Questions tagged [deobfuscation]

Techniques to remove obfuscation from a piece of program.

Filter by
Sorted by
Tagged with
0
votes
0answers
301 views

How does ConfuserEx work and what to look out for?

I wanted to learn how to crack some .NET obfuscated programs and I'm wondering how does ConfuserEx (since that seems to be the state-of-the-art) work? What do I have to look out for and why? What ...
1
vote
0answers
35 views

How To Deobfuscate ConfuserEx .NET Assembly?

No matter what I try I cannot deobfuscate this crackme https://crackmes.one/crackme/5d6c847433c5d46f00e2c390. I have tried each & every tutorial on youTube of which this one is the best https://...
1
vote
0answers
68 views

Looking for obfuscation patterns within jumps

I'm working on an obfuscated binary. I recognized some patterns used to confuse the disassembler, some used to obfuscate function calls, some other for conditional jumps and so on. The idea was to ...
0
votes
2answers
42 views

Decode xor data in IDA

I have code that looks like this: byte_100031BA4 = v41; byte_100031BA5 ^= 0x3Eu; byte_100031BA6 ^= 0x47u; LOBYTE(a1) = -9; byte_100031BA7 ^= 0xF7u; byte_100031BA8 ^= 0xA9u; byte_100031BA9 ^= 0xE8u; ...
2
votes
0answers
132 views

How can I practically approach VM-obfuscated code with symbolic analysis/execution?

Dealing with VM-obfuscated code and started learning about symbolic analysis but having a hard time wrapping my head around how to practically apply it to a problem. If someone can give me some ...
-1
votes
1answer
96 views

How can I analyze this code? [closed]

I wanted to analyse the code for some functionality. in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using ...
1
vote
0answers
180 views

Reversing PyArmor + Pyinstaller

Created an application, protected by PyArmor and used pyinstaller. I'm trying to reverse engineer it. So far I've decompiled the exe into pyc files but it's still pyarmor encrypted I can only see the ...
50
votes
7answers
109k views

What is a good Java decompiler and deobfuscator?

I am using JD-GUI to decompile Java JAR files, but the problem is that it leaves many errors, such as duplicate variables which I have to fix myself and check to see if the program still works (if I ...
2
votes
2answers
194 views

Dealing with obfuscated PUSH PUSH RET instructions

I wanted to run an app on a VM but there are PUSH PUSH RETs stopping me from looking at their anti VM code. There is a messagebox when I run it on a VM. I set a breakpoint at MessageBoxA and it gets ...
0
votes
1answer
105 views

Reverse Engineering Javascript - Out of Memory

I found this javascript file on one of those online movie streaming services and was interested in finding out what it does. However, after trying many deobfuscators I am still stuck. A major ...
0
votes
0answers
260 views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
0
votes
0answers
96 views

Cannot detect obfuscator of executable C#

I have an obfuscated exe file writen in c#, which I want to deobfuscate. In dnSpy I can see this de4dot said unknown obfuscator, tried to deobfuscate with some result which looks on dnSpy the same (...
1
vote
0answers
67 views

Guidelines for dealing with obfuscated code

I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
1
vote
2answers
94 views

Working with strong obfuscated Java

I've got a jar file, that is strong obfuscated. When I tried to put it into decompilers such as bytecode-viewer and luyten I seen many lines of traps and Chinese letters. I tried to deobfuscate it ...
2
votes
2answers
117 views

Virtual machine code obfuscation implementation details

I want to implement a VM based simple proof-of-concept obfuscator. It should take an exe file as input and produce a new pe file with appended vm section. For simplicity let's say the exe file is ...
2
votes
1answer
437 views

De-obfuscating code ran through JScrambler 3x via Eval() functions

I am relatively new to JS and de-obfuscation in general and I am having difficulties reversing some complicated JS. I know the code itself is obsfucated via jscrambler 3-4x and therefore is ran ...
1
vote
0answers
109 views

How to use Ghidra to work with VM obfuscated binaries?

