Concealing the nature of how things truly function or work.
2
votes
2answers
41 views
Obfuscated code analysis - can unused variables be ignored?
I am analyzing a malicious javascript. The code is encoded and obfuscated in a way that I did not manage to even partially deobfuscate yet and it is filled with long strings. In order to simplify the ...
1
vote
0answers
27 views
Missing Map from Java Native Method to C Code
When writing a C implementation for a native Java method in Android, the rule is to name the C function according to the convention "Java_com_...". But I encountered an APK in which there are no such ...
1
vote
1answer
88 views
Is deobfuscation of my javascript code hard or easy?
I am trying to protect my app code from theft. Since most of it is written in javascript I had to use many obfuscation techniques to make it incomprehensible.
I have written a very small piece of ...
1
vote
0answers
52 views
Obscure router refuses to flash OpenWrt
This is a very obscure Chinese router from a brand called Wavlink. It's the Model: WN529R2/WN529R2P. It's web interface was pretty limited and wouldn't allow firmware modifications.
I found GND/Tx/Rx/...
3
votes
2answers
86 views
Why doesn't this retn instruction return from the function?
I disassembled an exe file on Windows with IDA and saw this function prologue:
I see that when the retn executes instead of returning it jumps to sub_1314cba4.
Why doesn't the retn instruction ...
-3
votes
1answer
70 views
How do I decode this JavaScript code? [duplicate]
Each file starts with the same function:
(function(_0x128f83, _0x1ae5b9) {
var _0x1b5471 = function(_0x339be5) {
while (--_0x339be5) {
_0x128f83['push'](_0x128f83['shift']());
...
1
vote
1answer
74 views
Map an obfuscated javascript file to the original
Among other approaches, there are ways to "prettify" obfuscated javascript. But most of such approaches are geared towards someone trying to understand code that's not their own (e.g. from a website, ...
0
votes
2answers
134 views
verifyError in youtube android app modification
I try to decompile youtube android application and modify it but when I build the application and install on a virtual device faced with below error:
E/AndroidRuntime(1782): java.lang.VerifyError: ...
2
votes
1answer
101 views
IDA pro obfuscation instance
I have tried all the I have learned so far to figure out how to deal with this instance of obfuscation.
So far I understand that an opaque predicate is present, causing an unconditional jump to one ...
3
votes
1answer
172 views
Deobfuscating overlapping x86 assembly instructions
I'm trying to solve a reverse engineering challenge (http://crackmes.cf/users/beatrix/beaba/) and am having trouble with the obfuscation. Below is a piece of code that gets executed almost immediately ...
0
votes
0answers
33 views
Dotfuscator control flow level difference
I have a question about the .Net obfuscator Dotfuscator. In the professional edition you can opt between different control flow level (low, medium, high).
But I cannot tell any difference between low ...
2
votes
3answers
437 views
Exe protection by TLS callback, trying to understand the behaviour
I have an app, obfuscated by FSG protector. When i tried to unpack it, the first thign that i had is, when i start the process with the debugger/or attach debugger later, i immediatly receive ACCESS ...
0
votes
1answer
208 views
ARM ELF Obfuscation [closed]
Metamorphic is a technique to obfuscate a binary and change the opcode sequence and create new samples with same functionality. In my case, I have some elf binary of ARM processor type and their ...
1
vote
2answers
139 views
reverse javascript crackme encryption method algorithm
This crackme contains a text input element on the screen and a button to validate
The value you enter is set into _inputValue, afterwards you click on a button, the function executes, in the last ...
0
votes
2answers
142 views
Techniques to hide a process (procmon)? [closed]
On Windows, how would one go about hiding procmon from another process? What techniques/terms would I be searching for?
1
vote
0answers
411 views
de4dot and Dotfuscator: IL looks different, not DotPeek decompiled code
From the obfuscated to the deobfuscated assemblies, IL code looks different using ILDASM; however, DotPeek decompiled C# code looks exactly the same for both. Any clue why?
The obfuscation software ...
0
votes
0answers
119 views
Obfuscation - Control Flow Flattening Python code
To begin with, I should mention that I have gone through this thread:How do I protect Python code ? and have a perused the paper for Woot `13 which talks about reversing the Dropbox client written in ...
