Skip to main content

Questions tagged [deobfuscation]

Techniques to remove obfuscation from a piece of program.

Filter by
Sorted by
Tagged with
2 votes
1 answer
722 views

Animal Crossing: Pocket Camp .zdat File

Hello I am trying to obtain the music from the new game Animal Crossing: Pocket Camp. The music is contained in files like these: https://download-cdn-ac-pocketcamp.akamaized.net/assets/...
Michael's user avatar
  • 49
1 vote
0 answers
2k views

de4dot and Dotfuscator: IL looks different, not DotPeek decompiled code

From the obfuscated to the deobfuscated assemblies, IL code looks different using ILDASM; however, DotPeek decompiled C# code looks exactly the same for both. Any clue why? The obfuscation software ...
Masamune Shirow's user avatar
2 votes
2 answers
228 views

How to call an item of a Javascript array?

Say I have the following Javascript array: var _0xe984=[ '\x61\x70\x70\x6c\x79', '\x72\x65\x74\x75\x72\x6e\x20\x28\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x28\x29\x20', '\x7b\x7d\x2e\x63\x6f\x6e\x73\...
ESCM's user avatar
  • 143
0 votes
1 answer
370 views

How does the different types of executable packing work?

Reference to this thread: What are the different types of packers? Q1: How do packing methods like compression, protection, and encryption work, how do they differ, and which is more secure? Q2: ...
Nicolas Wein's user avatar
5 votes
1 answer
2k views

Understanding AutoIT "compilation"

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
majidarif's user avatar
  • 235
1 vote
1 answer
6k views

Decompiling and deobfuscating APK file

Let's suppose that I have an APK file. I decompiled it but I have very obfuscated code. Is it possible to analize this APK in such way that application will be executed step by step (instruction after ...
Bartosz Królak's user avatar
0 votes
1 answer
3k views

How to run and reconstruct a packed DLL in IDA Pro?

I have a packed DLL. It has an entry point. If I call LoadLibrary it gets unpacked with the entry point code. Then I can attach a debugger to the .exe that called LoadLibrary and see the unpacked dll ...
Edza's user avatar
  • 103
1 vote
2 answers
4k views

Renaming entitites in obfuscated java bytecode

I'm working with an SDK for developing apps that's distributed as an AAR, and has been obfuscated with ProGuard. I'm just trying to reverse a few things it does. The classes, methods and variables ...
user19009's user avatar
  • 154
4 votes
3 answers
9k views

Extracting classes from running JVM

I'm trying to RE a Java application that uses an obfuscated loader program to load classes from a second, obfuscated archive-like file. I'm trying to get at these loaded classes for further analysis, ...
nickanallen's user avatar
2 votes
1 answer
1k views

How to get address where MakeFunction() failed in IDA Pro

I am analysing obfuscated code which contains code paths leading to dummy instructions. These dummy instructions prevent IDA from creating functions. However, I need these functions to do a function ...
nebu's user avatar
  • 61
2 votes
0 answers
1k views

Do any known deobfuscateors work on Agile.net 6.4?

As a company we are going to start obfuscating our released binaries, so far the best front runner we have found has been Agile.net 6.4. I took one of our binaries we obfuscated with the trial ...
Scott Chamberlain's user avatar
1 vote
1 answer
1k views

Are .NET DLLs, even the best obfuscated ones, less secure than C++ DLLs?

From what I understand about .NET code, it is first compiled to Microsoft Common Intermediate Language (MSIL) before being translated to machine code at runtime. Whereas C++ code is compiled directly ...
Graviton's user avatar
  • 133
0 votes
0 answers
149 views

Reassemble function that has its control flow chopped so that it can be decompiled by IDA

I try to decompile a function that is obfuscated by having split up the controlflow into asmblocks scattered around the .text section and connected by "jmpq" jumps. <func1>: 0: insn.. 1: ...
Konrad Eisele's user avatar
4 votes
2 answers
2k views

Automating pattern-based de-obfuscation of x64 code using IDA plugins

Trying to deobfuscate x64 code. You can skim/skip most of this, since it mainly exists to prove I have tried and exhausted all avenues. Burning Purpose To massively automate the deobfuscation within ...
Orwellophile's user avatar
3 votes
1 answer
859 views

Reversal of unknown obfuscation or encryption with known plaintext

Introduction For academical reasons I am reversing a firmware for an embedded device. I have already created a perl script which is able to parse the firmware structure and extract files from it (its ...
SeWe's user avatar
  • 39
1 vote
1 answer
2k views

Cannot detect obfuscator of the obfuscated DLL

I want to do a reverse-engineering of an obfuscated Unity DLL assembly, but de4dot doesn't work. It says "Unknown Obfuscator". Also tried iMPROVE and it says that there is a 97% chance that it is a ...
Hadi77's user avatar
  • 11
0 votes
0 answers
395 views

