Skip to main content

Questions tagged [obfuscation]

Concealing the nature of how things truly function or work.

Filter by
Sorted by
Tagged with
0 votes
0 answers
72 views

What is this .Net Obfuscator?

I'm analysing a .Net executable and de4dot doesn't detect its obfuscator. Class/Method/Property names start with #=. Does anybody know what obfuscator this is? // Token: 0x0600EE8B RID: 61067 RVA: ...
Gudarzi's user avatar
  • 123
0 votes
1 answer
85 views

IDA Pro could not disassemble native function properly

Looks like some obfuscation technique was applied to this piece of code (none of start opcodes were identified properly): Is it possible to produce manually more readable assembly?
AseN's user avatar
  • 161
0 votes
1 answer
173 views

.NET Packer/Protector

I have been trying to analyse a .NET trojanized software, here is the link for reference:https://www.virustotal.com/gui/file/6186e0b5b1d820744f8f7aa682eec6b043ba11c7737a64e173522b8b55d06f81/detection ...
ElementalX's user avatar
0 votes
1 answer
204 views

unobfuscate Assembly-CSharp.dll?

First: sorry about English, it's not my language. The translation was done by Google Translate. I'm trying to work on a .dll from a Unity game, I managed to decompile the entire game, open the .dll, ...
Shadwlk's user avatar
0 votes
1 answer
245 views

Modifying a single .class file in an obfuscated JAR

i am trying to modify a jar that is partly obfuscated (and what i want to modify is in this part). I can use Recaf, it will decompile it well and I can save modifications and export program without ...
FluffyMuffin47's user avatar
4 votes
0 answers
65 views

Decyphering 8kbps audio file format used in Solar Chanting Lotus

I'm trying to reverse engineer a solar powered chanting lotus flower so that I might replace the built in audio with something more interesting. The main chip (JL16B-083A - haven't been able to find ...
Captain Lavender's user avatar
2 votes
1 answer
87 views

Obfuscation indirect address

I'm studying a reverse engineering course and here is an example about obfuscation indirect addresses: The course says: The original code moves the content of the CH register to DL and the output ...
nerios's user avatar
  • 21
2 votes
0 answers
174 views

How can i Lifting x86_64 assembly code to LLVM-IR

I'm researching of virus and I'm faced with the task of deobfuscating its virtual machine. I chose to do this through LLVM and I had a question, where can I see a simple example of lifting ...
OSPFv3's user avatar
  • 21
1 vote
0 answers
325 views

deobfuscate Dexgaurd obfuscated code

I was reversing an apk. the code detects whether the apk is running on a rooted device or not. if it is rooted or an emulator it will stop and close out. so this is the snippet code which I think it ...
hanan's user avatar
  • 309
1 vote
2 answers
287 views

Reversing .net crypter with obfuscated imports

I have started recently with reverse engineering. I came across the linked file. It is a packed/crypted putty.exe. (WARNING: IT MAY BE BACKDOORED!!) How it's working and loading putty.exe with runpe ...
Sauseee's user avatar
  • 21
3 votes
0 answers
242 views

How find all kernel functions called by a driver in windows 11

I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
user19819208's user avatar
1 vote
1 answer
726 views

Reverse Engineering Go obfuscated binaries

I have been trying to understand the working of this go malware by reversing it, which can be found here , so basically this stuff takes a shellcode as an input, and converts it to an exe or dll file, ...
Subhajeet 's user avatar
1 vote
1 answer
102 views

How to debug an obfuscated self hashing program?

I need to understand what the following obfuscated application does: interpreter.py: string = "lambda x : obfuscated_code_to_interpret_variable_x" interpreter = eval(string) ...
mercury0114's user avatar
1 vote
1 answer
215 views

Python or C for a Qt application and security against reverse engineering

I actually have two choices : C or Python to create my application. On my application users will need a key (on start) to access it, the key will be verified with an algorythm on the user's computer. ...
sramazoth's user avatar
  • 113
2 votes
0 answers
156 views

De-Obfuscating/unminifying a JS code [not duplicate]

I have come across a lot of similar questions on the same heading but unfortunately, none of them provided me with the intended results. I have a piece of code which, initially I am trying to ...
Supraja's user avatar
  • 21
2 votes
1 answer
565 views

x86 - How do I detect virtualized code by looking at the assembly?

How can I detected virtualized code by say, vmprotect, obsidium or themida just by looking at the assembly code? I know that just looking at the PE section name would help, but I wanted to detect ...
Alexey's user avatar
  • 69
1 vote
0 answers
121 views

Which encryption returns 192 hash value it means 96 in bytes?