By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
1
vote
1answer
928 views

Suspicious obfuscated javascript file

This question is related to another question made on StackOverflow. The users asks about a unknown JavaScript file which is being loaded on his website. I managed to unroll a bit of the JavaScript ...
5
votes
1answer
1k views

Understanding AutoIT “compilation”

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
1
vote
0answers
42 views

Main contemporary deobfuscation techniques

Could you please specify in a few words main contemporary deobfuscation techniques which we can apply to 32/64 bit PE files? For example, (1) using instruction templates, such as: mov edx, 5B1F04F1h ...
1
vote
1answer
89 views

Reverse Engineering Java - Deobfuscating symbols

I'm new to Java and working on cleaning up a fairly large Java .jar sample where the obfuscator has renamed symbols into invalid names. For example: import org.lib.00.0.2; public final class 90 ...
-2
votes
1answer
763 views

How to decompile obfuscated Python code?

I have an executable file, which I am trying to decompile. I have already deduced that it was originally programmed in Python. I know that it was obfuscated with PyArmor and possibly compiled with ...
2
votes
0answers
42 views

Reverse engineering hidden audio track in this MPEG-1 video file?

No matter what video player or video analysis software I throw this video at, neither are able to reproduce or detect the audio track of the video: Introduction video of Wipeout XL PC version (...
1
vote
0answers
147 views

What is the header 'X-Goog-Spatula'?

I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not ...
2
votes
0answers
87 views

How to reverse engineer an exe built using nexe?

I am working on an express application. I obfuscate the source code using javascript-obfuscator. I am using nexe cli for generating a single exe from the obfuscated code. Can anyone tell me if there ...
63
votes
8answers
204k views

How do I reverse engineer .so files found in android APKs?

I know how to reverse engineer normal android APKs using tools like APK-tool anddex2jar but i don't know how to work with obfuscation. Can anyone help or atleast provide some pointers? I know this ...
0
votes
1answer
193 views

Obfuscated VBE malware script analysis

Some actions of this script are clear e.g. the section that adds firewall rules, others not so much On Error Resume Next F27 F10 A0 DBCF Sub F27() Dim E13C563AFCB34, C0009B48F34B, C8, ...
-1
votes
1answer
136 views

De-obfuscate JS code [closed]

I came across a script that converts font files from one type to another (i.e. WOFF to TTF, etc). I would like to understand it and incorporate some of the code into a personal project. The script ...
2
votes
2answers
724 views

Dealing with heavily obfuscated Java, possibly on bytecode level

I've got a jarfile from a friend, he told me to put it thru an decompiler. So I did, but: JD-GUI basically spit out just the imports and didn't show any class data CFR dumped out stack trace on ...
1
vote
1answer
213 views

Is it possible to completely reverse this code?

i have this code i'm trying to deobfuscate https://pastebin.com/g5mHpWE4 I used https://beautifier.io/ and http://www.jsnice.org/ but the result is still not good, current code: https://pastebin.com/...
0
votes
1answer
126 views

Error After de4dot - Application Does Not Start

There is an application that has been obfuscation to learn. So in an unpack me style. In the first stage I would unpack with de4dot. After you unpack, the running application stops working. dump and ...
1
vote
1answer
171 views

Reversing a key-gen firmware for RISC-V

I would like to study this firmware for Sipeed MAix, a RISC-V development board. You can download it here: key_gen_v1.2.zip. As the name suggests, its purpose is to calculate and print a "machine key"...
2
votes
2answers
276 views

Static analysis obfuscated code

I'm reversing a code that is heavily obfuscated. It uses opaque predicates, call stack tampering, junk code and control flow flattering. Call stack tampering uses indirect branches (push register / ...
0
votes
1answer
781 views

How can I deobfuscate this javascript code

I am trying to deobfuscate this javascript code, but I don't know how it was created. Can you please tell me what the mechanism or the function is that generate such characters in javascript? É=-~-~[]...
0
votes
2answers
177 views

How to remove bytes/opcodes within IDA Pro database

I am dealing with a heavily obfuscated binary, with certain portions of it having an abundance of junk code when it attempts to set a value at certain offsets to esp/ebp. My question, having ...
2
votes
0answers
1k views

How to decompile a obfuscated mach-o dylib?