How to pass Obfuscated Elf binary to gcc optimization end

Currently I have a 2000+Line function to reverse engineer with many redundancies and appears to be obfuscated. It their a way to pass to pass this binary to gcc or clang to reassemble it and optimize ...
u185619's user avatar
  • 335
1 vote
1 answer
3k views

Decompiled Java classes span multiple files

I've been playing around with decompiling Android apps from dex/jar files to java source code, with varying success. I've tried the usual suspects - JD-GUI, procyon, cfr, krakatau and jadx. I'm having ...
user1118764's user avatar
1 vote
0 answers
371 views

Discovering byte array obfuscation function

I'm in the middle of reverse engineering SafeNet (formerly Rainbow) iKey 1000 USB dongle protocol, in order to create Linux driver for it. I'm using Windows as guest in virtual machine on Linux host ...
yuiu's user avatar
  • 11
1 vote
1 answer
849 views

I'm decompiling an apk file to learn how the creator designed the UI for their app. Are these layout files obfuscated?

I'm new to decompiling apps. Most of the apps I decompile aren't very popular, so obfuscation hasn't been a problem yet. I'm not entirely sure what obfuscation looks like. The current app I'm looking ...
God Usopp's user avatar
  • 111
2 votes
1 answer
2k views

Any good deobfuscators for java?

So I've built an obfuscator for java source code, would anyone know if there is any good deobfuscators which i could test how well my obfuscator is? I know there are many deobfuscators out there, ...
Alan Liang's user avatar
1 vote
0 answers
72 views

Java source code deobfuscator? [duplicate]

Does anyone know of any source code deobfuscator in java? I'm currently writing an obfuscator for java source code and I want to test how well I have made it with an deobfuscator.
Alan Liang's user avatar
0 votes
1 answer
456 views

Reverse-engineering the generation of a hash?

Using a forward proxy, I have logged two payloads that are POST requests to a site, and I was curious as to what the best way to determine how a particular attribute in the payloads was generated. ...
Patrick Roberts's user avatar
2 votes
0 answers
646 views

find CRC algorithm, having some input and output data pairs

I'm trying to discover the algorithm of a lost software, there is an equipment that requiest some data, and validates the data using the "KEY", if you change any parameter of the data then you need a ...
JohnR's user avatar
  • 21
2 votes
1 answer
2k views

Assistance in Decrypting Lua script that is obfuscated with Base64 > SSL

Can anyone on here help me on decrypting the SSL encryption that protects this LUA script linked at the end of this topic ? Basically they are encoded with Base64 then SSL, but I have no idea how to ...
Saeed A Suleiman's user avatar
2 votes
0 answers
223 views

Javascript equivalent of JEB

In case you already know, there is a full-feature decompiler for Java/Android called JEB (https://www.pnfsoftware.com/) Some of the most important features include the ability to rename identifiers ...
Nederealm's user avatar
  • 277
2 votes
1 answer
1k views

What kind of compression/obfuscation algorithm is this?

I have a couple of streams that look pretty odd within a DICOM file. In a few words, DICOM is very close to what binary XML would look like. Almost all of the information from those DICOM files are ...
tibar's user avatar
  • 375
1 vote
2 answers
770 views

Debugging Win32.Upatre - why does Ollydbg fail to analyze this?

So I've been looking at this thread - Where can I, as an individual, get malware samples to analyze? And grabbed myself a binary sample of Win32.Upatre from Halvar Flake's blog. I started analyzing ...
FigureItOut's user avatar
1 vote
1 answer
6k views

Tools for automated deobfuscation

To evaluate different Java obfuscators, I want also consider if the obfuscators use preventive techniques against common tools used for automated deobfuscation. Therefore I plan to obfuscate a test ...
la-ga's user avatar
  • 11
7 votes
1 answer
2k views

How can I decode this php code?

I found this backdoor on a client's website. http://pastebin.com/wVs8w44v (original format) http://pastebin.com/acfx49QJ (semi - readable) I have gotten rid of it and realise it's an obfuscated ...
Vikas Thakur's user avatar
0 votes
1 answer
112 views

Understanding pseudocode containing a math operation in a variable assignment [closed]

So I'm trying to reverse engineer a LFSR encryption scheme using IDA, and am (hopefully) pretty close to cracking it. The code in particular iterates through every byte of the encrypted file, ...
Bjarke's user avatar
  • 3
1 vote
1 answer
290 views

Reversing Checksum of serial protocol

I'm trying to reverse engineer a serial protocol of a compressor, but i've no luck calculation the checksum. e.g. here are some messages including the 16-bit checksum at the end of the message. ff ...
Hannibal's user avatar
6 votes
1 answer
724 views

Recompiling/optimizing redundant code to make analysis easier

I'm analyzing an application created with Borland Delphi but the poor quality of the object code makes analysis difficult and tedious. The code is so convoluted and inflated with superfluous ...
Eric's user avatar
  • 439
4 votes
1 answer
902 views

