Questions tagged [deobfuscation]

Techniques to remove obfuscation from a piece of program.

Filter by
Sorted by
Tagged with
0
votes
0answers
8 views

How to gain access to obfuscated files stored within an app's OBB file?

So, for the last few days, I've been working on this problem. I've been trying to gain access to an Android app's code, and have managed to narrow it down (probably) to the app's .OBB file. I can open ...
0
votes
1answer
118 views

$$Lambda$(number) when decompiled Java bytecode

Why when I decompile a Java bytecode (which further was decompiled from .dex), I get $$Lambda$(number), in Java files, and it's not possible to build project with these java codes as it's insufficient ...
2
votes
1answer
815 views

De-obfuscating code ran through JScrambler 3x via Eval() functions

I am relatively new to JS and de-obfuscation in general and I am having difficulties reversing some complicated JS. I know the code itself is obsfucated via jscrambler 3-4x and therefore is ran ...
0
votes
1answer
1k views

Suspicious obfuscated JavaScript file

This question is related to another question made on StackOverflow. The users ask about an unknown JavaScript file which is being loaded on his website. I managed to unroll a bit of the JavaScript ...
2
votes
2answers
1k views

How to reverse engineer an exe built using nexe?

I am working on an express application. I obfuscate the source code using javascript-obfuscator. I am using nexe cli for generating a single exe from the obfuscated code. Can anyone tell me if there ...
0
votes
2answers
517 views

Decode xor data in IDA

I have code that looks like this: byte_100031BA4 = v41; byte_100031BA5 ^= 0x3Eu; byte_100031BA6 ^= 0x47u; LOBYTE(a1) = -9; byte_100031BA7 ^= 0xF7u; byte_100031BA8 ^= 0xA9u; byte_100031BA9 ^= 0xE8u; ...
5
votes
0answers
5k views

Deobfuscating Unknown C# obfuscator?

Hello, I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my ...
82
votes
9answers
253k views

How do I reverse engineer .so files found in android APKs?

I know how to reverse engineer normal android APKs using tools like APK-tool anddex2jar but i don't know how to work with obfuscation. Can anyone help or atleast provide some pointers? I know this ...
0
votes
1answer
493 views

How can I de-obfuscate a VBScript (.vbs) file?

I have a VBScript (.vbs) file that is a malware dropper. It executes correctly in a commercial malware sandbox. but does not act the same in my manual analysis lab, and I need to figure out why. The ...
0
votes
0answers
63 views

How to deobfuscate Java application

Hi i am unable to deobfuscate the Advanced String Obfuscation Jar on tryHackMe I tried dumping the classes using a dumper javaagent deobfuscate the jar with java-deobfuscator threadtear functions ...
0
votes
2answers
299 views

Reverse Engineering Javascript - Out of Memory

I found this javascript file on one of those online movie streaming services and was interested in finding out what it does. However, after trying many deobfuscators I am still stuck. A major ...
0
votes
0answers
24 views

How to keep track of Dynamic Variables

The thing I'm trying to reverse has a lot of variables on allocated memory so I can't comment and keep track of the addresses as every time I re-run the software they will be different.. I'm working ...
0
votes
0answers
20 views

Need Help with decryption backup config.bin file "ZTE ZXHN H168N V3.5"

I am trying to decrypt my router config.bin file.( model mentioned above). When i use zcu utility to decompress my backup to Original format it's say payload 4 .. and the key might be your serial. I ...
11
votes
3answers
5k views

What are the available libraries to statically modify ELF executables?

I would like to be able to rewrite or reorganize an ELF binary program directly from the executable format (not at compile-time). The only library I know to do this is elfesteem (used in Miasm). But,...
0
votes
0answers
46 views

How to reverse engine JS code whose callstacks are hidden?

I am learning how to reverse engine JS code and got a hard exercise, beyond hidding strings this obfuscated JS tries to hide callstacks by spreading and storing partial computations in a bunch of ...
1
vote
0answers
65 views

ZKM 15 Deobfuscation (Jar file) [closed]

Hello I am looking for someone who can deobfuscate a ZKM 15 obfuscated jar file for me. I am willing to pay money for this. I mostly just need Strings from the jar file. It doesn't need to be perfect. ...
1
vote
0answers
56 views

How can I decode this Malicious php code?

