Questions tagged [deobfuscation]

Techniques to remove obfuscation from a piece of program.

Filter by
Sorted by
Tagged with
2
votes
0answers
2k views

Tool for JavaScript deobfuscation

I'd like to reverse engineer a JavaScript program by manually renaming minimified variable, parameter and function names. However, updating my reverse-engineered code to a newer version would be very ...
2
votes
0answers
983 views

Do any known deobfuscateors work on Agile.net 6.4?

As a company we are going to start obfuscating our released binaries, so far the best front runner we have found has been Agile.net 6.4. I took one of our binaries we obfuscated with the trial ...
2
votes
0answers
556 views

find CRC algorithm, having some input and output data pairs

I'm trying to discover the algorithm of a lost software, there is an equipment that requiest some data, and validates the data using the "KEY", if you change any parameter of the data then you need a ...
2
votes
0answers
178 views

Javascript equivalent of JEB

In case you already know, there is a full-feature decompiler for Java/Android called JEB (https://www.pnfsoftware.com/) Some of the most important features include the ability to rename identifiers ...
1
vote
1answer
2k views

What kind of obfuscate is this?

I'm trying to deobfuscate a .NET exe file, using de4dot. I have many dll files, when I open the dll file with .NET Reflector, it appears like this: And when I did the deobfuscation again with de4dot, ...
1
vote
1answer
1k views

How to deobfuscate native Android library obfuscated with OLLVM?

When I load the binay in IDA, all I can see are loads of .datadiv_decodeXXX... functions and this is because of OLLVM. I know it is possible as a Chinese article I found said they were able to ...
1
vote
2answers
3k views

(de4dot) The file isn't a .NET PE file

Probably, many of you have ever seen the message from de4dot while trying to deobfuscate app/dll: WARNING: The file isn't a .NET PE file: What steps to take in such cases to proceed? How to make the ...
1
vote
2answers
643 views

Debugging Win32.Upatre - why does Ollydbg fail to analyze this?

So I've been looking at this thread - Where can I, as an individual, get malware samples to analyze? And grabbed myself a binary sample of Win32.Upatre from Halvar Flake's blog. I started analyzing ...
1
vote
1answer
213 views

Is it possible to completely reverse this code?

i have this code i'm trying to deobfuscate https://pastebin.com/g5mHpWE4 I used https://beautifier.io/ and http://www.jsnice.org/ but the result is still not good, current code: https://pastebin.com/...
1
vote
1answer
3k views

Is deobfuscation of my javascript code hard or easy?

I am trying to protect my app code from theft. Since most of it is written in javascript I had to use many obfuscation techniques to make it incomprehensible. I have written a very small piece of ...
1
vote
2answers
814 views

how to deobfuscate Autoit strings?

The code is: https://pastebin.com/ZwvySjgy Is it possible to deobfuscate the strings protected with STRINGDEC?
1
vote
1answer
5k views

Decompiling and deobfuscating APK file

Let's suppose that I have an APK file. I decompiled it but I have very obfuscated code. Is it possible to analize this APK in such way that application will be executed step by step (instruction after ...
1
vote
1answer
171 views

Reversing a key-gen firmware for RISC-V

I would like to study this firmware for Sipeed MAix, a RISC-V development board. You can download it here: key_gen_v1.2.zip. As the name suggests, its purpose is to calculate and print a "machine key"...
1
vote
1answer
342 views

What's this obfuscation technique?

I'm reverse-engineering a particular dylib on Mac OS X. The dylib is highly obfuscated, but I suspect it's from some well-known technique that I'm not aware of. I'd like to describe it in the hope ...
1
vote
1answer
1k views

Are .NET DLLs, even the best obfuscated ones, less secure than C++ DLLs?

From what I understand about .NET code, it is first compiled to Microsoft Common Intermediate Language (MSIL) before being translated to machine code at runtime. Whereas C++ code is compiled directly ...
1
vote
1answer
252 views

What is the difficulty/advantage to obfuscate a multi-thread program?

