Reverse Engineering Beta

Questions tagged [obfuscation]

Ask Question

Concealing the nature of how things truly function or work.

129 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
0
votes
1answer
28 views

De-obfuscate JS code

I came across a script that converts font files from one type to another (i.e. WOFF to TTF, etc). I would like to understand it and incorporate some of the code into a personal project. The script ...
2
votes
2answers
187 views

Dealing with heavily obfuscated Java, possibly on bytecode level

I've got a jarfile from a friend, he told me to put it thru an decompiler. So I did, but: JD-GUI basically spit out just the imports and didn't show any class data CFR dumped out stack trace on ...
1
vote
1answer
97 views

Stack-pointer analysis failed

I'm testing my toy obfuscating C compiler against IDA's decompiler, but IDA refuses always functions (then the decompilation is not possible). For example, at one of lowest-levels of obfuscating, a ...
1
vote
1answer
54 views

Python self decryption script, as mean of obfuscation

I have a software with an embedded python interpreter. The software can open upon startup a given .py script and execute it. Let's assume that in my python environment I can't open other files, and I ...
1
vote
1answer
153 views

Is it possible to completely reverse this code?

i have this code i'm trying to deobfuscate https://pastebin.com/g5mHpWE4 I used https://beautifier.io/ and http://www.jsnice.org/ but the result is still not good, current code: https://pastebin.com/...
0
votes
1answer
51 views

Error After de4dot - Application Does Not Start

There is an application that has been obfuscation to learn. So in an unpack me style. In the first stage I would unpack with de4dot. After you unpack, the running application stops working. dump and ...
1
vote
0answers
40 views

Possibly infected image

Long story short I'v downloaded a template for my website and instead of images it has the .html files included, and at the beginning those html files do include PNG IHDR , and they are being loaded ...
2
votes
2answers
156 views

Static analysis obfuscated code

I'm reversing a code that is heavily obfuscated. It uses opaque predicates, call stack tampering, junk code and control flow flattering. Call stack tampering uses indirect branches (push register / ...
2
votes
1answer
191 views

Best way to protect source code of .exe program running on Python?

I am developing proprietary software that would be distributed in a form of .exe file. In order to use it, users will have to authenticate with their whitelist credentials (username + password). The ...
1
vote
0answers
67 views

API Hiding Issue

I'm trying to analyze a malware which is hiding API names. When I open it with CFF Explorer, except a few API like GetProcAddress, nothing appears. Basically, I know how API hiding works. I set a ...
0
votes
0answers
34 views

IDA Fails to Analyze Stack Pointer Correctly in Heavily Chunked Functions

I am currently dealing with obfuscated code in IDA. The obfuscation I am combating is control flow obfuscation, where a function is split up into hundreds of basic blocks spread across the entire ...
1
vote
1answer
62 views

J2ME games obfuscator - Spyro and Tekken 5

While reversing some J2ME games like Spyro or Tekken 5 Mobile I have encountered a weird obfuscation where all fields, methods and classes have names like A, a, B, b, Aa, Bb etc. It's really hard to ...
5
votes
2answers
222 views

Trace Method Calls in .NET/C# Binary

I have a heavily obfuscated Windows service binary. Fields, types and methods are renamed. While it is possible to decompile the binary using dnSpy, it is still very cumbersome to identify important/...
0
votes
0answers
183 views

Obfuscate JSON file that is served client-side

Through some research I have found that obfuscation won't block hackers from retrieving your .json file, but I'd like to have at least a level of obfuscation that deters some people. I ran into a npm ...
0
votes
0answers
37 views

obfuscating mprotect, or run-time alternative

For an anti-debug method, I need to make a stack page executable at run-time, but only briefly. I don't want to use mprotect() as it's easily located and tracing forward reveals the location of the ...
1
vote
0answers
149 views

Mysterious chunk of code in IOLI crackme0x06 challenge

I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge. Context But first of all, here is the context : I've successfully cracked the ...
0
votes
0answers
106 views

Reverse engineering .NET malware - iloveyou.exe

I have a .NET malware sample whose dynamic behavior I understand. It is also packed. de4dot identified the obfuscator as .NET Reactor, so I used de4dot to de-obfuscate it. However, after de-...
1
vote
0answers
44 views

How to choose a .NET software protector which will have a small impact on run-time performance speed? [closed]

I am writing a .NET software which is doing calculations and drawing in real-time i.e when the user is moving the mouse. I want to protect this software from being reverse engineered and restrict its ...
0
votes
1answer
736 views

How to deobfuscate native Android library obfuscated with OLLVM?