0
votes
1answer
73 views
How does the different types of executable packing work?
Reference to this thread: What are the different types of packers?
Q1: How do packing methods like compression, protection, and encryption work, how do they differ, and which is more secure?
Q2: ...
1
vote
0answers
68 views
How to hide / obfuscate the function of an IC?
Let's say I have an IC (integrated circuit) and I want to hide it's function. What would be best practice to do that?
Removing the markings with sandpaper or acid?
(E.g. atmega328, ATtiny85,... ) ...
8
votes
2answers
465 views
Is there a name for this kind of “obfuscation” for the machine code from C++?
I was trying to reverse engineer an android ndk (arm) using ida pro on a static analysis. However, it appears there are a lot of useless jumps to the same place and with random values set to R1 to ...
0
votes
2answers
305 views
Android App's hardcoded local keystore password r3versing
Novice Android security researcher here. Recently I was tasked with the task/challenge of exposing a certain app's hardcoded local keystore password.
I've decompiled it with JEB2 and obviously within ...
0
votes
0answers
81 views
Where are the stack windows when debugging Java bytecode with Bytecode Visualizer?
I have an obfuscated .Jar file and I want to debug it. I tried debugging it with Eclipse's Bytecode Visualizer:
But when debugging, I don't see stack windows. Where can I find them?
0
votes
0answers
240 views
Reversing (well known) obfuscated ARM function
I am working quite some time on a binary which uses the below function. Furternatly the function should be well known, but I cannot seem to find the name of it. It takes a uchar* as input and somehow ...
0
votes
1answer
61 views
What do the unusually named packages and files usually mean?
When decompiling an apk with apktool, the classes.dex file is decompiled into folders smali_classes#, and sorted their respective packages. I recognize some of the files, as they are mentioned in ...
1
vote
1answer
77 views
Unkown Swap Encoding
I'm trying to figure out this encoding in malware.. All I have are the static strings..
I was able to figure one out so there is plaintext on one:
e-snAetgrU$
translates to
$User-Agent
Here are ...
2
votes
1answer
216 views
Distribution of malware obfuscation types
There are several statistics and numbers out there of current malware families and their distributions.
However, I'am looking for statistics which shows the distribution of malware differed by their ...
1
vote
2answers
166 views
Obfuscation by changing the order of a malware behaviour
I know that there are some obfuscation techniques which can lead to slowing or even failing the detection of malware when static analysis is used.
However, is there a similar technique that changes ...
1
vote
0answers
226 views
Discovering byte array obfuscation function
I'm in the middle of reverse engineering SafeNet (formerly Rainbow) iKey 1000 USB dongle protocol, in order to create Linux driver for it. I'm using Windows as guest in virtual machine on Linux host ...
1
vote
1answer
2k views
How to obfuscate x86 assembly code?
For my project, I am performing a kind of checksum operation on a portion of code to protect it and therefore do not want its template to be easily visible and therefore need obfuscation.
I have ...
1
vote
1answer
467 views
I'm decompiling an apk file to learn how the creator designed the UI for their app. Are these layout files obfuscated?
I'm new to decompiling apps. Most of the apps I decompile aren't very popular, so obfuscation hasn't been a problem yet. I'm not entirely sure what obfuscation looks like. The current app I'm looking ...
2
votes
1answer
844 views
Any good deobfuscators for java?
So I've built an obfuscator for java source code, would anyone know if there is any good deobfuscators which i could test how well my obfuscator is?
I know there are many deobfuscators out there, ...
2
votes
2answers
333 views
Unpacking NSPack v 2.9 based malware to get OEP
recently i am analyzing a malware which is packed with NSPack.
when i am trying to unpack it using this blog link,i landed over two instruction PUSHFD,PUSHAD in ollydbg.
so i put a breakpoint on the ...
1
vote
0answers
60 views
Java source code deobfuscator? [duplicate]
Does anyone know of any source code deobfuscator in java?
I'm currently writing an obfuscator for java source code and I want to test how well I have made it with an deobfuscator.