I found this backdoor on a client's website. https://github.com/baogiaphucthinh/Malicious-php/blob/main/1259da6sc.php (original file) I have gotten rid of it and realise it's an obfuscated script but ...
7
votes
1answer
2k views

How can I decode this php code?

I found this backdoor on a client's website. http://pastebin.com/wVs8w44v (original format) http://pastebin.com/acfx49QJ (semi - readable) I have gotten rid of it and realise it's an obfuscated ...
1
vote
0answers
48 views

RE on firmware images that seem to use weak encryption/obfuscation. Robot vacuum

I have been playing with some robot vacuums that utilize very basic navigation, and I am wanting to play around with my own provisioning along with adding a Rpi to augment features. These vacuums are ...
1
vote
1answer
351 views

devirtualize? or what is this obfuscator? and how to get rid of this

from previous question i still dont get any info or any process at all... now i asking again with this question is this virtualize code or something? i try many thing and it still didnt work [i unpack ...
0
votes
0answers
58 views

Determining a password-hashing function knowing plaintext + output

I have a password that has been stored and I'd like to figure out how it's been 'transformed' to be stored in my database. The plaintext password is: k4oK203$ And the password as it is stored 'crypted'...
1
vote
1answer
402 views

Any good places to learn about JS de-obfuscation?

I am trying to make a bot on a specific website, so I have to reverse a lot of JS scripts. The reversing it self is not that hard but the de-obfuscation is. Lots of the scripts are obfuscated with ...
0
votes
1answer
80 views

How to clean obfuscated code from fake if statements?

I am trying to deobfuscate javascript code. Firstly I extracted strings from big array. Then I saw many parts like this There is only one line of code which makes sense. Is there any Node.js cleaner ...
0
votes
0answers
49 views

Deobfuscating JS Code?

I am trying to deobfuscate a highly obfuscated JS file for use to be passed in along with an HTTP POST request from my C# application. I don't know much about JS. The file I am trying to deobfuscate ...
2
votes
0answers
6k views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
1
vote
1answer
47 views

Is there a way in ida pro to see the address where I have explicitly marked them as code or data, etc?

I'm analyzing an obfuscated binary. IDA did a pretty good job of doing the initial auto-analysis. Later, I went through and marked some sections as undefined, or code, etc. Now IDA can't re-create ...
0
votes
0answers
73 views

how to get rid of this obfuscator?

i somehow know that this is Confuserex but noting working agter many try the file is still unreadable. is there a way to? or im just bad... ps.i unpack this from the exe file that only has PE(maybe ...
0
votes
0answers
26 views

Tools for tracing down a Windows-specific UUID generation?

I'm have a kind of "Crackme" program that generates a 4-byte Windows system-specific UUID. It doesn't seem to be hardware-dependent - I have created 2 identical Windows 7 virtualboxes - same ...
1
vote
1answer
111 views

How to deal with IDA auto-analysis analyzing invalid paths?

Obfuscation techniques such as opaque predicates often trick IDA's auto-analysis into creating incorrect or contradicting interpretations of the code under analysis. There is some mention of ...
0
votes
0answers
121 views

Reverse Engineering Instagram's Private API

I'm trying to reverse engineer Instagram Web's Private API. I have successfully managed to login into Instagram using their login endpoint using man-in-the-middle proxy and postman. I now want to send ...
1
vote
1answer
562 views

How to decompile heavily obfuscated classes mixed with Arabic/Chinese/Korean characters?

I recently downloaded a jar file and was curious to see if it was malicious, so I ran it through FernFlower and it wasn't able to deobfuscate it. When I unzipped the jar, I looked inside it and saw ...
0
votes
1answer
172 views

IDA refuses to recognize basic block as part of function that jumps to it

I have a function MyFunc in an obfuscated program as follows: Start address: .text:000000014219FC5D End address: .text:000000014219FD0E MyFunc starts off by jumping to .text:000000014143C159, which ...
2
votes
0answers
30 views

How to use smalivm and simplify to find a certain static constant from APK or remove confusion?

smalivm: Provides a virtual machine sandbox for executing Dalvik methods. After executing a method, it returns a graph containing all possible register and class values for every execution path. I ...
-2
votes
1answer
160 views

What obfuscator is used?