Protect a key from being recovered by decompilation

I work in a game editor that develop an online game. In our endless struggle against bots (that have negative impacts on server performances, game economy, game experience, ...), one of ours weapons ...
Kriss's user avatar
  • 41
0 votes
2 answers
1k views

What kind of JS obfuscation is this? [closed]

I have read about de-obfuscating JS files and about multi-layered obfuscation. I have come across a file (which I have uploaded here) and it doesn't seem to be obfuscated except for lines 21 and 42. I ...
Pervy Sage's user avatar
  • 1,205
2 votes
2 answers
5k views

Deobfuscating a javascript file

I am having a obfuscated JS file and I want to deobfuscate it (and not beautify it). I have seen answer to a similar question here and I tried de-obfuscating a the file using online version of ...
Pervy Sage's user avatar
  • 1,205
-3 votes
1 answer
307 views

Trying to deobfuscate multi layered javascript [closed]

Can someone deobfuscate this code? I am not getting any way to deobfuscate this. Unable to paste it over here as it over passed 30,000 word limit. http://pastebin.com/V327Q8Hg Thanks
Sameer Sam's user avatar
5 votes
1 answer
2k views

IDA PRO Hex-Rays 1.5 pseudo code understanding -=0x3FFFFFFFu; += 0x3FFFFFFFu;

I'm trying to clean up the pseudo code to make it compile and function similar if not exactly the same as the original code. This bit which looks like this appears in various places I'm trying to ...
SSpoke's user avatar
  • 759
1 vote
1 answer
3k views

What kind of obfuscate is this?

I'm trying to deobfuscate a .NET exe file, using de4dot. I have many dll files, when I open the dll file with .NET Reflector, it appears like this: And when I did the deobfuscation again with de4dot, ...
user8490's user avatar
-2 votes
1 answer
2k views

Trying to decrypt javascript code [duplicate]

Is it possible to deobfuscate/decrypt this javascript code? ;eval(function(w,i,s,e){var lIll=0;var ll1I=0;var Il1l=0;var ll1l=[];var l1lI=[];while(true){if(lIll<5)l1lI.push(w.charAt(lIll));else if(...
Afonso's user avatar
  • 1
2 votes
1 answer
3k views

Deobfuscating IDA Pseudocode

I have wanted to get into the art of reverse engineering for quite some time now, so I took a look at a few online lessons (such as opensecuritytraining.info) and also got my hands on IDA Pro. ...
Christoph Böhmwalder's user avatar
5 votes
2 answers
316 views

Need help in figuring out checksum used in this small wireless packet

Need help in figuring out the checksum used for this small data packet. Packet is 48 bits long, I already have figured out most of the bits. Least 8 bits change even if there is a single bit change in ...
chis's user avatar
  • 51
93 votes
9 answers
317k views

How do I reverse-engineer .so files found in Android APKs?

I know how to reverse-engineer normal Android APKs using tools like apktool and dex2jar, but I don't know how to work with obfuscation. When I extract everything from APK, I get some Smali files (I ...
Pervy Sage's user avatar
  • 1,205
16 votes
1 answer
125k views

How to deobfuscate an obfuscated javascript file like this? [duplicate]

I'm having serious problems deobfuscating a JavaScript file at work. This file is inside a web app that I was left in charge to improve it. The problem is that I can do it without having access to ...
MaizerG's user avatar
  • 169
9 votes
3 answers
13k views

Guessing CRC checksum algorithm

I am trying to reverse engineer a 16 bit checksum algorithm of one relatively old (10 years) LAN game that is no longer supported nor has source code available. As it seems, data packets don't have ...
astralmaster's user avatar
3 votes
1 answer
441 views

Experiences from reverse engineers in detecting recursive calls

I have absolutely no experience in reversing real-world binary codes, so I wonder how the obfuscated codes prevent reversers. I doubt that the reverses always find some ways to understand what are ...
Ta Thanh Dinh's user avatar
1 vote
1 answer
2k views

Suspicious obfuscated JavaScript file

This question is related to another question made on StackOverflow. The users ask about an unknown JavaScript file which is being loaded on his website. I managed to unroll a bit of the JavaScript ...
enapupe's user avatar
  • 119
3 votes
1 answer
3k views

Rename classes and packages in a jar file

I have an obfuscated jar file I'm trying to decompile and get into an eclipse project. I can easily view the "source" using a tool like jd-gui but I cant save it because the filenames are too long. I ...
Ephyxia's user avatar
  • 31
6 votes
1 answer
2k views

How to efficiently simplify obfuscated formula in QF_BV logic with Z3?

I would like to know if there are efficient ways to simplify arithmetic formula expression over bit-vectors with Microsoft Z3. But, first, I would like to explain a bit the problem. Lets start with an ...
perror's user avatar
  • 19.1k
1 vote
1 answer
293 views

What is the difficulty/advantage to obfuscate a multi-thread program?

According to my knowledge, several obfuscation strategies are widely used(or at least described in academic) like: complicating control flow inserting bogus control-flow control-flow flattening jump ...
lllllllllllll's user avatar