I am reversing an APK and there is a signature that needs to be found. The function from where the signature is generated is present in the .so file. I did small debugging. While doing it, the ...
Nirbhay Jain's user avatar
0 votes
0 answers
559 views

How to deobfuscate Java application

Hi i am unable to deobfuscate the Advanced String Obfuscation Jar on tryHackMe I tried dumping the classes using a dumper javaagent deobfuscate the jar with java-deobfuscator threadtear functions ...
altsphaantm's user avatar
1 vote
0 answers
211 views

Confusing objdump with data as code

I am trying to confuse objdump to solve the first exercise of chapter 6 in Practical Binary Analysis. Admittedly I am super weak with inline assembler but I made a best-effort attempt and tried to get ...
CL40's user avatar
  • 111
5 votes
2 answers
1k views

Fixing/recompiling a heavily control flow obfuscated function

I've recently come across a binary that has been obfuscated with a very obscure protection. Obfuscation From what I understand, the obfuscator is effective in several ways. Multiple JMPs via relative ...
user avatar
0 votes
0 answers
3k views

How to disassemble an obfuscated .NET DLL?

I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL: Any idea how to unpack it?
c00000fd's user avatar
  • 1,691
0 votes
1 answer
2k views

How can I reverse this python code (obfuscated by b64, gzip and many more)

How can I Deobfuscate this python code Link to code I tried to replace eval places by print. but it won't work and output is also obfuscated Head of the code looks like this can anyone please help me
JC Rathnayake's user avatar
1 vote
1 answer
778 views

devirtualize? or what is this obfuscator? and how to get rid of this

from previous question i still dont get any info or any process at all... now i asking again with this question is this virtualize code or something? i try many thing and it still didnt work [i unpack ...
EntryEmb's user avatar
1 vote
1 answer
937 views

Is there a way in ida pro to see the address where I have explicitly marked them as code or data, etc?

I'm analyzing an obfuscated binary. IDA did a pretty good job of doing the initial auto-analysis. Later, I went through and marked some sections as undefined, or code, etc. Now IDA can't re-create ...
Gauss Euler's user avatar
0 votes
0 answers
262 views

new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?

just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
ringXzero's user avatar
0 votes
1 answer
825 views

What are the way I can reverse engineer an obfuscated C++ program?

I am reverse engineering an program. I encountered a problem where I can't reverse engineer it as the program code is obfuscated. I realised the program is obfuscated thanks to my friend who noticed ...
The epic face 007's user avatar
2 votes
1 answer
437 views

Best way to protect source code of exe that being loaded by Assembly.Load method

I am protecting an exe that being loaded by Assembly.Load... This makes everything difficult because most obfuscators causing it to not work properly or not load at all. I used confuserEx Ameteurz ...
dreamerx's user avatar
0 votes
1 answer
325 views

What is the obfuscation method utilised in Playdead's 'LIMBO' video game?

The game uses Unity3D engine, perhaps with a custom render pipeline. Reports have been made, it is not possible to disassemble it. How did they achieve that?
ivan866's user avatar
  • 109
0 votes
0 answers
41 views

Methods to alert inappropriate use of JS code

Let's say we have a JS code library that is not for sale, just internal. Of course, anyone who can access the website will be able to download that and reuse it. To avoid others to reuse that library, ...
Ivan's user avatar
  • 101
2 votes
2 answers
196 views

Wave File obfuscation

I have this file here, that is supposed to be a wave audio file, but seems to have some obfuscation applied to it. The file header is here: https://pastebin.com/LD5aA1EG Any suggestions where else ...
Tim's user avatar
  • 21
3 votes
2 answers
993 views

Guidelines for dealing with obfuscated code

I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
geo10's user avatar
  • 145
2 votes
2 answers
3k views

Virtual machine code obfuscation implementation details

I want to implement a VM based simple proof-of-concept obfuscator. It should take an exe file as input and produce a new pe file with appended vm section. For simplicity let's say the exe file is ...
Rob D's user avatar
  • 123
2 votes
0 answers
100 views

Trying to replicate encryption of an android app

I was trying to replicate/copy the encryption of an android app which uses CryptoJS with sha256 encryption as having seen in the source code of the android app. fingerprinting the app, it was built ...
hanan's user avatar
  • 309
1 vote
1 answer
495 views

Reverse Engineering Java - Deobfuscating symbols

I'm new to Java and working on cleaning up a fairly large Java .jar sample where the obfuscator has renamed symbols into invalid names. For example: import org.lib.00.0.2; public final class 90 ...
user3238415's user avatar
0 votes
0 answers
142 views

How to call strongly encrypted DLL from Resources?

