Questions tagged [deobfuscation]

Techniques to remove obfuscation from a piece of program.

Filter by
Sorted by
Tagged with
0
votes
1answer
52 views

How can I deobfuscate this javascript code

I am trying to deobfuscate this javascript code, but I don't know how it was created. Can you please tell me what the mechanism or the function is that generate such characters in javascript? É=-~-~[]...
1
vote
0answers
46 views

Reversing a key-gen firmware for RISC-V

I would like to study this firmware for Sipeed MAix, a RISC-V development board. You can download it here: key_gen_v1.2.zip. As the name suggests, its purpose is to calculate and print a "machine key"...
0
votes
2answers
43 views

How to remove bytes/opcodes within IDA Pro database

I am dealing with a heavily obfuscated binary, with certain portions of it having an abundance of junk code when it attempts to set a value at certain offsets to esp/ebp. My question, having ...
0
votes
1answer
100 views

How does ConfuserEx work and what to look out for?

I wanted to learn how to crack some .NET obfuscated programs and I'm wondering how does ConfuserEx (since that seems to be the state-of-the-art) work? What do I have to look out for and why? What ...
0
votes
1answer
96 views

Need help identifying a -possibly- encrypted string

I'm having some trouble building an app that gets data from a database to keep a log of files added to a website. Most URLs are generated from a file ID and a time stamp, some of those URLs are ...
0
votes
0answers
97 views

Reverse engineering .NET malware - iloveyou.exe

I have a .NET malware sample whose dynamic behavior I understand. It is also packed. de4dot identified the obfuscator as .NET Reactor, so I used de4dot to de-obfuscate it. However, after de-...
0
votes
0answers
53 views

Output address path during .exe execution

I have an obfuscated software. I'm a beginner in this area, so I don't find where a patch would be useful for what I want to do. It turns out that I have an idea of how I could find out in which ...
0
votes
0answers
52 views

replace variable references with its values at once in javascript file

I'm trying to de-obfuscate a Javascript file: Javascript Obfuscated File I have already de-obfuscated the code but it's still hard to read. As you can see in the code below there is a huge list of ...
1
vote
1answer
253 views

De-obfuscating code ran through JScrambler 3x via Eval() functions

I am relatively new to JS and de-obfuscation in general and I am having difficulties reversing some complicated JS. I know the code itself is obsfucated via jscrambler 3-4x and therefore is ran ...
1
vote
0answers
74 views

deobfuscating/decompiling extremely complicated javascript [closed]

I am working with some extremely complicated JavaScript. It is around 70,000 lines long and sections of the code look like this U2xx.l11="0x78920d50";m2xx.r9G="11";b2xx.v3y="0x744ebc37";P2xx.K5h="...
0
votes
1answer
682 views

How to deobfuscate native Android library obfuscated with OLLVM?

When I load the binay in IDA, all I can see are loads of .datadiv_decodeXXX... functions and this is because of OLLVM. I know it is possible as a Chinese article I found said they were able to ...
0
votes
0answers
36 views

Replacing a function call with it's result in a script

I'm working with a heavily obfuscated Autoit malware script and one of the major problems is that almost all variables and lines of code are obfuscated by a custom function. The problem is that this ...
1
vote
1answer
124 views

Does a symbolic disassembler exist?

I would like to know if there are disassemblers based on a symbolic analysis, I'm beginner in RE, but I think that a disassembler based on symbolic techniques can be very interesting and could ...
0
votes
0answers
76 views

Determining correct javascript file deobfuscation

I am trying to reverse engineer a game which sends it's data through an Obfuscate and DeObfuscate function to protect itself. The code base is 50k+ lines long (pretty printed), and eval techniques ...
1
vote
1answer
203 views

What's this obfuscation technique?

I'm reverse-engineering a particular dylib on Mac OS X. The dylib is highly obfuscated, but I suspect it's from some well-known technique that I'm not aware of. I'd like to describe it in the hope ...
2
votes
0answers
602 views

How to decompile a obfuscated mach-o dylib?

