000 USB dongle protocol, in order to create Linux driver for it. I'm using Windows as guest in virtual machine on Linux host ...