4
votes
1answer
870 views
Obfuscated AES decryption assembly
I have recently been sifting my way through a whole load of assembly to try to identify how a program is decrypting some data. Thus far I have identified how the IV is extracted, that the IV is 16 ...
2
votes
0answers
255 views
Jar reversing: Can't open as zip file nor open it with common decompilers
I'm pentesting a JNLP application composed by several .jar files. I'm able to decompile with jd-gui every 3rd party library included in it, but the main .jar coded by my client.
So after running JD-...
-3
votes
1answer
2k views
How to deobfuscated javascript?
How to deobfuscate javascript file, i have a javascript code are deobfuscate .
Code: http://pastebin.com/zFH2GidN
Help me and thanks you.
0
votes
0answers
64 views
Encrypting and packing at functional boundaries for obfuscation
I am interested in software obfuscation techniques. I found your excellent summary of obfuscation in order to avoid (as possible) reverse engineering.
One of the proposed technique you quoted:
...
1
vote
3answers
935 views
How does PeID calculate entropy?
I'm curious about the entropy field value that shows up when a binary is dropped into PeID. Does someone know how it arrives upon this value?
1
vote
2answers
504 views
Debugging Win32.Upatre - why does Ollydbg fail to analyze this?
So I've been looking at this thread - Where can I, as an individual, get malware samples to analyze?
And grabbed myself a binary sample of Win32.Upatre from Halvar Flake's blog.
I started analyzing ...
1
vote
1answer
2k views
Tools for automated deobfuscation
To evaluate different Java obfuscators, I want also consider if the obfuscators use preventive techniques against common tools used for automated deobfuscation.
Therefore I plan to obfuscate a test ...
6
votes
2answers
1k views
How are obfuscators detected?
I'm guessing that tools like PeiD detect packers by looking for signatures inside the packed binary and by measuring the entropy. Is there any other work that tries to determine if a binary is ...
3
votes
1answer
96 views
Expressing trace semantics as a solution for a fixpoint equation
I was reading through the chapter on Obfuscation in "Practical Reverse Engineering" I encountered the following statement.
Where X is the set of execution traces (finite and infinite), you can
...
7
votes
2answers
935 views
Protect data stored in binary
Let's say I've some function(i.e. hash function), that generates value from input seed and some precomputed hash values, that are stored somewhere in binary. What are the possible approaches for:
...
1
vote
0answers
72 views
Where to identify and access the main object/closure in a JavaScript web app?
I want to add missing functionality to a web app's front end code JavaScript code.
I can find the code in the browser's developer tools by setting breakpoints and stepping through.
But in a large ...
3
votes
1answer
290 views
Which virtualized target is recommended for newbie on vm-obfuscation?
I'm newbie on virtualized code obfuscation. I can break many features to avoid debugging/reversing and packer/protector (even Themida, without vm option), but I'm not good at virtualized code.
Though ...
0
votes
2answers
837 views
Obfuscating jar already obfuscated [closed]
I'm wondering what happens if we try to run a jar through Proguard that has already been obfuscated by another obfuscator or Proguard itself? Will the obfuscated class names and methods names be ...
2
votes
1answer
883 views
finding a RC4 Encryption function in obfuscated assembly code with no symbols
RC4 encryption is quite basic and its Pseudo random generation algorithm is given at Wikipedia
When Looking for a hashing algorithm like MD5 or SHAx it is pretty simple to look for the Hashing ...
7
votes
3answers
991 views
Writeup of reverse engineering VM based obfuscation
I've seen quite a few crackmes on reverse engineering VM's. I've also come across "Unpacking Virtualization Obfuscators". Are there any other writeups that you could point me to that discuss the RE'...
4
votes
0answers
2k views
Well-known JSON obfuscator that puts the string “Salted12” in front of obfuscated files?
I have an application that pulls some JSON definition files from the internet. In former versions of the application, these files were genuine json files; now, in a later version, they seem to be ...
1
vote
1answer
3k views
How to start learning reverse engineering to eventually help exploiting of modern consoles like Xbox One, PS4? [duplicate]
How can someone with little programming knowledge except for some Ruby on Rails/Ruby begin on a path of Reverse Engineering as a hobbyist to help the exploitation process of modern-day gaming consoles ...
