Questions tagged [deobfuscation]

Techniques to remove obfuscation from a piece of program.

Filter by
Sorted by
Tagged with
0 votes
0 answers
13 views

How do I reverse engineer an Electron compiled file?- a JSC Bytenode file

I have a bytenode JSC file which is described as: This tool truly compiles your JavaScript code into V8 bytecode, so that you can protect your source code. It can be used with Node.js, as well as ...
user avatar
  • 103
0 votes
1 answer
65 views

Deobfuscator and decompiler for .NET [closed]

Which are the most common and useful deobfuscators and decompilers for .NET .dll files?
user avatar
0 votes
2 answers
178 views

Reversing an obfuscation through a long linear switch statement

I have a program (ELF, 32 bits) that is probably quite short and simple, but which have been obfuscated with the following construction: i = 0 switch(i): case 0: one small instruction ...
user avatar
0 votes
0 answers
44 views

How to gain access to obfuscated files stored within an app's OBB file?

So, for the last few days, I've been working on this problem. I've been trying to gain access to an Android app's code, and have managed to narrow it down (probably) to the app's .OBB file. I can open ...
user avatar
0 votes
0 answers
102 views

How to deobfuscate Java application

Hi i am unable to deobfuscate the Advanced String Obfuscation Jar on tryHackMe I tried dumping the classes using a dumper javaagent deobfuscate the jar with java-deobfuscator threadtear functions ...
user avatar
0 votes
0 answers
26 views

How to keep track of Dynamic Variables

The thing I'm trying to reverse has a lot of variables on allocated memory so I can't comment and keep track of the addresses as every time I re-run the software they will be different.. I'm working ...
user avatar
0 votes
0 answers
61 views

Need Help with decryption backup config.bin file "ZTE ZXHN H168N V3.5"

I am trying to decrypt my router config.bin file.( model mentioned above). When i use zcu utility to decompress my backup to Original format it's say payload 4 .. and the key might be your serial. I ...
user avatar
1 vote
0 answers
96 views

ZKM 15 Deobfuscation (Jar file) [closed]

Hello I am looking for someone who can deobfuscate a ZKM 15 obfuscated jar file for me. I am willing to pay money for this. I mostly just need Strings from the jar file. It doesn't need to be perfect. ...
user avatar
1 vote
0 answers
62 views

How can I decode this Malicious php code?

I found this backdoor on a client's website. https://github.com/baogiaphucthinh/Malicious-php/blob/main/1259da6sc.php (original file) I have gotten rid of it and realise it's an obfuscated script but ...
user avatar
1 vote
0 answers
50 views

RE on firmware images that seem to use weak encryption/obfuscation. Robot vacuum

I have been playing with some robot vacuums that utilize very basic navigation, and I am wanting to play around with my own provisioning along with adding a Rpi to augment features. These vacuums are ...
user avatar
  • 41
0 votes
0 answers
59 views

Determining a password-hashing function knowing plaintext + output

I have a password that has been stored and I'd like to figure out how it's been 'transformed' to be stored in my database. The plaintext password is: k4oK203$ And the password as it is stored 'crypted'...
user avatar
1 vote
1 answer
801 views

Any good places to learn about JS de-obfuscation?

I am trying to make a bot on a specific website, so I have to reverse a lot of JS scripts. The reversing it self is not that hard but the de-obfuscation is. Lots of the scripts are obfuscated with ...
user avatar
0 votes
1 answer
95 views

How to clean obfuscated code from fake if statements?

I am trying to deobfuscate javascript code. Firstly I extracted strings from big array. Then I saw many parts like this There is only one line of code which makes sense. Is there any Node.js cleaner ...
user avatar
1 vote
1 answer
421 views

devirtualize? or what is this obfuscator? and how to get rid of this

from previous question i still dont get any info or any process at all... now i asking again with this question is this virtualize code or something? i try many thing and it still didnt work [i unpack ...
user avatar
1 vote
1 answer
105 views

Is there a way in ida pro to see the address where I have explicitly marked them as code or data, etc?

I'm analyzing an obfuscated binary. IDA did a pretty good job of doing the initial auto-analysis. Later, I went through and marked some sections as undefined, or code, etc. Now IDA can't re-create ...
user avatar
0 votes
1 answer
150 views

$$Lambda$(number) when decompiled Java bytecode

Why when I decompile a Java bytecode (which further was decompiled from .dex), I get $$Lambda$(number), in Java files, and it's not possible to build project with these java codes as it's insufficient ...
user avatar
1 vote
1 answer
115 views

How to deal with IDA auto-analysis analyzing invalid paths?