There is a program. This program accepts plugins. Plugins written with C#. I have to encrypt it. But when I use strong obfuscators I have exception. Program doesn't read. How can I fix that ? How can ...
dfsvs's user avatar
  • 1
3 votes
2 answers
4k views

How to reverse engineer an exe built using nexe?

I am working on an express application. I obfuscate the source code using javascript-obfuscator. I am using nexe cli for generating a single exe from the obfuscated code. Can anyone tell me if there ...
Krish's user avatar
  • 31
-1 votes
1 answer
1k views

De-obfuscate JS code [closed]

I came across a script that converts font files from one type to another (i.e. WOFF to TTF, etc). I would like to understand it and incorporate some of the code into a personal project. The script ...
oldboy's user avatar
  • 99
5 votes
2 answers
5k views

Dealing with heavily obfuscated Java, possibly on bytecode level

I've got a jarfile from a friend, he told me to put it thru an decompiler. So I did, but: JD-GUI basically spit out just the imports and didn't show any class data CFR dumped out stack trace on ...
Kamila Szewczyk's user avatar
2 votes
1 answer
1k views

Stack-pointer analysis failed

I'm testing my toy obfuscating C compiler against IDA's decompiler, but IDA refuses always functions (then the decompilation is not possible). For example, at one of lowest-levels of obfuscating, a ...
Ta Thanh Dinh's user avatar
1 vote
1 answer
411 views

Python self decryption script, as mean of obfuscation

I have a software with an embedded python interpreter. The software can open upon startup a given .py script and execute it. Let's assume that in my python environment I can't open other files, and I ...
macro_controller's user avatar
1 vote
1 answer
308 views

Is it possible to completely reverse this code?

i have this code i'm trying to deobfuscate https://pastebin.com/g5mHpWE4 I used https://beautifier.io/ and http://www.jsnice.org/ but the result is still not good, current code: https://pastebin.com/...
Bruno Andrade's user avatar
0 votes
1 answer
607 views

Error After de4dot - Application Does Not Start

There is an application that has been obfuscation to learn. So in an unpack me style. In the first stage I would unpack with de4dot. After you unpack, the running application stops working. dump and ...
Halil Han Badem's user avatar
2 votes
0 answers
50 views

Possibly infected image

Long story short I'v downloaded a template for my website and instead of images it has the .html files included, and at the beginning those html files do include PNG IHDR , and they are being loaded ...
Tomas Randomas's user avatar
2 votes
2 answers
1k views

Static analysis obfuscated code

I'm reversing a code that is heavily obfuscated. It uses opaque predicates, call stack tampering, junk code and control flow flattering. Call stack tampering uses indirect branches (push register / ...
Francisco Linan's user avatar
4 votes
1 answer
12k views

Best way to protect source code of .exe program running on Python?

I am developing proprietary software that would be distributed in a form of .exe file. In order to use it, users will have to authenticate with their whitelist credentials (username + password). The ...
TimesAndPlaces's user avatar
2 votes
0 answers
101 views

API Hiding Issue

I'm trying to analyze a malware which is hiding API names. When I open it with CFF Explorer, except a few API like GetProcAddress, nothing appears. Basically, I know how API hiding works. I set a ...
badbabo's user avatar
  • 21
1 vote
2 answers
369 views

J2ME games obfuscator - Spyro and Tekken 5

While reversing some J2ME games like Spyro or Tekken 5 Mobile I have encountered a weird obfuscation where all fields, methods and classes have names like A, a, B, b, Aa, Bb etc. It's really hard to ...
westman379's user avatar
5 votes
2 answers
2k views

Trace Method Calls in .NET/C# Binary

I have a heavily obfuscated Windows service binary. Fields, types and methods are renamed. While it is possible to decompile the binary using dnSpy, it is still very cumbersome to identify important/...
DucatiNerd's user avatar
1 vote
0 answers
2k views

Obfuscate JSON file that is served client-side

Through some research I have found that obfuscation won't block hackers from retrieving your .json file, but I'd like to have at least a level of obfuscation that deters some people. I ran into a npm ...
Beta's user avatar
  • 11
1 vote
0 answers
265 views

Mysterious chunk of code in IOLI crackme0x06 challenge

I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge. Context But first of all, here is the context : I've successfully cracked the ...
programmersn's user avatar