Questions tagged [obfuscation]
Concealing the nature of how things truly function or work.
159
questions
0
votes
1
answer
55
views
.NET Packer/Protector
I have been trying to analyse a .NET trojanized software, here is the link for reference:https://www.virustotal.com/gui/file/6186e0b5b1d820744f8f7aa682eec6b043ba11c7737a64e173522b8b55d06f81/detection
...
- 36.4k
1
vote
2
answers
5k
views
Is deobfuscation of my javascript code hard or easy?
I am trying to protect my app code from theft. Since most of it is written in javascript I had to use many obfuscation techniques to make it incomprehensible.
I have written a very small piece of ...
- 1
1
vote
1
answer
492
views
Reverse Engineering Go obfuscated binaries
I have been trying to understand the working of this go malware by reversing it, which can be found here , so basically this stuff takes a shellcode as an input, and converts it to an exe or dll file, ...
CommunityBot
- 1
0
votes
1
answer
86
views
unobfuscate Assembly-CSharp.dll?
First: sorry about English, it's not my language. The translation was done by Google Translate.
I'm trying to work on a .dll from a Unity game, I managed to decompile the entire game, open the .dll, ...
CommunityBot
- 1
92
votes
9
answers
304k
views
How do I reverse-engineer .so files found in Android APKs?
I know how to reverse-engineer normal Android APKs using tools like apktool and dex2jar, but I don't know how to work with obfuscation.
When I extract everything from APK, I get some Smali files (I ...
- 115
0
votes
1
answer
138
views
Modifying a single .class file in an obfuscated JAR
i am trying to modify a jar that is partly obfuscated (and what i want to modify is in this part).
I can use Recaf, it will decompile it well and I can save modifications and export program without ...
CommunityBot
- 1
2
votes
1
answer
386
views
Best way to protect source code of exe that being loaded by Assembly.Load method
I am protecting an exe that being loaded by Assembly.Load... This makes everything difficult because most obfuscators causing it to not work properly or not load at all. I used confuserEx Ameteurz ...
CommunityBot
- 1
15
votes
2
answers
12k
views
What are the different types of packers?
I know the basic principle of a packer. Basically, it is a small routine launched at the beginning of the program that decompress the actual program and jump to it once achieved.
Yet, it seems that ...
- 6,684
0
votes
1
answer
312
views
What is the obfuscation method utilised in Playdead's 'LIMBO' video game?
The game uses Unity3D engine, perhaps with a custom render pipeline. Reports have been made, it is not possible to disassemble it. How did they achieve that?
CommunityBot
- 1
32
votes
1
answer
9k
views
What kinds of steps can I take to make my C++ application harder to reverse engineer?
If I am building a C++ application and I want to make it more difficult to reverse engineer, what steps can I take to do this?
Does the choice of compiler affect this?
What about compiler flags, ...
- 257
21
votes
3
answers
6k
views
Anti-debug techniques on Unix platforms?
I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more).
I am thinking about techniques such as the PTRACE test at the beginning of ...
- 257
2
votes
1
answer
80
views
Obfuscation indirect address
I'm studying a reverse engineering course and here is an example about obfuscation indirect addresses:
The course says:
The original code moves the content of the CH register to DL and the output ...
- 119
4
votes
0
answers
60
views
Decyphering 8kbps audio file format used in Solar Chanting Lotus
I'm trying to reverse engineer a solar powered chanting lotus flower so that I might replace the built in audio with something more interesting. The main chip (JL16B-083A - haven't been able to find ...
1
vote
2
answers
271
views
Reversing .net crypter with obfuscated imports
I have started recently with reverse engineering. I came across the linked file. It is a packed/crypted putty.exe. (WARNING: IT MAY BE BACKDOORED!!)
How it's working and loading putty.exe with runpe ...
- 257
3
votes
2
answers
729
views
Guidelines for dealing with obfuscated code
I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
- 21
2
votes
0
answers
127
views
How can i Lifting x86_64 assembly code to LLVM-IR
I'm researching of virus and I'm faced with the task of deobfuscating its virtual machine. I chose to do this through LLVM and I had a question, where can I see a simple example of lifting ...
- 21
5
votes
2
answers
1k
views
Fixing/recompiling a heavily control flow obfuscated function
I've recently come across a binary that has been obfuscated with a very obscure protection.
