Skip to main content

Questions tagged [obfuscation]

Concealing the nature of how things truly function or work.

Filter by
Sorted by
Tagged with
5 votes
2 answers
2k views

Trace Method Calls in .NET/C# Binary

I have a heavily obfuscated Windows service binary. Fields, types and methods are renamed. While it is possible to decompile the binary using dnSpy, it is still very cumbersome to identify important/...
DucatiNerd's user avatar
1 vote
0 answers
2k views

Obfuscate JSON file that is served client-side

Through some research I have found that obfuscation won't block hackers from retrieving your .json file, but I'd like to have at least a level of obfuscation that deters some people. I ran into a npm ...
Beta's user avatar
  • 11
1 vote
0 answers
267 views

Mysterious chunk of code in IOLI crackme0x06 challenge

I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge. Context But first of all, here is the context : I've successfully cracked the ...
programmersn's user avatar
1 vote
0 answers
55 views

How to choose a .NET software protector which will have a small impact on run-time performance speed? [closed]

I am writing a .NET software which is doing calculations and drawing in real-time i.e when the user is moving the mouse. I want to protect this software from being reverse engineered and restrict its ...
ForeverNoob's user avatar
1 vote
1 answer
3k views

How to deobfuscate native Android library obfuscated with OLLVM?

When I load the binay in IDA, all I can see are loads of .datadiv_decodeXXX... functions and this is because of OLLVM. I know it is possible as a Chinese article I found said they were able to ...
Charlie Niekirk's user avatar
2 votes
1 answer
237 views

Does a symbolic disassembler exist?

I would like to know if there are disassemblers based on a symbolic analysis, I'm beginner in RE, but I think that a disassembler based on symbolic techniques can be very interesting and could ...
n4sm's user avatar
  • 63
3 votes
2 answers
2k views

Jump in the middle trick

I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
Francisco Linan's user avatar
4 votes
2 answers
777 views

What's this obfuscation technique?

I'm reverse-engineering a particular dylib on Mac OS X. The dylib is highly obfuscated, but I suspect it's from some well-known technique that I'm not aware of. I'd like to describe it in the hope ...
user27283's user avatar
6 votes
1 answer
779 views

Simplifying assembly

I'm analysing some binary trace, it's pretty much obfuscated. What I need to do is to understand work flow of its alghoritms. However I cannot find any reliable tool which would help me with that. I ...
kozera2137's user avatar
1 vote
1 answer
2k views

Analyzing and deobfuscating complex JS code [duplicate]

I am looking to reverse engineer a very ugly piece of JS found here. As far as I can tell, this script generates and sets some cookies on my browser that identify it on the site. Deobfuscating it ...
Joxrox's user avatar
  • 21
1 vote
0 answers
797 views

C# Hidden Method through transparent proxy object?

I'm dealing with an interesting form of obfuscation. A C# program I am reversing has a central API, let's call it "Central API". This Central API has several functions that aren't exactly defined. ...
Rob Gates's user avatar
  • 131
7 votes
2 answers
729 views

Why do obfuscators remove line numbers, and can I safely leave them in?

Application security engineer here. When we compile our java code, we obfuscate it using KlassMaster and have it remove line numbers (see KlassMaster docs) because of a handwavy explanation "it makes ...
Mike Ounsworth's user avatar
1 vote
1 answer
1k views

What is the difference between stripped binary and obfuscated binary

I want to know the difference between stripped binary and obfuscated binary.
nutim's user avatar
  • 19
2 votes
0 answers
4k views

Can de4dot deobfuscate Dotfuscator Professional?

I ran de4dot on a Xamarin app obfuscated using Dotfuscator Professional. However, there's still the random switches and strange ints everywhere. Can de4dot decode this? If not, is there another tool ...
ButteredQwaffles's user avatar
4 votes
3 answers
420 views

Obfuscated code analysis - can unused variables be ignored?

I am analyzing a malicious javascript. The code is encoded and obfuscated in a way that I did not manage to even partially deobfuscate yet and it is filled with long strings. In order to simplify the ...
skooog's user avatar
  • 197
1 vote
0 answers
130 views

Missing Map from Java Native Method to C Code

When writing a C implementation for a native Java method in Android, the rule is to name the C function according to the convention "Java_com_...". But I encountered an APK in which there are no such ...
Zirui Wang's user avatar
1 vote
2 answers
5k views

Is deobfuscation of my javascript code hard or easy?