According to my knowledge, several obfuscation strategies are widely used(or at least described in academic) like: complicating control flow inserting bogus control-flow control-flow flattening jump ...
1
vote
2answers
94 views

Working with strong obfuscated Java

I've got a jar file, that is strong obfuscated. When I tried to put it into decompilers such as bytecode-viewer and luyten I seen many lines of traps and Chinese letters. I tried to deobfuscate it ...
1
vote
1answer
89 views

Reverse Engineering Java - Deobfuscating symbols

I'm new to Java and working on cleaning up a fairly large Java .jar sample where the obfuscator has renamed symbols into invalid names. For example: import org.lib.00.0.2; public final class 90 ...
1
vote
1answer
237 views

De-obfuscation - Emulation-oriented vs Script-oriented

What are the advantages of each method when employing de-obsfucation of potentially malicious code? I've been told to always use emulators like x86emu since it doesn't actually run the code when ...
1
vote
1answer
287 views

deobfuscating javascript injected into Wordpress

Found a WP site (not mine) with lovely obfuscated code injected into the footer so I've been trying to de-obfuscate it. I ran it through unpacker, then converted hex to ASCII, then un-minified to ...
1
vote
2answers
2k views

Renaming entitites in obfuscated java bytecode

I'm working with an SDK for developing apps that's distributed as an AAR, and has been obfuscated with ProGuard. I'm just trying to reverse a few things it does. The classes, methods and variables ...
1
vote
1answer
1k views

Cannot detect obfuscator of the obfuscated DLL

I want to do a reverse-engineering of an obfuscated Unity DLL assembly, but de4dot doesn't work. It says "Unknown Obfuscator". Also tried iMPROVE and it says that there is a 97% chance that it is a ...
1
vote
1answer
2k views

Decompiled Java classes span multiple files

I've been playing around with decompiling Android apps from dex/jar files to java source code, with varying success. I've tried the usual suspects - JD-GUI, procyon, cfr, krakatau and jadx. I'm having ...
1
vote
1answer
683 views

I'm decompiling an apk file to learn how the creator designed the UI for their app. Are these layout files obfuscated?

I'm new to decompiling apps. Most of the apps I decompile aren't very popular, so obfuscation hasn't been a problem yet. I'm not entirely sure what obfuscation looks like. The current app I'm looking ...
1
vote
1answer
4k views

Tools for automated deobfuscation

To evaluate different Java obfuscators, I want also consider if the obfuscators use preventive techniques against common tools used for automated deobfuscation. Therefore I plan to obfuscate a test ...
1
vote
1answer
207 views

Reversing Checksum of serial protocol

I'm trying to reverse engineer a serial protocol of a compressor, but i've no luck calculation the checksum. e.g. here are some messages including the 16-bit checksum at the end of the message. ff ...
1
vote
0answers
36 views

How To Deobfuscate ConfuserEx .NET Assembly?

No matter what I try I cannot deobfuscate this crackme https://crackmes.one/crackme/5d6c847433c5d46f00e2c390. I have tried each & every tutorial on youTube of which this one is the best https://...
1
vote
0answers
68 views

Looking for obfuscation patterns within jumps

I'm working on an obfuscated binary. I recognized some patterns used to confuse the disassembler, some used to obfuscate function calls, some other for conditional jumps and so on. The idea was to ...
1
vote
0answers
188 views

Reversing PyArmor + Pyinstaller

Created an application, protected by PyArmor and used pyinstaller. I'm trying to reverse engineer it. So far I've decompiled the exe into pyc files but it's still pyarmor encrypted I can only see the ...
1
vote
0answers
68 views

Guidelines for dealing with obfuscated code

I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
1
vote
0answers
112 views

How to use Ghidra to work with VM obfuscated binaries?

By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
1
vote
0answers
42 views

Main contemporary deobfuscation techniques

Could you please specify in a few words main contemporary deobfuscation techniques which we can apply to 32/64 bit PE files? For example, (1) using instruction templates, such as: mov edx, 5B1F04F1h ...
1
vote
0answers
147 views

What is the header 'X-Goog-Spatula'?