I am trying to decompile a dylib called libConfigurer64.dylib, which is loaded from the environment variable "DYLD_INSERT_LIBRARIES" I want to analyze what it really does, so I dragged it in to IDA,...
6
votes
1answer
397 views

Simplifying assembly

I'm analysing some binary trace, it's pretty much obfuscated. What I need to do is to understand work flow of its alghoritms. However I cannot find any reliable tool which would help me with that. I ...
1
vote
2answers
2k views

(de4dot) The file isn't a .NET PE file

Probably, many of you have ever seen the message from de4dot while trying to deobfuscate app/dll: WARNING: The file isn't a .NET PE file: What steps to take in such cases to proceed? How to make the ...
0
votes
0answers
566 views

How to detect obfuscator (de4dot shows: Detected unknown obfuscator)

Generally, I use de4dot to detect obfuscator or deobfuscate. But some files are protected as they show: Detected unknown obfuscator What are ways to detect the obfuscator of .exe?
2
votes
1answer
131 views

Find out string encoding/shift of proprietary binary file format

I'm trying to reverse-engineer a proprietary file format to be able to extract certain strings from files in this format. I have the application, that writes the files, at hand. By trial-and-error I ...
3
votes
0answers
481 views

Deobfuscate PHP that contains - goto

I've found a bunch of obfuscated PHP scripts in my server but it seems I cannot deobfuscate them to follow the code flow. I came to the conclusion that the files have been obfuscated with https://www....
1
vote
0answers
848 views

Can de4dot deobfuscate Dotfuscator Professional?

I ran de4dot on a Xamarin app obfuscated using Dotfuscator Professional. However, there's still the random switches and strange ints everywhere. Can de4dot decode this? If not, is there another tool ...
4
votes
3answers
209 views

Obfuscated code analysis - can unused variables be ignored?

I am analyzing a malicious javascript. The code is encoded and obfuscated in a way that I did not manage to even partially deobfuscate yet and it is filled with long strings. In order to simplify the ...
1
vote
1answer
2k views

Is deobfuscation of my javascript code hard or easy?

I am trying to protect my app code from theft. Since most of it is written in javascript I had to use many obfuscation techniques to make it incomprehensible. I have written a very small piece of ...
-3
votes
1answer
6k views

How do I decode this JavaScript code? [duplicate]

Each file starts with the same function: (function(_0x128f83, _0x1ae5b9) { var _0x1b5471 = function(_0x339be5) { while (--_0x339be5) { _0x128f83['push'](_0x128f83['shift']()); ...
-1
votes
1answer
1k views

How decrypt hexadecimal javascript code? [closed]

Someone here already had success to deobfuscate 100% a "hexadecimal" Javascript code? E.g.: var _0x22bc92 = function() { var _0x26938d = !![]; return function(_0x100751, _0x54d399) { ...
1
vote
1answer
368 views

Map an obfuscated javascript file to the original

Among other approaches, there are ways to "prettify" obfuscated javascript. But most of such approaches are geared towards someone trying to understand code that's not their own (e.g. from a website, ...
3
votes
2answers
100 views

Hardcoded addresses in dumped PEs

I have taken a dump of a game using Explorer Suite, and while looking at some obfuscated parts of the game PE's text section in IDA, I've seen code that follows this form: mov rbp, 7FF633CE2790h jmp ...
2
votes
1answer
796 views

IDA 7.0 (freeware) auto-analysis gets stuck in a loop

I am trying to create a graph so that I can visualize the flow of a particular function in a game that I am interested in. I was initially using Cheat Engine to follow the flow of the function, but ...
-1
votes
4answers
502 views

Decrypting authorization PHP script

Description I asked for help on freelancing, for the finalization of the project in PHP. All this worked well until I needed to edit the authorization mechanism. Having opened the file, I found that ...
1
vote
1answer
196 views

De-obfuscation - Emulation-oriented vs Script-oriented

What are the advantages of each method when employing de-obsfucation of potentially malicious code? I've been told to always use emulators like x86emu since it doesn't actually run the code when ...
3
votes
1answer
744 views

How to deal with heavy control flow flattening?