When I load the binay in IDA, all I can see are loads of .datadiv_decodeXXX... functions and this is because of OLLVM. I know it is possible as a Chinese article I found said they were able to ...
0
votes
0answers
37 views

Replacing a function call with it's result in a script

I'm working with a heavily obfuscated Autoit malware script and one of the major problems is that almost all variables and lines of code are obfuscated by a custom function. The problem is that this ...
2
votes
1answer
130 views

Does a symbolic disassembler exist?

I would like to know if there are disassemblers based on a symbolic analysis, I'm beginner in RE, but I think that a disassembler based on symbolic techniques can be very interesting and could ...
2
votes
2answers
255 views

Jump in the middle trick

I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
1
vote
1answer
226 views

What's this obfuscation technique?

I'm reverse-engineering a particular dylib on Mac OS X. The dylib is highly obfuscated, but I suspect it's from some well-known technique that I'm not aware of. I'd like to describe it in the hope ...
6
votes
1answer
406 views

Simplifying assembly

I'm analysing some binary trace, it's pretty much obfuscated. What I need to do is to understand work flow of its alghoritms. However I cannot find any reliable tool which would help me with that. I ...
1
vote
1answer
626 views

Analyzing and deobfuscating complex JS code [duplicate]

I am looking to reverse engineer a very ugly piece of JS found here. As far as I can tell, this script generates and sets some cookies on my browser that identify it on the site. Deobfuscating it ...
1
vote
0answers
279 views

C# Hidden Method through transparent proxy object?

I'm dealing with an interesting form of obfuscation. A C# program I am reversing has a central API, let's call it "Central API". This Central API has several functions that aren't exactly defined. ...
7
votes
2answers
394 views

Why do obfuscators remove line numbers, and can I safely leave them in?

Application security engineer here. When we compile our java code, we obfuscate it using KlassMaster and have it remove line numbers (see KlassMaster docs) because of a handwavy explanation "it makes ...
1
vote
1answer
379 views

What is the difference between stripped binary and obfuscated binary

I want to know the difference between stripped binary and obfuscated binary.
1
vote
0answers
916 views

Can de4dot deobfuscate Dotfuscator Professional?

I ran de4dot on a Xamarin app obfuscated using Dotfuscator Professional. However, there's still the random switches and strange ints everywhere. Can de4dot decode this? If not, is there another tool ...
4
votes
3answers
221 views

Obfuscated code analysis - can unused variables be ignored?

I am analyzing a malicious javascript. The code is encoded and obfuscated in a way that I did not manage to even partially deobfuscate yet and it is filled with long strings. In order to simplify the ...
1
vote
0answers
54 views

Missing Map from Java Native Method to C Code

When writing a C implementation for a native Java method in Android, the rule is to name the C function according to the convention "Java_com_...". But I encountered an APK in which there are no such ...
1
vote
1answer
2k views

Is deobfuscation of my javascript code hard or easy?

I am trying to protect my app code from theft. Since most of it is written in javascript I had to use many obfuscation techniques to make it incomprehensible. I have written a very small piece of ...
2
votes
0answers
364 views

Obscure router refuses to flash OpenWrt

This is a very obscure Chinese router from a brand called Wavlink. It's the Model: WN529R2/WN529R2P. It's web interface was pretty limited and wouldn't allow firmware modifications. I found GND/Tx/Rx/...
3
votes
2answers
203 views

Why doesn't this retn instruction return from the function?