In version 3.7.3.7 I was able to modify some parts of the code using dnSpy. The language is C#. But in the new(next) version, I did not succeed and I guess the code is obfuscated. De4dot did not help. ...
-2
votes
1answer
200 views

How to deobfuscate Java application protected by Java Antidecompiler [closed]

Here is some infomation I found from MANIFEST.MF Archiver-Version: Plexus Archiver Built-By: boonb Created-By: Apache Maven Build-Jdk: 1.8.0_231 Main-Class: JavaLauncher Modified-By: 9.4 (BIS Guard &...
57
votes
7answers
123k views

What is a good Java decompiler and deobfuscator?

I am using JD-GUI to decompile Java JAR files, but the problem is that it leaves many errors, such as duplicate variables which I have to fix myself and check to see if the program still works (if I ...
71
votes
9answers
79k views

Analyzing highly obfuscated JavaScript

I was recently analyzing a web page that contained some highly obfuscated JavaScript - it's clear that the author had went through quite a bit of effort to make it as hard to understand as possible. I'...
2
votes
0answers
442 views

How To Deobfuscate ConfuserEx .NET Assembly?

No matter what I try I cannot deobfuscate this crackme https://crackmes.one/crackme/5d6c847433c5d46f00e2c390. I have tried each & every tutorial on youTube of which this one is the best https://...
1
vote
0answers
92 views

Looking for obfuscation patterns within jumps

I'm working on an obfuscated binary. I recognized some patterns used to confuse the disassembler, some used to obfuscate function calls, some other for conditional jumps and so on. The idea was to ...
3
votes
0answers
293 views

How can I practically approach VM-obfuscated code with symbolic analysis/execution?

Dealing with VM-obfuscated code and started learning about symbolic analysis but having a hard time wrapping my head around how to practically apply it to a problem. If someone can give me some ...
-1
votes
1answer
133 views

How can I analyze this code? [closed]

I wanted to analyse the code for some functionality. in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using ...
1
vote
0answers
1k views

Reversing PyArmor + Pyinstaller

Created an application, protected by PyArmor and used pyinstaller. I'm trying to reverse engineer it. So far I've decompiled the exe into pyc files but it's still pyarmor encrypted I can only see the ...
2
votes
2answers
607 views

Dealing with obfuscated PUSH PUSH RET instructions

I wanted to run an app on a VM but there are PUSH PUSH RETs stopping me from looking at their anti VM code. There is a messagebox when I run it on a VM. I set a breakpoint at MessageBoxA and it gets ...
1
vote
0answers
195 views

Guidelines for dealing with obfuscated code

I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
1
vote
2answers
335 views

Working with strong obfuscated Java

I've got a jar file, that is strong obfuscated. When I tried to put it into decompilers such as bytecode-viewer and luyten I seen many lines of traps and Chinese letters. I tried to deobfuscate it ...
2
votes
2answers
997 views

Virtual machine code obfuscation implementation details

I want to implement a VM based simple proof-of-concept obfuscator. It should take an exe file as input and produce a new pe file with appended vm section. For simplicity let's say the exe file is ...
2
votes
0answers
504 views

How to use Ghidra to work with VM obfuscated binaries?

By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
5
votes
1answer
2k views

Understanding AutoIT "compilation"

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
1
vote
0answers
48 views

Main contemporary deobfuscation techniques

Could you please specify in a few words main contemporary deobfuscation techniques which we can apply to 32/64 bit PE files? For example, (1) using instruction templates, such as: mov edx, 5B1F04F1h ...
1
vote
1answer
264 views

Reverse Engineering Java - Deobfuscating symbols

I'm new to Java and working on cleaning up a fairly large Java .jar sample where the obfuscator has renamed symbols into invalid names. For example: import org.lib.00.0.2; public final class 90 ...