Obfuscation
From what I understand, the obfuscator is effective in several ways.
Multiple JMPs via relative ...
- 10.9k
29
votes
3
answers
20k
views
What is a "control-flow flattening" obfuscation technique?
I recently heard about the "control-flow flattening" obfuscation which seems to be is used to break the structure of the CFG of the binary program (see Symbolic Execution and CFG Flattening)....
- 18.9k
9
votes
3
answers
1k
views
Is there a name for this kind of "obfuscation" for the machine code from C++?
I was trying to reverse engineer an android ndk (arm) using ida pro on a static analysis. However, it appears there are a lot of useless jumps to the same place and with random values set to R1 to ...
- 59
4
votes
2
answers
736
views
What's this obfuscation technique?
I'm reverse-engineering a particular dylib on Mac OS X. The dylib is highly obfuscated, but I suspect it's from some well-known technique that I'm not aware of.
I'd like to describe it in the hope ...
- 10.9k
16
votes
3
answers
1k
views
Are there any metrics for code obfuscation?
Is source code obfuscation quantifiable ?
Are there any metrics that measure the degree of obfuscation in a source file ?
- 10.9k
1
vote
0
answers
242
views
deobfuscate Dexgaurd obfuscated code
I was reversing an apk. the code detects whether the apk is running on a rooted device or not. if it is rooted or an emulator it will stop and close out. so this is the snippet code which I think it ...
- 309
12
votes
3
answers
708
views
Trying to reverse engineer dump of a timestamp
I have the following hex parts and I have a strong suspicion that behind them is a date of an event:
2013.05.23 20:35:00 08014273ed2071a6800017
2013.05.23 21:45:00 08014273ed246cf0000017
2013....
- 121
3
votes
0
answers
203
views
How find all kernel functions called by a driver in windows 11
I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
- 33
3
votes
2
answers
3k
views
How to reverse engineer an exe built using nexe?
I am working on an express application. I obfuscate the source code using javascript-obfuscator.
I am using nexe cli for generating a single exe from the obfuscated code. Can anyone tell me if there ...
CommunityBot
- 1
5
votes
2
answers
4k
views
Dealing with heavily obfuscated Java, possibly on bytecode level
I've got a jarfile from a friend, he told me to put it thru an decompiler. So I did, but:
JD-GUI basically spit out just the imports and didn't show any class data
CFR dumped out stack trace on ...
- 3
4
votes
2
answers
1k
views
finding a RC4 Encryption function in obfuscated assembly code with no symbols
RC4 encryption is quite basic and its Pseudo random generation algorithm is given at Wikipedia
When Looking for a hashing algorithm like MD5 or SHAx it is pretty simple to look for the Hashing ...
- 326
1
vote
1
answer
90
views
How to debug an obfuscated self hashing program?
I need to understand what the following obfuscated application does:
interpreter.py:
string = "lambda x : obfuscated_code_to_interpret_variable_x"
interpreter = eval(string)
...
- 8,408
1
vote
1
answer
187
views
Python or C for a Qt application and security against reverse engineering
I actually have two choices : C or Python to create my application.
On my application users will need a key (on start) to access it, the key will be verified with an algorythm on the user's computer. ...
- 796
2
votes
0
answers
125
views
De-Obfuscating/unminifying a JS code [not duplicate]
I have come across a lot of similar questions on the same heading but unfortunately, none of them provided me with the intended results.
I have a piece of code which, initially I am trying to ...
- 21
2
votes
1
answer
426
views
x86 - How do I detect virtualized code by looking at the assembly?
How can I detected virtualized code by say, vmprotect, obsidium or themida just by looking at the assembly code? I know that just looking at the PE section name would help, but I wanted to detect ...
- 9,178
16
votes
1
answer
124k
views
How to deobfuscate an obfuscated javascript file like this? [duplicate]
I'm having serious problems deobfuscating a JavaScript file at work. This file is inside a web app that I was left in charge to improve it. The problem is that I can do it without having access to ...
- 18.9k
1
vote
0
answers
105
views
Which encryption returns 192 hash value it means 96 in bytes?
I am reversing an APK and there is a signature that needs to be found.