I disassembled an exe file on Windows with IDA and saw this function prologue: I see that when the retn executes instead of returning it jumps to sub_1314cba4. Why doesn't the retn instruction ...
-3
votes
1answer
6k views

How do I decode this JavaScript code? [duplicate]

Each file starts with the same function: (function(_0x128f83, _0x1ae5b9) { var _0x1b5471 = function(_0x339be5) { while (--_0x339be5) { _0x128f83['push'](_0x128f83['shift']()); ...
1
vote
1answer
397 views

Map an obfuscated javascript file to the original

Among other approaches, there are ways to "prettify" obfuscated javascript. But most of such approaches are geared towards someone trying to understand code that's not their own (e.g. from a website, ...
0
votes
2answers
834 views

verifyError in youtube android app modification

I try to decompile youtube android application and modify it but when I build the application and install on a virtual device faced with below error: E/AndroidRuntime(1782): java.lang.VerifyError: ...
3
votes
1answer
335 views

IDA pro obfuscation instance

I have tried all the I have learned so far to figure out how to deal with this instance of obfuscation. So far I understand that an opaque predicate is present, causing an unconditional jump to one ...
3
votes
1answer
482 views

Deobfuscating overlapping x86 assembly instructions

I'm trying to solve a reverse engineering challenge (http://crackmes.cf/users/beatrix/beaba/) and am having trouble with the obfuscation. Below is a piece of code that gets executed almost immediately ...
3
votes
3answers
3k views

Exe protection by TLS callback, trying to understand the behaviour

I have an app, obfuscated by FSG protector. When i tried to unpack it, the first thign that i had is, when i start the process with the debugger/or attach debugger later, i immediatly receive ACCESS ...
0
votes
1answer
482 views

ARM ELF Obfuscation [closed]

Metamorphic is a technique to obfuscate a binary and change the opcode sequence and create new samples with same functionality. In my case, I have some elf binary of ARM processor type and their ...
1
vote
2answers
232 views

reverse javascript crackme encryption method algorithm

This crackme contains a text input element on the screen and a button to validate The value you enter is set into _inputValue, afterwards you click on a button, the function executes, in the last ...
1
vote
2answers
523 views

Techniques to hide a process (procmon)? [closed]

On Windows, how would one go about hiding procmon from another process? What techniques/terms would I be searching for?
1
vote
0answers
819 views

de4dot and Dotfuscator: IL looks different, not DotPeek decompiled code

From the obfuscated to the deobfuscated assemblies, IL code looks different using ILDASM; however, DotPeek decompiled C# code looks exactly the same for both. Any clue why? The obfuscation software ...
0
votes
1answer
179 views

How does the different types of executable packing work?

Reference to this thread: What are the different types of packers? Q1: How do packing methods like compression, protection, and encryption work, how do they differ, and which is more secure? Q2: ...
1
vote
0answers
95 views

How to hide / obfuscate the function of an IC?

Let's say I have an IC (integrated circuit) and I want to hide it's function. What would be best practice to do that? Removing the markings with sandpaper or acid? (E.g. atmega328, ATtiny85,... ) ...
8
votes
2answers
861 views

Is there a name for this kind of “obfuscation” for the machine code from C++?

I was trying to reverse engineer an android ndk (arm) using ida pro on a static analysis. However, it appears there are a lot of useless jumps to the same place and with random values set to R1 to ...
0
votes
2answers
680 views

Android App's hardcoded local keystore password r3versing

Novice Android security researcher here. Recently I was tasked with the task/challenge of exposing a certain app's hardcoded local keystore password. I've decompiled it with JEB2 and obviously within ...
0
votes
1answer
104 views

What do the unusually named packages and files usually mean?

When decompiling an apk with apktool, the classes.dex file is decompiled into folders smali_classes#, and sorted their respective packages. I recognize some of the files, as they are mentioned in ...
2
votes
1answer
87 views

Unkown Swap Encoding

I'm trying to figure out this encoding in malware.. All I have are the static strings.. I was able to figure one out so there is plaintext on one: e-snAetgrU$ translates to $User-Agent Here are ...

1 2 3