I am trying to decompile a dylib called libConfigurer64.dylib, which is loaded from the environment variable "DYLD_INSERT_LIBRARIES" I want to analyze what it really does, so I dragged it in to IDA,...
10
votes
4answers
21k views

Try to deobfuscate multi layered javascript

According to the techy zilla blog It will be much harder to deobfuscate code that has been obfuscated using multiple obfuscating algorithms. According to them, jsbeautifier can't fix this obfuscated ...
0
votes
1answer
100 views

Need help identifying a -possibly- encrypted string

I'm having some trouble building an app that gets data from a database to keep a log of files added to a website. Most URLs are generated from a file ID and a time stamp, some of those URLs are ...
68
votes
9answers
69k views

Analyzing highly obfuscated JavaScript

I was recently analyzing a web page that contained some highly obfuscated JavaScript - it's clear that the author had went through quite a bit of effort to make it as hard to understand as possible. I'...
0
votes
0answers
60 views

Output address path during .exe execution

I have an obfuscated software. I'm a beginner in this area, so I don't find where a patch would be useful for what I want to do. It turns out that I have an idea of how I could find out in which ...
2
votes
1answer
2k views

Assistance in Decrypting Lua script that is obfuscated with Base64 > SSL

Can anyone on here help me on decrypting the SSL encryption that protects this LUA script linked at the end of this topic ? Basically they are encoded with Base64 then SSL, but I have no idea how to ...
1
vote
0answers
105 views

deobfuscating/decompiling extremely complicated javascript [closed]

I am working with some extremely complicated JavaScript. It is around 70,000 lines long and sections of the code look like this U2xx.l11="0x78920d50";m2xx.r9G="11";b2xx.v3y="0x744ebc37";P2xx.K5h="...
1
vote
1answer
1k views

How to deobfuscate native Android library obfuscated with OLLVM?

When I load the binay in IDA, all I can see are loads of .datadiv_decodeXXX... functions and this is because of OLLVM. I know it is possible as a Chinese article I found said they were able to ...
2
votes
1answer
156 views

Does a symbolic disassembler exist?

I would like to know if there are disassemblers based on a symbolic analysis, I'm beginner in RE, but I think that a disassembler based on symbolic techniques can be very interesting and could ...
1
vote
1answer
341 views

What's this obfuscation technique?

I'm reverse-engineering a particular dylib on Mac OS X. The dylib is highly obfuscated, but I suspect it's from some well-known technique that I'm not aware of. I'd like to describe it in the hope ...
6
votes
1answer
446 views

Simplifying assembly

I'm analysing some binary trace, it's pretty much obfuscated. What I need to do is to understand work flow of its alghoritms. However I cannot find any reliable tool which would help me with that. I ...
1
vote
2answers
3k views

(de4dot) The file isn't a .NET PE file

Probably, many of you have ever seen the message from de4dot while trying to deobfuscate app/dll: WARNING: The file isn't a .NET PE file: What steps to take in such cases to proceed? How to make the ...
0
votes
0answers
943 views

How to detect obfuscator (de4dot shows: Detected unknown obfuscator)

Generally, I use de4dot to detect obfuscator or deobfuscate. But some files are protected as they show: Detected unknown obfuscator What are ways to detect the obfuscator of .exe?
2
votes
1answer
150 views

Find out string encoding/shift of proprietary binary file format

I'm trying to reverse-engineer a proprietary file format to be able to extract certain strings from files in this format. I have the application, that writes the files, at hand. By trial-and-error I ...
3
votes
0answers
722 views

Deobfuscate PHP that contains - goto

I've found a bunch of obfuscated PHP scripts in my server but it seems I cannot deobfuscate them to follow the code flow. I came to the conclusion that the files have been obfuscated with https://www....