The function from where the signature is generated is present in the .so file.
I did small debugging. While doing it, the ...
- 11
32
votes
5
answers
24k
views
What is a good tools to reverse the effects of Minify on JavaScript?
Are there any scripts and/or online tools that can reverse the effects of minification?
I'm specifically looking to unminify a minified JavaScript file. Variable renaming is not a big issue, I want ...
- 1
0
votes
0
answers
449
views
How to deobfuscate Java application
Hi i am unable to deobfuscate the Advanced String Obfuscation Jar on tryHackMe
I tried
dumping the classes using a dumper javaagent
deobfuscate the jar with java-deobfuscator
threadtear functions
...
11
votes
3
answers
7k
views
What are the available libraries to statically modify ELF executables?
I would like to be able to rewrite or reorganize an ELF binary program directly from the executable format (not at compile-time).
The only library I know to do this is elfesteem (used in Miasm). But,...
- 7,078
1
vote
0
answers
192
views
Confusing objdump with data as code
I am trying to confuse objdump to solve the first exercise of chapter 6 in Practical Binary Analysis. Admittedly I am super weak with inline assembler but I made a best-effort attempt and tried to get ...
- 111
0
votes
0
answers
2k
views
How to disassemble an obfuscated .NET DLL?
I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL:
Any idea how to unpack it?
- 1,639
6
votes
3
answers
2k
views
How to design opaque predicates?
Opaque predicate are used to disrupt automatic analysis of the binary code by reaching the limits of what can do an analyzer.
Can somebody give an example (or a few examples) of an opaque predicate ...
1
vote
1
answer
705
views
devirtualize? or what is this obfuscator? and how to get rid of this
from previous question i still dont get any info or any process at all... now i asking again with this question is this virtualize code or something? i try many thing and it still didnt work [i unpack ...
- 10.9k
0
votes
1
answer
1k
views
How can I reverse this python code (obfuscated by b64, gzip and many more)
How can I Deobfuscate this python code
Link to code
I tried to replace eval places by print. but it won't work and output is also obfuscated
Head of the code looks like this
can anyone please help me
- 310
1
vote
1
answer
716
views
Is there a way in ida pro to see the address where I have explicitly marked them as code or data, etc?
I'm analyzing an obfuscated binary. IDA did a pretty good job of doing the initial auto-analysis. Later, I went through and marked some sections as undefined, or code, etc. Now IDA can't re-create ...
- 36.4k
0
votes
0
answers
212
views
new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?
just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
- 23
63
votes
6
answers
32k
views
Where to find (free) training in reverse engineering? [closed]
Can someone give a list of websites with good (and free) reverse engineering training exercises ?
- 18.9k
0
votes
1
answer
699
views
What are the way I can reverse engineer an obfuscated C++ program?
I am reverse engineering an program. I encountered a problem where I can't reverse engineer it as the program code is obfuscated. I realised the program is obfuscated thanks to my friend who noticed ...
- 21
0
votes
0
answers
37
views
Methods to alert inappropriate use of JS code
Let's say we have a JS code library that is not for sale, just internal. Of course, anyone who can access the website will be able to download that and reuse it.
To avoid others to reuse that library, ...
- 101
1
vote
2
answers
339
views
J2ME games obfuscator - Spyro and Tekken 5
While reversing some J2ME games like Spyro or Tekken 5 Mobile I have encountered a weird obfuscation where all fields, methods and classes have names like A, a, B, b, Aa, Bb etc.
It's really hard to ...
2
votes
2
answers
176
views
Wave File obfuscation
I have this file here, that is supposed to be a wave audio file, but seems to have some obfuscation applied to it. The file header is here: https://pastebin.com/LD5aA1EG Any suggestions where else ...
- 416
37
votes
5
answers
8k
views
What is the reason for this method to call itself?
While reversing a 32bit Mach-O binary with Hopper, I noticed this peculiar method. The instruction on 0x0000e506 seems to be calling an address right below the instruction.
What would be the reason ...
- 476
2
votes
2
answers
3k
views
Virtual machine code obfuscation implementation details
I want to implement a VM based simple proof-of-concept obfuscator. It should take an exe file as input and produce a new pe file with appended vm section. For simplicity let's say the exe file is ...
- 143