We changed our privacy policy. Read more.

Questions tagged [deobfuscation]

Techniques to remove obfuscation from a piece of program.

Filter by
Sorted by
Tagged with
1
vote
0answers
349 views

Discovering byte array obfuscation function

I'm in the middle of reverse engineering SafeNet (formerly Rainbow) iKey 1000 USB dongle protocol, in order to create Linux driver for it. I'm using Windows as guest in virtual machine on Linux host ...
1
vote
0answers
68 views

Java source code deobfuscator? [duplicate]

Does anyone know of any source code deobfuscator in java? I'm currently writing an obfuscator for java source code and I want to test how well I have made it with an deobfuscator.
1
vote
0answers
1k views

How to send and render an .html for chromecast using RAW http requests?

I am trying to RE the chrome cast protocol. I saw Koushik Dutta did RE the protocol, but didn't find any post online analyze the protocol. Moreover Google changed it a little bit since then. ...
0
votes
1answer
310 views

Obfuscated VBE malware script analysis

Some actions of this script are clear e.g. the section that adds firewall rules, others not so much On Error Resume Next F27 F10 A0 DBCF Sub F27() Dim E13C563AFCB34, C0009B48F34B, C8, ...
0
votes
2answers
1k views

What kind of JS obfuscation is this? [closed]

I have read about de-obfuscating JS files and about multi-layered obfuscation. I have come across a file (which I have uploaded here) and it doesn't seem to be obfuscated except for lines 21 and 42. I ...
0
votes
1answer
4k views

How can I deobfuscate this javascript code

I am trying to deobfuscate this javascript code, but I don't know how it was created. Can you please tell me what the mechanism or the function is that generate such characters in javascript? É=-~-~[]...
0
votes
1answer
3k views

How decrypt hexadecimal javascript code? [closed]

Someone here already had success to deobfuscate 100% a "hexadecimal" Javascript code? E.g.: var _0x22bc92 = function() { var _0x26938d = !![]; return function(_0x100751, _0x54d399) { ...
0
votes
2answers
7k views

How do you deobfuscate Java classes? [closed]

What tools or methodology do you use to de-obfuscate Java classes? I know you can theoretically decompile, modify and recompile, but that's only you fully trust a Java decompiler (and none is ...
0
votes
1answer
70 views

How to clean obfuscated code from fake if statements?

I am trying to deobfuscate javascript code. Firstly I extracted strings from big array. Then I saw many parts like this There is only one line of code which makes sense. Is there any Node.js cleaner ...
0
votes
1answer
105 views

IDA refuses to recognize basic block as part of function that jumps to it

I have a function MyFunc in an obfuscated program as follows: Start address: .text:000000014219FC5D End address: .text:000000014219FD0E MyFunc starts off by jumping to .text:000000014143C159, which ...
0
votes
2answers
514 views

How to remove bytes/opcodes within IDA Pro database

I am dealing with a heavily obfuscated binary, with certain portions of it having an abundance of junk code when it attempts to set a value at certain offsets to esp/ebp. My question, having ...
0
votes
1answer
533 views

Unpacking ROM dump

I have a ROM dump from an unknown controller, which must be reversed (as a task). It looks like encrypted, packed or obfuscated. Binwalk did not give any information("cisco os experimental microcode ...
0
votes
1answer
296 views

How does the different types of executable packing work?

Reference to this thread: What are the different types of packers? Q1: How do packing methods like compression, protection, and encryption work, how do they differ, and which is more secure? Q2: ...
0
votes
1answer
2k views

How to run and reconstruct a packed DLL in IDA Pro?

I have a packed DLL. It has an entry point. If I call LoadLibrary it gets unpacked with the entry point code. Then I can attach a debugger to the .exe that called LoadLibrary and see the unpacked dll ...
0
votes
1answer
295 views

Reverse-engineering the generation of a hash?

Using a forward proxy, I have logged two payloads that are POST requests to a site, and I was curious as to what the best way to determine how a particular attribute in the payloads was generated. ...
0
votes
1answer
109 views

Understanding pseudocode containing a math operation in a variable assignment [closed]

So I'm trying to reverse engineer a LFSR encryption scheme using IDA, and am (hopefully) pretty close to cracking it. The code in particular iterates through every byte of the encrypted file, ...
0
votes
0answers
31 views

How to reverse engine JS code whose callstacks are hidden?

I am learning how to reverse engine JS code and got a hard exercise, beyond hidding strings this obfuscated JS tries to hide callstacks by spreading and storing partial computations in a bunch of ...
0
votes
0answers
55 views

Determining a password-hashing function knowing plaintext + output

I have a password that has been stored and I'd like to figure out how it's been 'transformed' to be stored in my database. The plaintext password is: k4oK203$ And the password as it is stored 'crypted'...
0
votes
0answers
45 views

Deobfuscating JS Code?

I am trying to deobfuscate a highly obfuscated JS file for use to be passed in along with an HTTP POST request from my C# application. I don't know much about JS. The file I am trying to deobfuscate ...
0
votes
0answers
62 views

how to get rid of this obfuscator?

i somehow know that this is Confuserex but noting working agter many try the file is still unreadable. is there a way to? or im just bad... ps.i unpack this from the exe file that only has PE(maybe ...
0
votes
0answers
19 views

Tools for tracing down a Windows-specific UUID generation?

