Questions tagged [deobfuscation]
Techniques to remove obfuscation from a piece of program.
150
questions
3
votes
0
answers
44
views
Decyphering 8kbps audio file format used in Solar Chanting Lotus
I'm trying to reverse engineer a solar powered chanting lotus flower so that I might replace the built in audio with something more interesting. The main chip (JL16B-083A - haven't been able to find ...
1
vote
0
answers
68
views
Program Analysis on a Wargame Binary
I've recently took it upon myself to research more about reverse engineering, I'm currently testing my intermediate skills on various CTF hosting sites. Interestingly enough I have come across a ...
- 11
1
vote
0
answers
58
views
How can i Lifting x86_64 assembly code to LLVM-IR
I'm researching of virus and I'm faced with the task of deobfuscating its virtual machine. I chose to do this through LLVM and I had a question, where can I see a simple example of lifting ...
- 11
1
vote
0
answers
57
views
deobfuscate Dexgaurd obfuscated code
I was reversing an apk. the code detects whether the apk is running on a rooted device or not. if it is rooted or an emulator it will stop and close out. so this is the snippet code which I think it ...
- 219
2
votes
0
answers
73
views
Decrypt Keybindings for EVE Online
I've had this idea for a while for a tool I'd like to make to assist people in getting used to keybinds in EVE Online. Not sure how useful it'd actually be, but seems like a fun project nonetheless.
I'...
- 29
2
votes
1
answer
135
views
Automatic deobfuscation of Java class/method/parameter names with access to old non obfuscated sources
I am currently trying to de-obfuscate a Java program (i.e. find each class name and namespace, each method name and each method parameter name).
To do so, I started by using Enigma (the fork from ...
- 123
0
votes
0
answers
82
views
x32dbg : exe with different code address when running
I have a 32 bits exe that works only when there is a specific usb flash disk inserted. On my new laptop, I only have a single USB port, so I want to make it works without the original key, or from a &...
- 131
1
vote
1
answer
77
views
How to debug an obfuscated self hashing program?
I need to understand what the following obfuscated application does:
interpreter.py:
string = "lambda x : obfuscated_code_to_interpret_variable_x"
interpreter = eval(string)
...
- 111
1
vote
0
answers
63
views
De-Obfuscating/unminifying a JS code [not duplicate]
I have come across a lot of similar questions on the same heading but unfortunately, none of them provided me with the intended results.
I have a piece of code which, initially I am trying to ...
- 11
0
votes
1
answer
200
views
Decompile obfuscated jar file
Tried java-deobfuscator and other things, detect said it was allatori protected so tried the relevant transformers but to no avail.
Please can someone help, I'm happy to tip for your help :)
https://...
2
votes
0
answers
2k
views
How do I reverse engineer an Electron compiled file?- a JSC Bytenode file
I have a bytenode JSC file - which is described as:
This tool truly compiles your JavaScript code into V8 bytecode, so
that you can protect your source code. It can be used with Node.js, as
well as ...
- 83
0
votes
1
answer
392
views
Deobfuscator and decompiler for .NET [closed]
Which are the most common and useful deobfuscators and decompilers for .NET .dll files?
- 11
0
votes
2
answers
300
views
Reversing an obfuscation through a long linear switch statement
I have a program (ELF, 32 bits) that is probably quite short and simple, but which have been obfuscated with the following construction:
i = 0
switch(i):
case 0:
one small instruction
...
- 11
0
votes
0
answers
261
views
How to deobfuscate Java application
Hi i am unable to deobfuscate the Advanced String Obfuscation Jar on tryHackMe
I tried
dumping the classes using a dumper javaagent
deobfuscate the jar with java-deobfuscator
threadtear functions
...
1
vote
0
answers
160
views
ZKM 15 Deobfuscation (Jar file) [closed]
Hello I am looking for someone who can deobfuscate a ZKM 15 obfuscated jar file for me.
I am willing to pay money for this.
I mostly just need Strings from the jar file. It doesn't need to be perfect.
...
- 11
1
vote
0
answers
109
views
How can I decode this Malicious php code?
I found this backdoor on a client's website.
https://github.com/baogiaphucthinh/Malicious-php/blob/main/1259da6sc.php (original file)
I have gotten rid of it and realise it's an obfuscated script but ...
- 11
1
vote
0
answers
59
views
RE on firmware images that seem to use weak encryption/obfuscation. Robot vacuum
I have been playing with some robot vacuums that utilize very basic navigation, and I am wanting to play around with my own provisioning along with adding a Rpi to augment features.
These vacuums are ...
- 41
0
votes
0
answers
64
views
Determining a password-hashing function knowing plaintext + output
I have a password that has been stored and I'd like to figure out how it's been 'transformed' to be stored in my database.
