Questions tagged [deobfuscation]

Techniques to remove obfuscation from a piece of program.

48 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
1answer
2k views

Understanding AutoIT "compilation"

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
3
votes
0answers
257 views

How can I practically approach VM-obfuscated code with symbolic analysis/execution?

Dealing with VM-obfuscated code and started learning about symbolic analysis but having a hard time wrapping my head around how to practically apply it to a problem. If someone can give me some ...
3
votes
0answers
1k views

Deobfuscate PHP that contains - goto

I've found a bunch of obfuscated PHP scripts in my server but it seems I cannot deobfuscate them to follow the code flow. I came to the conclusion that the files have been obfuscated with https://www....
3
votes
0answers
2k views

Tool for JavaScript deobfuscation

I'd like to reverse engineer a JavaScript program by manually renaming minimified variable, parameter and function names. However, updating my reverse-engineered code to a newer version would be very ...
3
votes
1answer
737 views

Reversal of unknown obfuscation or encryption with known plaintext

Introduction For academical reasons I am reversing a firmware for an embedded device. I have already created a perl script which is able to parse the firmware structure and extract files from it (its ...
2
votes
0answers
28 views

How to use smalivm and simplify to find a certain static constant from APK or remove confusion?

smalivm: Provides a virtual machine sandbox for executing Dalvik methods. After executing a method, it returns a graph containing all possible register and class values for every execution path. I ...
2
votes
0answers
4k views

Deobfuscating Unknown C# obfuscator?

Hello, I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my ...
2
votes
0answers
374 views

How To Deobfuscate ConfuserEx .NET Assembly?

No matter what I try I cannot deobfuscate this crackme https://crackmes.one/crackme/5d6c847433c5d46f00e2c390. I have tried each & every tutorial on youTube of which this one is the best https://...
2
votes
0answers
5k views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
2
votes
0answers
452 views

How to use Ghidra to work with VM obfuscated binaries?

By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
2
votes
0answers
66 views

Reverse engineering hidden audio track in this MPEG-1 video file?

No matter what video player or video analysis software I throw this video at, neither are able to reproduce or detect the audio track of the video: Introduction video of Wipeout XL PC version (...
2
votes
1answer
797 views

How to reverse engineer an exe built using nexe?

I am working on an express application. I obfuscate the source code using javascript-obfuscator. I am using nexe cli for generating a single exe from the obfuscated code. Can anyone tell me if there ...
2
votes
1answer
763 views

De-obfuscating code ran through JScrambler 3x via Eval() functions

I am relatively new to JS and de-obfuscation in general and I am having difficulties reversing some complicated JS. I know the code itself is obsfucated via jscrambler 3-4x and therefore is ran ...
2
votes
0answers
1k views

How to decompile a obfuscated mach-o dylib?

I am trying to decompile a dylib called libConfigurer64.dylib, which is loaded from the environment variable "DYLD_INSERT_LIBRARIES" I want to analyze what it really does, so I dragged it in to IDA,...
2
votes
0answers
2k views

Can de4dot deobfuscate Dotfuscator Professional?

I ran de4dot on a Xamarin app obfuscated using Dotfuscator Professional. However, there's still the random switches and strange ints everywhere. Can de4dot decode this? If not, is there another tool ...
2
votes
0answers
754 views

Decode RubyEncoder

I was trying out some things when I came across some RubyEncoder encoded code. After searching the web, I found basically nothing useful on how to reverse them (Except this and [this][2], but I had no ...
2
votes
0answers
1k views

Do any known deobfuscateors work on Agile.net 6.4?

As a company we are going to start obfuscating our released binaries, so far the best front runner we have found has been Agile.net 6.4. I took one of our binaries we obfuscated with the trial ...
2
votes
0answers
570 views

find CRC algorithm, having some input and output data pairs

I'm trying to discover the algorithm of a lost software, there is an equipment that requiest some data, and validates the data using the "KEY", if you change any parameter of the data then you need a ...
2
votes
0answers
196 views

Javascript equivalent of JEB

In case you already know, there is a full-feature decompiler for Java/Android called JEB (https://www.pnfsoftware.com/) Some of the most important features include the ability to rename identifiers ...
1
vote
0answers
47 views

How can I decode this Malicious php code?

I found this backdoor on a client's website. https://github.com/baogiaphucthinh/Malicious-php/blob/main/1259da6sc.php (original file) I have gotten rid of it and realise it's an obfuscated script but ...
1
vote
0answers
46 views

RE on firmware images that seem to use weak encryption/obfuscation. Robot vacuum

I have been playing with some robot vacuums that utilize very basic navigation, and I am wanting to play around with my own provisioning along with adding a Rpi to augment features. These vacuums are ...
1
vote
0answers
85 views

Looking for obfuscation patterns within jumps

I'm working on an obfuscated binary. I recognized some patterns used to confuse the disassembler, some used to obfuscate function calls, some other for conditional jumps and so on. The idea was to ...
1
vote
0answers
1k views

Reversing PyArmor + Pyinstaller

Created an application, protected by PyArmor and used pyinstaller. I'm trying to reverse engineer it. So far I've decompiled the exe into pyc files but it's still pyarmor encrypted I can only see the ...
1
vote
0answers
177 views

Guidelines for dealing with obfuscated code

I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
1
vote
0answers
45 views

Main contemporary deobfuscation techniques

Could you please specify in a few words main contemporary deobfuscation techniques which we can apply to 32/64 bit PE files? For example, (1) using instruction templates, such as: mov edx, 5B1F04F1h ...
1
vote
0answers
321 views

What is the header 'X-Goog-Spatula'?