I am trying to protect my app code from theft. Since most of it is written in javascript I had to use many obfuscation techniques to make it incomprehensible. I have written a very small piece of ...
Asperger's user avatar
  • 113
2 votes
0 answers
767 views

Obscure router refuses to flash OpenWrt

This is a very obscure Chinese router from a brand called Wavlink. It's the Model: WN529R2/WN529R2P. It's web interface was pretty limited and wouldn't allow firmware modifications. I found GND/Tx/Rx/...
78dtat78da's user avatar
3 votes
2 answers
511 views

Why doesn't this retn instruction return from the function?

I disassembled an exe file on Windows with IDA and saw this function prologue: I see that when the retn executes instead of returning it jumps to sub_1314cba4. Why doesn't the retn instruction ...
Jonert6544's user avatar
-2 votes
1 answer
19k views

How do I decode this JavaScript code? [duplicate]

Each file starts with the same function: (function(_0x128f83, _0x1ae5b9) { var _0x1b5471 = function(_0x339be5) { while (--_0x339be5) { _0x128f83['push'](_0x128f83['shift']()); ...
solo's user avatar
  • 111
1 vote
1 answer
1k views

Map an obfuscated javascript file to the original

Among other approaches, there are ways to "prettify" obfuscated javascript. But most of such approaches are geared towards someone trying to understand code that's not their own (e.g. from a website, ...
ahron's user avatar
  • 113
0 votes
2 answers
2k views

verifyError in youtube android app modification

I try to decompile youtube android application and modify it but when I build the application and install on a virtual device faced with below error: E/AndroidRuntime(1782): java.lang.VerifyError: ...
hossein abdi's user avatar
3 votes
1 answer
881 views

IDA pro obfuscation instance

I have tried all the I have learned so far to figure out how to deal with this instance of obfuscation. So far I understand that an opaque predicate is present, causing an unconditional jump to one ...
vsA_'s user avatar
  • 33
3 votes
1 answer
1k views

Deobfuscating overlapping x86 assembly instructions

I'm trying to solve a reverse engineering challenge (http://crackmes.cf/users/beatrix/beaba/) and am having trouble with the obfuscation. Below is a piece of code that gets executed almost immediately ...
user22977's user avatar
4 votes
3 answers
9k views

Exe protection by TLS callback, trying to understand the behaviour

I have an app, obfuscated by FSG protector. When i tried to unpack it, the first thign that i had is, when i start the process with the debugger/or attach debugger later, i immediatly receive ACCESS ...
BakedPotatoWithCheese's user avatar
0 votes
1 answer
957 views

ARM ELF Obfuscation [closed]

Metamorphic is a technique to obfuscate a binary and change the opcode sequence and create new samples with same functionality. In my case, I have some elf binary of ARM processor type and their ...
hamid darabian's user avatar
1 vote
2 answers
550 views

reverse javascript crackme encryption method algorithm

This crackme contains a text input element on the screen and a button to validate The value you enter is set into _inputValue, afterwards you click on a button, the function executes, in the last ...
James W.'s user avatar
  • 283
1 vote
2 answers
2k views

Techniques to hide a process (procmon)? [closed]

On Windows, how would one go about hiding procmon from another process? What techniques/terms would I be searching for?
user737447's user avatar
1 vote
0 answers
2k views

de4dot and Dotfuscator: IL looks different, not DotPeek decompiled code

From the obfuscated to the deobfuscated assemblies, IL code looks different using ILDASM; however, DotPeek decompiled C# code looks exactly the same for both. Any clue why? The obfuscation software ...
Masamune Shirow's user avatar
0 votes
1 answer
374 views

How does the different types of executable packing work?

Reference to this thread: What are the different types of packers? Q1: How do packing methods like compression, protection, and encryption work, how do they differ, and which is more secure? Q2: ...
Nicolas Wein's user avatar
1 vote
0 answers
116 views

How to hide / obfuscate the function of an IC?

Let's say I have an IC (integrated circuit) and I want to hide it's function. What would be best practice to do that? Removing the markings with sandpaper or acid? (E.g. atmega328, ATtiny85,... ) ...
7twenty7's user avatar
  • 111
9 votes
3 answers
1k views

Is there a name for this kind of "obfuscation" for the machine code from C++?

I was trying to reverse engineer an android ndk (arm) using ida pro on a static analysis. However, it appears there are a lot of useless jumps to the same place and with random values set to R1 to ...
Y M's user avatar
  • 118
0 votes
2 answers
2k views

Android App's hardcoded local keystore password r3versing

Novice Android security researcher here. Recently I was tasked with the task/challenge of exposing a certain app's hardcoded local keystore password. I've decompiled it with JEB2 and obviously within ...
martin_s's user avatar
0 votes
1 answer
149 views

What do the unusually named packages and files usually mean?

