Questions tagged [deobfuscation]

Techniques to remove obfuscation from a piece of program.

25 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
0answers
481 views

Deobfuscate PHP that contains - goto

I've found a bunch of obfuscated PHP scripts in my server but it seems I cannot deobfuscate them to follow the code flow. I came to the conclusion that the files have been obfuscated with https://www....
3
votes
1answer
1k views

Understanding AutoIT “compilation”

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
3
votes
1answer
552 views

Reversal of unknown obfuscation or encryption with known plaintext

Introduction For academical reasons I am reversing a firmware for an embedded device. I have already created a perl script which is able to parse the firmware structure and extract files from it (its ...
2
votes
0answers
601 views

How to decompile a obfuscated mach-o dylib?

I am trying to decompile a dylib called libConfigurer64.dylib, which is loaded from the environment variable "DYLD_INSERT_LIBRARIES" I want to analyze what it really does, so I dragged it in to IDA,...
2
votes
0answers
2k views

Tool for JavaScript deobfuscation

I'd like to reverse engineer a JavaScript program by manually renaming minimified variable, parameter and function names. However, updating my reverse-engineered code to a newer version would be very ...
2
votes
0answers
872 views

Do any known deobfuscateors work on Agile.net 6.4?

As a company we are going to start obfuscating our released binaries, so far the best front runner we have found has been Agile.net 6.4. I took one of our binaries we obfuscated with the trial ...
2
votes
0answers
539 views

find CRC algorithm, having some input and output data pairs

I'm trying to discover the algorithm of a lost software, there is an equipment that requiest some data, and validates the data using the "KEY", if you change any parameter of the data then you need a ...
2
votes
0answers
167 views

Javascript equivalent of JEB

In case you already know, there is a full-feature decompiler for Java/Android called JEB (https://www.pnfsoftware.com/) Some of the most important features include the ability to rename identifiers ...
1
vote
0answers
46 views

Reversing a key-gen firmware for RISC-V

I would like to study this firmware for Sipeed MAix, a RISC-V development board. You can download it here: key_gen_v1.2.zip. As the name suggests, its purpose is to calculate and print a "machine key"...
1
vote
1answer
253 views

De-obfuscating code ran through JScrambler 3x via Eval() functions

I am relatively new to JS and de-obfuscation in general and I am having difficulties reversing some complicated JS. I know the code itself is obsfucated via jscrambler 3-4x and therefore is ran ...
1
vote
0answers
848 views

Can de4dot deobfuscate Dotfuscator Professional?

I ran de4dot on a Xamarin app obfuscated using Dotfuscator Professional. However, there's still the random switches and strange ints everywhere. Can de4dot decode this? If not, is there another tool ...
1
vote
0answers
453 views

Decode RubyEncoder

I was trying out some things when I came across some RubyEncoder encoded code. After searching the web, I found basically nothing useful on how to reverse them (Except this and [this][2], but I had no ...
1
vote
0answers
786 views

de4dot and Dotfuscator: IL looks different, not DotPeek decompiled code

From the obfuscated to the deobfuscated assemblies, IL code looks different using ILDASM; however, DotPeek decompiled C# code looks exactly the same for both. Any clue why? The obfuscation software ...
1
vote
0answers
304 views

Discovering byte array obfuscation function

I'm in the middle of reverse engineering SafeNet (formerly Rainbow) iKey 1000 USB dongle protocol, in order to create Linux driver for it. I'm using Windows as guest in virtual machine on Linux host ...
1
vote
1answer
730 views

Suspicious obfuscated javascript file

This question is related to another question made on StackOverflow. The users asks about a unknown JavaScript file which is being loaded on his website. I managed to unroll a bit of the JavaScript ...
1
vote
0answers
1k views

How to send and render an .html for chromecast using RAW http requests?

I am trying to RE the chrome cast protocol. I saw Koushik Dutta did RE the protocol, but didn't find any post online analyze the protocol. Moreover Google changed it a little bit since then. ...
0
votes
1answer
99 views

How does ConfuserEx work and what to look out for?

I wanted to learn how to crack some .NET obfuscated programs and I'm wondering how does ConfuserEx (since that seems to be the state-of-the-art) work? What do I have to look out for and why? What ...
0
votes
0answers
96 views

Reverse engineering .NET malware - iloveyou.exe

I have a .NET malware sample whose dynamic behavior I understand. It is also packed. de4dot identified the obfuscator as .NET Reactor, so I used de4dot to de-obfuscate it. However, after de-...
0
votes
0answers
53 views

Output address path during .exe execution

I have an obfuscated software. I'm a beginner in this area, so I don't find where a patch would be useful for what I want to do. It turns out that I have an idea of how I could find out in which ...
0
votes
0answers
52 views

replace variable references with its values at once in javascript file

I'm trying to de-obfuscate a Javascript file: Javascript Obfuscated File I have already de-obfuscated the code but it's still hard to read. As you can see in the code below there is a huge list of ...
0
votes
0answers
36 views

Replacing a function call with it's result in a script

I'm working with a heavily obfuscated Autoit malware script and one of the major problems is that almost all variables and lines of code are obfuscated by a custom function. The problem is that this ...
0
votes
0answers
76 views

Determining correct javascript file deobfuscation

I am trying to reverse engineer a game which sends it's data through an Obfuscate and DeObfuscate function to protect itself. The code base is 50k+ lines long (pretty printed), and eval techniques ...
0
votes
0answers
565 views

How to detect obfuscator (de4dot shows: Detected unknown obfuscator)

Generally, I use de4dot to detect obfuscator or deobfuscate. But some files are protected as they show: Detected unknown obfuscator What are ways to detect the obfuscator of .exe?
0
votes
0answers
110 views

Reassemble function that has its control flow chopped so that it can be decompiled by IDA

I try to decompile a function that is obfuscated by having split up the controlflow into asmblocks scattered around the .text section and connected by "jmpq" jumps. <func1>: 0: insn.. 1: ...
0
votes
0answers
219 views

How to pass Obfuscated Elf binary to gcc optimization end

Currently I have a 2000+Line function to reverse engineer with many redundancies and appears to be obfuscated. It their a way to pass to pass this binary to gcc or clang to reassemble it and optimize ...