I am trying to reverse engineer an executable that uses a lot of control flow flattening obfuscation (i.e, lots of subroutines that end with something like jmp esi, jmp eax) IDA Pro isn't able to ...
1
vote
1answer
261 views

deobfuscating javascript injected into Wordpress

Found a WP site (not mine) with lovely obfuscated code injected into the footer so I've been trying to de-obfuscate it. I ran it through unpacker, then converted hex to ASCII, then un-minified to ...
1
vote
0answers
453 views

Decode RubyEncoder

I was trying out some things when I came across some RubyEncoder encoded code. After searching the web, I found basically nothing useful on how to reverse them (Except this and [this][2], but I had no ...
2
votes
0answers
2k views

Tool for JavaScript deobfuscation

I'd like to reverse engineer a JavaScript program by manually renaming minimified variable, parameter and function names. However, updating my reverse-engineered code to a newer version would be very ...
1
vote
2answers
672 views

how to deobfuscate Autoit strings?

The code is: https://pastebin.com/ZwvySjgy Is it possible to deobfuscate the strings protected with STRINGDEC?
0
votes
1answer
403 views

Unpacking ROM dump

I have a ROM dump from an unknown controller, which must be reversed (as a task). It looks like encrypted, packed or obfuscated. Binwalk did not give any information("cisco os experimental microcode ...
3
votes
1answer
467 views

Animal Crossing: Pocket Camp .zdat File

Hello I am trying to obtain the music from the new game Animal Crossing: Pocket Camp. The music is contained in files like these: https://download-cdn-ac-pocketcamp.akamaized.net/assets/...
1
vote
0answers
786 views

de4dot and Dotfuscator: IL looks different, not DotPeek decompiled code

From the obfuscated to the deobfuscated assemblies, IL code looks different using ILDASM; however, DotPeek decompiled C# code looks exactly the same for both. Any clue why? The obfuscation software ...
2
votes
2answers
143 views

How to call an item of a Javascript array?

Say I have the following Javascript array: var _0xe984=[ '\x61\x70\x70\x6c\x79', '\x72\x65\x74\x75\x72\x6e\x20\x28\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x28\x29\x20', '\x7b\x7d\x2e\x63\x6f\x6e\x73\...
0
votes
1answer
168 views

How does the different types of executable packing work?

Reference to this thread: What are the different types of packers? Q1: How do packing methods like compression, protection, and encryption work, how do they differ, and which is more secure? Q2: ...
3
votes
1answer
1k views

Understanding AutoIT “compilation”

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
1
vote
1answer
3k views

Decompiling and deobfuscating APK file

Let's suppose that I have an APK file. I decompiled it but I have very obfuscated code. Is it possible to analize this APK in such way that application will be executed step by step (instruction after ...
1
vote
1answer
1k views

How to run and reconstruct a packed DLL in IDA Pro?

I have a packed DLL. It has an entry point. If I call LoadLibrary it gets unpacked with the entry point code. Then I can attach a debugger to the .exe that called LoadLibrary and see the unpacked dll ...
1
vote
2answers
2k views

Renaming entitites in obfuscated java bytecode

I'm working with an SDK for developing apps that's distributed as an AAR, and has been obfuscated with ProGuard. I'm just trying to reverse a few things it does. The classes, methods and variables ...
2
votes
3answers
5k views

Extracting classes from running JVM

I'm trying to RE a Java application that uses an obfuscated loader program to load classes from a second, obfuscated archive-like file. I'm trying to get at these loaded classes for further analysis, ...
2
votes
1answer
654 views

How to get address where MakeFunction() failed in IDA Pro

I am analysing obfuscated code which contains code paths leading to dummy instructions. These dummy instructions prevent IDA from creating functions. However, I need these functions to do a function ...
2
votes
0answers
872 views

Do any known deobfuscateors work on Agile.net 6.4?

As a company we are going to start obfuscating our released binaries, so far the best front runner we have found has been Agile.net 6.4. I took one of our binaries we obfuscated with the trial ...
1
vote
1answer
1k views

Are .NET DLLs, even the best obfuscated ones, less secure than C++ DLLs?

From what I understand about .NET code, it is first compiled to Microsoft Common Intermediate Language (MSIL) before being translated to machine code at runtime. Whereas C++ code is compiled directly ...
0
votes
0answers
110 views

Reassemble function that has its control flow chopped so that it can be decompiled by IDA

I try to decompile a function that is obfuscated by having split up the controlflow into asmblocks scattered around the .text section and connected by "jmpq" jumps. <func1>: 0: insn.. 1: ...