I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not ...
1
vote
0answers
1k views

How to detect obfuscator (de4dot shows: Detected unknown obfuscator)

Generally, I use de4dot to detect obfuscator or deobfuscate. But some files are protected as they show: Detected unknown obfuscator What are ways to detect the obfuscator of .exe?
1
vote
0answers
1k views

de4dot and Dotfuscator: IL looks different, not DotPeek decompiled code

From the obfuscated to the deobfuscated assemblies, IL code looks different using ILDASM; however, DotPeek decompiled C# code looks exactly the same for both. Any clue why? The obfuscation software ...
1
vote
0answers
349 views

Discovering byte array obfuscation function

I'm in the middle of reverse engineering SafeNet (formerly Rainbow) iKey 1000 USB dongle protocol, in order to create Linux driver for it. I'm using Windows as guest in virtual machine on Linux host ...
1
vote
0answers
1k views

How to send and render an .html for chromecast using RAW http requests?

I am trying to RE the chrome cast protocol. I saw Koushik Dutta did RE the protocol, but didn't find any post online analyze the protocol. Moreover Google changed it a little bit since then. ...
0
votes
0answers
39 views

How to deobfuscate Java application

Hi i am unable to deobfuscate the Advanced String Obfuscation Jar on tryHackMe I tried dumping the classes using a dumper javaagent deobfuscate the jar with java-deobfuscator threadtear functions ...
0
votes
0answers
21 views

How to keep track of Dynamic Variables

The thing I'm trying to reverse has a lot of variables on allocated memory so I can't comment and keep track of the addresses as every time I re-run the software they will be different.. I'm working ...
0
votes
0answers
14 views

Need Help with decryption backup config.bin file "ZTE ZXHN H168N V3.5"

I am trying to decrypt my router config.bin file.( model mentioned above). When i use zcu utility to decompress my backup to Original format it's say payload 4 .. and the key might be your serial. I ...
0
votes
0answers
37 views

How to reverse engine JS code whose callstacks are hidden?

I am learning how to reverse engine JS code and got a hard exercise, beyond hidding strings this obfuscated JS tries to hide callstacks by spreading and storing partial computations in a bunch of ...
0
votes
0answers
58 views

Determining a password-hashing function knowing plaintext + output

I have a password that has been stored and I'd like to figure out how it's been 'transformed' to be stored in my database. The plaintext password is: k4oK203$ And the password as it is stored 'crypted'...
0
votes
0answers
46 views

Deobfuscating JS Code?

I am trying to deobfuscate a highly obfuscated JS file for use to be passed in along with an HTTP POST request from my C# application. I don't know much about JS. The file I am trying to deobfuscate ...
0
votes
0answers
64 views

how to get rid of this obfuscator?

i somehow know that this is Confuserex but noting working agter many try the file is still unreadable. is there a way to? or im just bad... ps.i unpack this from the exe file that only has PE(maybe ...
0
votes
0answers
20 views

Tools for tracing down a Windows-specific UUID generation?

I'm have a kind of "Crackme" program that generates a 4-byte Windows system-specific UUID. It doesn't seem to be hardware-dependent - I have created 2 identical Windows 7 virtualboxes - same ...
0
votes
1answer
76 views

$$Lambda$(number) when decompiled java bytecode

why when i decompile java bytecode (which further was decompiled from .dex), i get $$Lambda$(number), in java files, and it's not possible to build project with these java codes as it's insufficient ...
0
votes
0answers
113 views

Reverse Engineering Instagram's Private API

I'm trying to reverse engineer Instagram Web's Private API. I have successfully managed to login into Instagram using their login endpoint using man-in-the-middle proxy and postman. I now want to send ...
0
votes
1answer
411 views

How can I de-obfuscate a VBScript (.vbs) file?

I have a VBScript (.vbs) file that is a malware dropper. It executes correctly in a commercial malware sandbox. but does not act the same in my manual analysis lab, and I need to figure out why. The ...
0
votes
2answers
380 views

Decode xor data in IDA

I have code that looks like this: byte_100031BA4 = v41; byte_100031BA5 ^= 0x3Eu; byte_100031BA6 ^= 0x47u; LOBYTE(a1) = -9; byte_100031BA7 ^= 0xF7u; byte_100031BA8 ^= 0xA9u; byte_100031BA9 ^= 0xE8u; ...
0
votes
2answers
275 views

Reverse Engineering Javascript - Out of Memory

I found this javascript file on one of those online movie streaming services and was interested in finding out what it does. However, after trying many deobfuscators I am still stuck. A major ...
0
votes
0answers
62 views

Output address path during .exe execution

I have an obfuscated software. I'm a beginner in this area, so I don't find where a patch would be useful for what I want to do. It turns out that I have an idea of how I could find out in which ...
0
votes
0answers
129 views

Reassemble function that has its control flow chopped so that it can be decompiled by IDA

I try to decompile a function that is obfuscated by having split up the controlflow into asmblocks scattered around the .text section and connected by "jmpq" jumps. <func1>: 0: insn.. 1: ...
0
votes
0answers
313 views

How to pass Obfuscated Elf binary to gcc optimization end

Currently I have a 2000+Line function to reverse engineer with many redundancies and appears to be obfuscated. It their a way to pass to pass this binary to gcc or clang to reassemble it and optimize ...
0
votes
1answer
1k views

Suspicious obfuscated javascript file

This question is related to another question made on StackOverflow. The users asks about a unknown JavaScript file which is being loaded on his website. I managed to unroll a bit of the JavaScript ...
-2
votes
1answer
145 views

What obfuscator is used?

In version 3.7.3.7 I was able to modify some parts of the code using dnSpy. The language is C#. But in the new(next) version, I did not succeed and I guess the code is obfuscated. De4dot did not help. ...