Obfuscation techniques such as opaque predicates often trick IDA's auto-analysis into creating incorrect or contradicting interpretations of the code under analysis. There is some mention of ...
user avatar
0 votes
1 answer
258 views

IDA refuses to recognize basic block as part of function that jumps to it

I have a function MyFunc in an obfuscated program as follows: Start address: .text:000000014219FC5D End address: .text:000000014219FD0E MyFunc starts off by jumping to .text:000000014143C159, which ...
user avatar
2 votes
1 answer
790 views

How to decompile heavily obfuscated classes mixed with Arabic/Chinese/Korean characters?

I recently downloaded a jar file and was curious to see if it was malicious, so I ran it through FernFlower and it wasn't able to deobfuscate it. When I unzipped the jar, I looked inside it and saw ...
user avatar
2 votes
0 answers
36 views

How to use smalivm and simplify to find a certain static constant from APK or remove confusion?

smalivm: Provides a virtual machine sandbox for executing Dalvik methods. After executing a method, it returns a graph containing all possible register and class values for every execution path. I ...
user avatar
-2 votes
1 answer
217 views

What obfuscator is used?

In version 3.7.3.7 I was able to modify some parts of the code using dnSpy. The language is C#. But in the new(next) version, I did not succeed and I guess the code is obfuscated. De4dot did not help. ...
user avatar
-2 votes
1 answer
236 views

How to deobfuscate Java application protected by Java Antidecompiler [closed]

Here is some infomation I found from MANIFEST.MF Archiver-Version: Plexus Archiver Built-By: boonb Created-By: Apache Maven Build-Jdk: 1.8.0_231 Main-Class: JavaLauncher Modified-By: 9.4 (BIS Guard &...
user avatar
0 votes
1 answer
650 views

How can I de-obfuscate a VBScript (.vbs) file?

I have a VBScript (.vbs) file that is a malware dropper. It executes correctly in a commercial malware sandbox. but does not act the same in my manual analysis lab, and I need to figure out why. The ...
user avatar
  • 131
5 votes
0 answers
7k views

Deobfuscating Unknown C# obfuscator?

Hello, I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my ...
user avatar
  • 51
2 votes
0 answers
545 views

How To Deobfuscate ConfuserEx .NET Assembly?

No matter what I try I cannot deobfuscate this crackme https://crackmes.one/crackme/5d6c847433c5d46f00e2c390. I have tried each & every tutorial on youTube of which this one is the best https://...
user avatar
  • 31
1 vote
0 answers
105 views

Looking for obfuscation patterns within jumps

I'm working on an obfuscated binary. I recognized some patterns used to confuse the disassembler, some used to obfuscate function calls, some other for conditional jumps and so on. The idea was to ...
user avatar
  • 11
0 votes
2 answers
681 views

Decode xor data in IDA

I have code that looks like this: byte_100031BA4 = v41; byte_100031BA5 ^= 0x3Eu; byte_100031BA6 ^= 0x47u; LOBYTE(a1) = -9; byte_100031BA7 ^= 0xF7u; byte_100031BA8 ^= 0xA9u; byte_100031BA9 ^= 0xE8u; ...
user avatar
3 votes
0 answers
334 views

How can I practically approach VM-obfuscated code with symbolic analysis/execution?

Dealing with VM-obfuscated code and started learning about symbolic analysis but having a hard time wrapping my head around how to practically apply it to a problem. If someone can give me some ...
user avatar
  • 143
-1 votes
1 answer
136 views

How can I analyze this code? [closed]

I wanted to analyse the code for some functionality. in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using ...
user avatar
  • 179
1 vote
0 answers
2k views

Reversing PyArmor + Pyinstaller

Created an application, protected by PyArmor and used pyinstaller. I'm trying to reverse engineer it. So far I've decompiled the exe into pyc files but it's still pyarmor encrypted I can only see the ...
user avatar
  • 19
2 votes
2 answers
711 views

Dealing with obfuscated PUSH PUSH RET instructions

I wanted to run an app on a VM but there are PUSH PUSH RETs stopping me from looking at their anti VM code. There is a messagebox when I run it on a VM. I set a breakpoint at MessageBoxA and it gets ...
user avatar
  • 153
2 votes
0 answers
7k views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
user avatar
1 vote
1 answer
260 views