The plaintext password is:
k4oK203$
And the password as it is stored 'crypted'...
- 101
1
vote
2
answers
2k
views
Any good places to learn about JS de-obfuscation?
I am trying to make a bot on a specific website, so I have to reverse a lot of JS scripts. The reversing it self is not that hard but the de-obfuscation is. Lots of the scripts are obfuscated with ...
- 11
0
votes
1
answer
146
views
How to clean obfuscated code from fake if statements?
I am trying to deobfuscate javascript code. Firstly I extracted strings from big array. Then I saw many parts like this
There is only one line of code which makes sense. Is there any Node.js cleaner ...
1
vote
1
answer
568
views
devirtualize? or what is this obfuscator? and how to get rid of this
from previous question i still dont get any info or any process at all... now i asking again with this question is this virtualize code or something? i try many thing and it still didnt work [i unpack ...
- 15
1
vote
1
answer
404
views
Is there a way in ida pro to see the address where I have explicitly marked them as code or data, etc?
I'm analyzing an obfuscated binary. IDA did a pretty good job of doing the initial auto-analysis. Later, I went through and marked some sections as undefined, or code, etc. Now IDA can't re-create ...
- 11
2
votes
1
answer
241
views
$$Lambda$(number) when decompiled Java bytecode
Why when I decompile a Java bytecode (which further was decompiled from .dex), I get $$Lambda$(number), in Java files, and it's not possible to build project with these java codes as it's insufficient ...
- 21
1
vote
1
answer
202
views
How to deal with IDA auto-analysis analyzing invalid paths?
Obfuscation techniques such as opaque predicates often trick IDA's auto-analysis into creating incorrect or contradicting interpretations of the code under analysis.
There is some mention of ...
- 170
1
vote
1
answer
417
views
IDA refuses to recognize basic block as part of function that jumps to it
I have a function MyFunc in an obfuscated program as follows:
Start address: .text:000000014219FC5D
End address: .text:000000014219FD0E
MyFunc starts off by jumping to .text:000000014143C159, which ...
- 170
2
votes
1
answer
1k
views
How to decompile heavily obfuscated classes mixed with Arabic/Chinese/Korean characters?
I recently downloaded a jar file and was curious to see if it was malicious, so I ran it through FernFlower and it wasn't able to deobfuscate it. When I unzipped the jar, I looked inside it and saw ...
2
votes
0
answers
50
views
How to use smalivm and simplify to find a certain static constant from APK or remove confusion?
smalivm: Provides a virtual machine sandbox for executing Dalvik methods. After executing a method, it returns a graph containing all possible register and class values for every execution path.
I ...
- 21
-1
votes
1
answer
478
views
What obfuscator is used?
In version 3.7.3.7 I was able to modify some parts of the code using dnSpy. The language is C#. But in the new(next) version, I did not succeed and I guess the code is obfuscated. De4dot did not help. ...
- 11
-2
votes
1
answer
310
views
How to deobfuscate Java application protected by Java Antidecompiler [closed]
Here is some infomation I found from MANIFEST.MF
Archiver-Version: Plexus Archiver
Built-By: boonb
Created-By: Apache Maven
Build-Jdk: 1.8.0_231
Main-Class: JavaLauncher
Modified-By: 9.4 (BIS Guard &...
- 1
1
vote
2
answers
1k
views
How can I de-obfuscate a VBScript (.vbs) file?
I have a VBScript (.vbs) file that is a malware dropper. It executes correctly in a commercial malware sandbox. but does not act the same in my manual analysis lab, and I need to figure out why. The ...
- 151
5
votes
0
answers
10k
views
Deobfuscating Unknown C# obfuscator?
Hello,
I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my ...
- 51
2
votes
0
answers
872
views
How To Deobfuscate ConfuserEx .NET Assembly?
No matter what I try I cannot deobfuscate this crackme https://crackmes.one/crackme/5d6c847433c5d46f00e2c390.
I have tried each & every tutorial on youTube of which this one is the best https://...
- 31
1
vote
0
answers
151
views
Looking for obfuscation patterns within jumps
I'm working on an obfuscated binary. I recognized some patterns used to confuse the disassembler, some used to obfuscate function calls, some other for conditional jumps and so on.
The idea was to ...
- 11
0
votes
2
answers
1k
views
Decode xor data in IDA
I have code that looks like this:
byte_100031BA4 = v41;
byte_100031BA5 ^= 0x3Eu;
byte_100031BA6 ^= 0x47u;
LOBYTE(a1) = -9;
byte_100031BA7 ^= 0xF7u;
byte_100031BA8 ^= 0xA9u;
byte_100031BA9 ^= 0xE8u;
...
- 1
3
votes
0
answers
527
views
How can I practically approach VM-obfuscated code with symbolic analysis/execution?