I'm have a kind of "Crackme" program that generates a 4-byte Windows system-specific UUID. It doesn't seem to be hardware-dependent - I have created 2 identical Windows 7 virtualboxes - same ...
0
votes
1answer
71 views

$$Lambda$(number) when decompiled java bytecode

why when i decompile java bytecode (which further was decompiled from .dex), i get $$Lambda$(number), in java files, and it's not possible to build project with these java codes as it's insufficient ...
0
votes
0answers
109 views

Reverse Engineering Instagram's Private API

I'm trying to reverse engineer Instagram Web's Private API. I have successfully managed to login into Instagram using their login endpoint using man-in-the-middle proxy and postman. I now want to send ...
0
votes
1answer
397 views

How can I de-obfuscate a VBScript (.vbs) file?

I have a VBScript (.vbs) file that is a malware dropper. It executes correctly in a commercial malware sandbox. but does not act the same in my manual analysis lab, and I need to figure out why. The ...
0
votes
2answers
346 views

Decode xor data in IDA

I have code that looks like this: byte_100031BA4 = v41; byte_100031BA5 ^= 0x3Eu; byte_100031BA6 ^= 0x47u; LOBYTE(a1) = -9; byte_100031BA7 ^= 0xF7u; byte_100031BA8 ^= 0xA9u; byte_100031BA9 ^= 0xE8u; ...
0
votes
2answers
244 views

Reverse Engineering Javascript - Out of Memory

I found this javascript file on one of those online movie streaming services and was interested in finding out what it does. However, after trying many deobfuscators I am still stuck. A major ...
0
votes
1answer
272 views

Error After de4dot - Application Does Not Start

There is an application that has been obfuscation to learn. So in an unpack me style. In the first stage I would unpack with de4dot. After you unpack, the running application stops working. dump and ...
0
votes
1answer
101 views

Need help identifying a -possibly- encrypted string

I'm having some trouble building an app that gets data from a database to keep a log of files added to a website. Most URLs are generated from a file ID and a time stamp, some of those URLs are ...
0
votes
0answers
62 views

Output address path during .exe execution

I have an obfuscated software. I'm a beginner in this area, so I don't find where a patch would be useful for what I want to do. It turns out that I have an idea of how I could find out in which ...
0
votes
0answers
128 views

Reassemble function that has its control flow chopped so that it can be decompiled by IDA

I try to decompile a function that is obfuscated by having split up the controlflow into asmblocks scattered around the .text section and connected by "jmpq" jumps. <func1>: 0: insn.. 1: ...
0
votes
0answers
313 views

How to pass Obfuscated Elf binary to gcc optimization end

Currently I have a 2000+Line function to reverse engineer with many redundancies and appears to be obfuscated. It their a way to pass to pass this binary to gcc or clang to reassemble it and optimize ...
0
votes
1answer
1k views

Suspicious obfuscated javascript file

This question is related to another question made on StackOverflow. The users asks about a unknown JavaScript file which is being loaded on his website. I managed to unroll a bit of the JavaScript ...
-1
votes
4answers
872 views

Decrypting authorization PHP script

Description I asked for help on freelancing, for the finalization of the project in PHP. All this worked well until I needed to edit the authorization mechanism. Having opened the file, I found that ...
-1
votes
1answer
126 views

How can I analyze this code? [closed]

I wanted to analyse the code for some functionality. in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using ...
-1
votes
1answer
588 views

De-obfuscate JS code [closed]

I came across a script that converts font files from one type to another (i.e. WOFF to TTF, etc). I would like to understand it and incorporate some of the code into a personal project. The script ...
-2
votes
1answer
15k views

How do I decode this JavaScript code? [duplicate]

Each file starts with the same function: (function(_0x128f83, _0x1ae5b9) { var _0x1b5471 = function(_0x339be5) { while (--_0x339be5) { _0x128f83['push'](_0x128f83['shift']()); ...
-2
votes
1answer
174 views

How to deobfuscate Java application protected by Java Antidecompiler [closed]

Here is some infomation I found from MANIFEST.MF Archiver-Version: Plexus Archiver Built-By: boonb Created-By: Apache Maven Build-Jdk: 1.8.0_231 Main-Class: JavaLauncher Modified-By: 9.4 (BIS Guard &...
-2
votes
1answer
4k views

How to decompile obfuscated Python code?

I have an executable file, which I am trying to decompile. I have already deduced that it was originally programmed in Python. I know that it was obfuscated with PyArmor and possibly compiled with ...
-2
votes
1answer
2k views

Trying to decrypt javascript code [duplicate]

Is it possible to deobfuscate/decrypt this javascript code? ;eval(function(w,i,s,e){var lIll=0;var ll1I=0;var Il1l=0;var ll1l=[];var l1lI=[];while(true){if(lIll<5)l1lI.push(w.charAt(lIll));else if(...
-2
votes
1answer
140 views

What obfuscator is used?

In version 3.7.3.7 I was able to modify some parts of the code using dnSpy. The language is C#. But in the new(next) version, I did not succeed and I guess the code is obfuscated. De4dot did not help. ...
-3
votes
1answer
244 views

Trying to deobfuscate multi layered javascript [closed]

Can someone deobfuscate this code? I am not getting any way to deobfuscate this. Unable to paste it over here as it over passed 30,000 word limit. http://pastebin.com/V327Q8Hg Thanks

1 2
3