Guidelines for dealing with obfuscated code

I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
user avatar
  • 25
2 votes
2 answers
1k views

Virtual machine code obfuscation implementation details

I want to implement a VM based simple proof-of-concept obfuscator. It should take an exe file as input and produce a new pe file with appended vm section. For simplicity let's say the exe file is ...
user avatar
  • 83
1 vote
2 answers
376 views

Working with strong obfuscated Java

I've got a jar file, that is strong obfuscated. When I tried to put it into decompilers such as bytecode-viewer and luyten I seen many lines of traps and Chinese letters. I tried to deobfuscate it ...
user avatar
  • 11
3 votes
0 answers
582 views

How to use Ghidra to work with VM obfuscated binaries?

By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
user avatar
1 vote
0 answers
49 views

Main contemporary deobfuscation techniques

Could you please specify in a few words main contemporary deobfuscation techniques which we can apply to 32/64 bit PE files? For example, (1) using instruction templates, such as: mov edx, 5B1F04F1h ...
user avatar
  • 131
1 vote
1 answer
295 views

Reverse Engineering Java - Deobfuscating symbols

I'm new to Java and working on cleaning up a fairly large Java .jar sample where the obfuscator has renamed symbols into invalid names. For example: import org.lib.00.0.2; public final class 90 ...
user avatar
0 votes
2 answers
337 views

Reverse Engineering Javascript - Out of Memory

I found this javascript file on one of those online movie streaming services and was interested in finding out what it does. However, after trying many deobfuscators I am still stuck. A major ...
user avatar
2 votes
0 answers
75 views

Reverse engineering hidden audio track in this MPEG-1 video file?

No matter what video player or video analysis software I throw this video at, neither are able to reproduce or detect the audio track of the video: Introduction video of Wipeout XL PC version (...
user avatar
  • 239
-2 votes
1 answer
4k views

How to decompile obfuscated Python code?

I have an executable file, which I am trying to decompile. I have already deduced that it was originally programmed in Python. I know that it was obfuscated with PyArmor and possibly compiled with ...
user avatar
  • 61
1 vote
0 answers
376 views

What is the header 'X-Goog-Spatula'?

I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not ...
user avatar
2 votes
2 answers
2k views

How to reverse engineer an exe built using nexe?

I am working on an express application. I obfuscate the source code using javascript-obfuscator. I am using nexe cli for generating a single exe from the obfuscated code. Can anyone tell me if there ...
user avatar
  • 21
0 votes
1 answer
344 views

Obfuscated VBE malware script analysis

Some actions of this script are clear e.g. the section that adds firewall rules, others not so much On Error Resume Next F27 F10 A0 DBCF Sub F27() Dim E13C563AFCB34, C0009B48F34B, C8, ...
user avatar
  • 101
-1 votes
1 answer
773 views

De-obfuscate JS code [closed]

I came across a script that converts font files from one type to another (i.e. WOFF to TTF, etc). I would like to understand it and incorporate some of the code into a personal project. The script ...
user avatar
  • 99
3 votes
2 answers
3k views

Dealing with heavily obfuscated Java, possibly on bytecode level

I've got a jarfile from a friend, he told me to put it thru an decompiler. So I did, but: JD-GUI basically spit out just the imports and didn't show any class data CFR dumped out stack trace on ...
user avatar
1 vote
1 answer
260 views

Is it possible to completely reverse this code?

i have this code i'm trying to deobfuscate https://pastebin.com/g5mHpWE4 I used https://beautifier.io/ and http://www.jsnice.org/ but the result is still not good, current code: https://pastebin.com/...
user avatar
0 votes
1 answer
332 views

Error After de4dot - Application Does Not Start

There is an application that has been obfuscation to learn. So in an unpack me style. In the first stage I would unpack with de4dot. After you unpack, the running application stops working. dump and ...
user avatar
2 votes
2 answers
846 views

Static analysis obfuscated code

I'm reversing a code that is heavily obfuscated. It uses opaque predicates, call stack tampering, junk code and control flow flattering. Call stack tampering uses indirect branches (push register / ...
user avatar
0 votes
1 answer
6k views

How can I deobfuscate this javascript code

I am trying to deobfuscate this javascript code, but I don't know how it was created. Can you please tell me what the mechanism or the function is that generate such characters in javascript? É=-~-~[]...
user avatar
  • 3