Dealing with VM-obfuscated code and started learning about symbolic analysis but having a hard time wrapping my head around how to practically apply it to a problem. If someone can give me some ...
- 143
-1
votes
1
answer
143
views
How can I analyze this code? [closed]
I wanted to analyse the code for some functionality.
in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using ...
- 219
1
vote
0
answers
2k
views
Reversing PyArmor + Pyinstaller
Created an application, protected by PyArmor and used pyinstaller. I'm trying to reverse engineer it. So far I've decompiled the exe into pyc files but it's still pyarmor encrypted I can only see the ...
- 19
2
votes
2
answers
940
views
Dealing with obfuscated PUSH PUSH RET instructions
I wanted to run an app on a VM but there are PUSH PUSH RETs stopping me from looking at their anti VM code. There is a messagebox when I run it on a VM. I set a breakpoint at MessageBoxA and it gets ...
- 153
2
votes
0
answers
9k
views
Reversing Pyarmor Discussion
Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
- 31
3
votes
2
answers
470
views
Guidelines for dealing with obfuscated code
I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
- 145
2
votes
2
answers
2k
views
Virtual machine code obfuscation implementation details
I want to implement a VM based simple proof-of-concept obfuscator. It should take an exe file as input and produce a new pe file with appended vm section. For simplicity let's say the exe file is ...
- 123
1
vote
2
answers
472
views
Working with strong obfuscated Java
I've got a jar file, that is strong obfuscated.
When I tried to put it into decompilers such as bytecode-viewer and luyten I seen many lines of traps and Chinese letters.
I tried to deobfuscate it ...
- 11
3
votes
0
answers
735
views
How to use Ghidra to work with VM obfuscated binaries?
By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
- 444
1
vote
0
answers
53
views
Main contemporary deobfuscation techniques
Could you please specify in a few words main contemporary deobfuscation techniques which we can apply to 32/64 bit PE files?
For example, (1) using instruction templates, such as:
mov edx, 5B1F04F1h
...
- 131
1
vote
1
answer
365
views
Reverse Engineering Java - Deobfuscating symbols
I'm new to Java and working on cleaning up a fairly large Java .jar sample where the obfuscator has renamed symbols into invalid names. For example:
import org.lib.00.0.2;
public final class 90
...
- 103
1
vote
2
answers
507
views
Reverse Engineering Javascript - Out of Memory
I found this javascript file on one of those online movie streaming services and was interested in finding out what it does. However, after trying many deobfuscators I am still stuck. A major ...
- 21
2
votes
0
answers
77
views
Reverse engineering hidden audio track in this MPEG-1 video file?
No matter what video player or video analysis software I throw this video at, neither are able to reproduce or detect the audio track of the video:
Introduction video of Wipeout XL PC version (...
- 239
-2
votes
1
answer
5k
views
How to decompile obfuscated Python code?
I have an executable file, which I am trying to decompile. I have already deduced that it was originally programmed in Python. I know that it was obfuscated with PyArmor and possibly compiled with ...
- 61
2
votes
0
answers
470
views
What is the header 'X-Goog-Spatula'?
I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not ...
- 21
3
votes
2
answers
3k
views
How to reverse engineer an exe built using nexe?
I am working on an express application. I obfuscate the source code using javascript-obfuscator.
I am using nexe cli for generating a single exe from the obfuscated code. Can anyone tell me if there ...
- 31
Hot Network Questions
- Word for "separating a group of similar-but-not-the-same things into categories"?
- when is it true that "the Fourier transform of the autocorrelation is the spectral density"?
- Did Sweden experience lower all-cause mortality during the pandemic?
- I found a security vulnerability in our code. How do I present it in our sprint review?
- Quantifying a measure of standard deviation in MILP
- Ray problem (geometry)
- How to map arms of the galaxy?
- Importance of PhD grade for future career in physics research?
- Development pattern for interactive in-game tutorials
- Coworker posted private chat message in a public group
- How many TCP retransmissions Internet traffic is considered normal for a basic home setup?
- Can I dilute 2-stroke gas and run it in my riding mower to get rid of it?
- How to get which object from the collection is used as particle instance in the particle system via bpy?
- Spokes damaged by chain – should they be replaced?
- Is there a specific definition for the tolerance value of a resistor?
- Practicality of building a space station in the tail of a comet
- Size of instanced objects based on subdivision levels
- When did Star Trek first start using low lights as a norm for red alert conditions?
- Computer is frying all USB devices that are connected
- Symmetric version of Hilbert's seventeenth problem?
- Can stars be born giants?
- \RemoveFromHook not working as expected if code placed in package file
- Why is it generally important to be consistent with the tone and style of writing?
- Why is the US under Biden so strongly supporting Ukraine in the war?