When decompiling an apk with apktool, the classes.dex file is decompiled into folders smali_classes#, and sorted their respective packages. I recognize some of the files, as they are mentioned in ...
John K's user avatar
  • 153
2 votes
1 answer
94 views

Unkown Swap Encoding

I'm trying to figure out this encoding in malware.. All I have are the static strings.. I was able to figure one out so there is plaintext on one: e-snAetgrU$ translates to $User-Agent Here are ...
Chris Hall's user avatar
2 votes
1 answer
263 views

Distribution of malware obfuscation types

There are several statistics and numbers out there of current malware families and their distributions. However, I'am looking for statistics which shows the distribution of malware differed by their ...
asdf's user avatar
  • 33
1 vote
2 answers
193 views

Obfuscation by changing the order of a malware behaviour

I know that there are some obfuscation techniques which can lead to slowing or even failing the detection of malware when static analysis is used. However, is there a similar technique that changes ...
Ophilia's user avatar
  • 187
1 vote
0 answers
372 views

Discovering byte array obfuscation function

I'm in the middle of reverse engineering SafeNet (formerly Rainbow) iKey 1000 USB dongle protocol, in order to create Linux driver for it. I'm using Windows as guest in virtual machine on Linux host ...
yuiu's user avatar
  • 11
1 vote
3 answers
8k views

How to obfuscate x86 assembly code?

For my project, I am performing a kind of checksum operation on a portion of code to protect it and therefore do not want its template to be easily visible and therefore need obfuscation. I have ...
rkabhishek's user avatar
1 vote
1 answer
850 views

I'm decompiling an apk file to learn how the creator designed the UI for their app. Are these layout files obfuscated?

I'm new to decompiling apps. Most of the apps I decompile aren't very popular, so obfuscation hasn't been a problem yet. I'm not entirely sure what obfuscation looks like. The current app I'm looking ...
God Usopp's user avatar
  • 111
2 votes
1 answer
2k views

Any good deobfuscators for java?

So I've built an obfuscator for java source code, would anyone know if there is any good deobfuscators which i could test how well my obfuscator is? I know there are many deobfuscators out there, ...
Alan Liang's user avatar
2 votes
2 answers
795 views

Unpacking NSPack v 2.9 based malware to get OEP

recently i am analyzing a malware which is packed with NSPack. when i am trying to unpack it using this blog link,i landed over two instruction PUSHFD,PUSHAD in ollydbg. so i put a breakpoint on the ...
Bikash Dash's user avatar
1 vote
0 answers
72 views

Java source code deobfuscator? [duplicate]

Does anyone know of any source code deobfuscator in java? I'm currently writing an obfuscator for java source code and I want to test how well I have made it with an deobfuscator.
Alan Liang's user avatar
5 votes
1 answer
2k views

Obfuscated AES decryption assembly

I have recently been sifting my way through a whole load of assembly to try to identify how a program is decrypting some data. Thus far I have identified how the IV is extracted, that the IV is 16 ...
Joshua's user avatar
  • 109
2 votes
0 answers
509 views

Jar reversing: Can't open as zip file nor open it with common decompilers

I'm pentesting a JNLP application composed by several .jar files. I'm able to decompile with jd-gui every 3rd party library included in it, but the main .jar coded by my client. So after running JD-...
Igarr's user avatar
  • 21
-3 votes
1 answer
9k views

How to deobfuscated javascript?

How to deobfuscate javascript file, i have a javascript code are deobfuscate . Code: http://pastebin.com/zFH2GidN Help me and thanks you.
KingOne's user avatar
  • 67
0 votes
0 answers
118 views

Encrypting and packing at functional boundaries for obfuscation

I am interested in software obfuscation techniques. I found your excellent summary of obfuscation in order to avoid (as possible) reverse engineering. One of the proposed technique you quoted: ...
odysseasg's user avatar
1 vote
3 answers
3k views

How does PeID calculate entropy?

I'm curious about the entropy field value that shows up when a binary is dropped into PeID. Does someone know how it arrives upon this value?
user avatar
1 vote
2 answers
772 views

Debugging Win32.Upatre - why does Ollydbg fail to analyze this?

So I've been looking at this thread - Where can I, as an individual, get malware samples to analyze? And grabbed myself a binary sample of Win32.Upatre from Halvar Flake's blog. I started analyzing ...
FigureItOut's user avatar
1 vote
1 answer
6k views

Tools for automated deobfuscation

To evaluate different Java obfuscators, I want also consider if the obfuscators use preventive techniques against common tools used for automated deobfuscation. Therefore I plan to obfuscate a test ...
la-ga's user avatar
  • 11