I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not ...
1
vote
0answers
105 views

deobfuscating/decompiling extremely complicated javascript [closed]

I am working with some extremely complicated JavaScript. It is around 70,000 lines long and sections of the code look like this U2xx.l11="0x78920d50";m2xx.r9G="11";b2xx.v3y="0x744ebc37";P2xx.K5h="...
1
vote
0answers
1k views

Can de4dot deobfuscate Dotfuscator Professional?

I ran de4dot on a Xamarin app obfuscated using Dotfuscator Professional. However, there's still the random switches and strange ints everywhere. Can de4dot decode this? If not, is there another tool ...
1
vote
1answer
496 views

Map an obfuscated javascript file to the original

Among other approaches, there are ways to "prettify" obfuscated javascript. But most of such approaches are geared towards someone trying to understand code that's not their own (e.g. from a website, ...
1
vote
0answers
559 views

Decode RubyEncoder

I was trying out some things when I came across some RubyEncoder encoded code. After searching the web, I found basically nothing useful on how to reverse them (Except this and [this][2], but I had no ...
1
vote
0answers
989 views

de4dot and Dotfuscator: IL looks different, not DotPeek decompiled code

From the obfuscated to the deobfuscated assemblies, IL code looks different using ILDASM; however, DotPeek decompiled C# code looks exactly the same for both. Any clue why? The obfuscation software ...
1
vote
0answers
326 views

Discovering byte array obfuscation function

I'm in the middle of reverse engineering SafeNet (formerly Rainbow) iKey 1000 USB dongle protocol, in order to create Linux driver for it. I'm using Windows as guest in virtual machine on Linux host ...
1
vote
0answers
67 views

Java source code deobfuscator? [duplicate]

Does anyone know of any source code deobfuscator in java? I'm currently writing an obfuscator for java source code and I want to test how well I have made it with an deobfuscator.
1
vote
1answer
928 views

Suspicious obfuscated javascript file

This question is related to another question made on StackOverflow. The users asks about a unknown JavaScript file which is being loaded on his website. I managed to unroll a bit of the JavaScript ...
1
vote
0answers
1k views

How to send and render an .html for chromecast using RAW http requests?

I am trying to RE the chrome cast protocol. I saw Koushik Dutta did RE the protocol, but didn't find any post online analyze the protocol. Moreover Google changed it a little bit since then. ...
0
votes
1answer
193 views

Obfuscated VBE malware script analysis

Some actions of this script are clear e.g. the section that adds firewall rules, others not so much On Error Resume Next F27 F10 A0 DBCF Sub F27() Dim E13C563AFCB34, C0009B48F34B, C8, ...
0
votes
2answers
934 views

What kind of JS obfuscation is this? [closed]

I have read about de-obfuscating JS files and about multi-layered obfuscation. I have come across a file (which I have uploaded here) and it doesn't seem to be obfuscated except for lines 21 and 42. I ...
0
votes
2answers
6k views

How do you deobfuscate Java classes? [closed]

What tools or methodology do you use to de-obfuscate Java classes? I know you can theoretically decompile, modify and recompile, but that's only you fully trust a Java decompiler (and none is ...
0
votes
1answer
794 views

How can I deobfuscate this javascript code

I am trying to deobfuscate this javascript code, but I don't know how it was created. Can you please tell me what the mechanism or the function is that generate such characters in javascript? É=-~-~[]...
0
votes
2answers
179 views

How to remove bytes/opcodes within IDA Pro database

I am dealing with a heavily obfuscated binary, with certain portions of it having an abundance of junk code when it attempts to set a value at certain offsets to esp/ebp. My question, having ...
0
votes
1answer
480 views

Unpacking ROM dump

I have a ROM dump from an unknown controller, which must be reversed (as a task). It looks like encrypted, packed or obfuscated. Binwalk did not give any information("cisco os experimental microcode ...
0
votes
1answer
214 views

How does the different types of executable packing work?

Reference to this thread: What are the different types of packers? Q1: How do packing methods like compression, protection, and encryption work, how do they differ, and which is more secure? Q2: ...
0
votes
1answer
2k views

How to run and reconstruct a packed DLL in IDA Pro?

I have a packed DLL. It has an entry point. If I call LoadLibrary it gets unpacked with the entry point code. Then I can attach a debugger to the .exe that called LoadLibrary and see the unpacked dll ...