Questions tagged [obfuscation]
Concealing the nature of how things truly function or work.
30
questions with no upvoted or accepted answers
4
votes
0
answers
60
views
Decyphering 8kbps audio file format used in Solar Chanting Lotus
I'm trying to reverse engineer a solar powered chanting lotus flower so that I might replace the built in audio with something more interesting. The main chip (JL16B-083A - haven't been able to find ...
4
votes
0
answers
3k
views
Well-known JSON obfuscator that puts the string "Salted12" in front of obfuscated files?
I have an application that pulls some JSON definition files from the internet. In former versions of the application, these files were genuine json files; now, in a later version, they seem to be ...
- 12.9k
3
votes
0
answers
203
views
How find all kernel functions called by a driver in windows 11
I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
- 33
2
votes
0
answers
127
views
How can i Lifting x86_64 assembly code to LLVM-IR
I'm researching of virus and I'm faced with the task of deobfuscating its virtual machine. I chose to do this through LLVM and I had a question, where can I see a simple example of lifting ...
- 21
2
votes
0
answers
125
views
De-Obfuscating/unminifying a JS code [not duplicate]
I have come across a lot of similar questions on the same heading but unfortunately, none of them provided me with the intended results.
I have a piece of code which, initially I am trying to ...
- 21
2
votes
1
answer
386
views
Best way to protect source code of exe that being loaded by Assembly.Load method
I am protecting an exe that being loaded by Assembly.Load... This makes everything difficult because most obfuscators causing it to not work properly or not load at all. I used confuserEx Ameteurz ...
- 21
2
votes
0
answers
98
views
Trying to replicate encryption of an android app
I was trying to replicate/copy the encryption of an android app which uses CryptoJS with sha256 encryption as having seen in the source code of the android app. fingerprinting the app, it was built ...
- 309
2
votes
0
answers
50
views
Possibly infected image
Long story short I'v downloaded a template for my website and instead of images it has the .html files included, and at the beginning those html files do include PNG IHDR , and they are being loaded ...
2
votes
0
answers
98
views
API Hiding Issue
I'm trying to analyze a malware which is hiding API names. When I open it with CFF Explorer, except a few API like GetProcAddress, nothing appears. Basically, I know how API hiding works. I set a ...
- 21
2
votes
0
answers
4k
views
Can de4dot deobfuscate Dotfuscator Professional?
I ran de4dot on a Xamarin app obfuscated using Dotfuscator Professional. However, there's still the random switches and strange ints everywhere. Can de4dot decode this? If not, is there another tool ...
2
votes
0
answers
750
views
Obscure router refuses to flash OpenWrt
This is a very obscure Chinese router from a brand called Wavlink. It's the Model: WN529R2/WN529R2P. It's web interface was pretty limited and wouldn't allow firmware modifications.
I found GND/Tx/Rx/...
- 154
2
votes
0
answers
482
views
Jar reversing: Can't open as zip file nor open it with common decompilers
I'm pentesting a JNLP application composed by several .jar files. I'm able to decompile with jd-gui every 3rd party library included in it, but the main .jar coded by my client.
So after running JD-...
- 21
1
vote
0
answers
242
views
deobfuscate Dexgaurd obfuscated code
I was reversing an apk. the code detects whether the apk is running on a rooted device or not. if it is rooted or an emulator it will stop and close out. so this is the snippet code which I think it ...
- 309
1
vote
1
answer
492
views
Reverse Engineering Go obfuscated binaries
I have been trying to understand the working of this go malware by reversing it, which can be found here , so basically this stuff takes a shellcode as an input, and converts it to an exe or dll file, ...
- 11
1
vote
0
answers
105
views
Which encryption returns 192 hash value it means 96 in bytes?
I am reversing an APK and there is a signature that needs to be found.
The function from where the signature is generated is present in the .so file.
I did small debugging. While doing it, the ...
- 11
1
vote
0
answers
192
views
Confusing objdump with data as code
I am trying to confuse objdump to solve the first exercise of chapter 6 in Practical Binary Analysis. Admittedly I am super weak with inline assembler but I made a best-effort attempt and tried to get ...
- 111
1
vote
0
answers
2k
views
Obfuscate JSON file that is served client-side
Through some research I have found that obfuscation won't block hackers from retrieving your .json file, but I'd like to have at least a level of obfuscation that deters some people. I ran into a npm ...
- 11
1
vote
0
answers
263
views
Mysterious chunk of code in IOLI crackme0x06 challenge
I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge.
Context
But first of all, here is the context : I've successfully cracked the ...
- 51
1
vote
0
answers
751
views
C# Hidden Method through transparent proxy object?
I'm dealing with an interesting form of obfuscation. A C# program I am reversing has a central API, let's call it "Central API". This Central API has several functions that aren't exactly defined.
...
- 131
1
vote
0
answers
127
views
Missing Map from Java Native Method to C Code
When writing a C implementation for a native Java method in Android, the rule is to name the C function according to the convention "Java_com_...". But I encountered an APK in which there are no such ...
- 121
1
vote
0
answers
2k
views
de4dot and Dotfuscator: IL looks different, not DotPeek decompiled code
From the obfuscated to the deobfuscated assemblies, IL code looks different using ILDASM; however, DotPeek decompiled C# code looks exactly the same for both. Any clue why?
The obfuscation software ...
1
vote
0
answers
114
views
How to hide / obfuscate the function of an IC?
Let's say I have an IC (integrated circuit) and I want to hide it's function. What would be best practice to do that?
Removing the markings with sandpaper or acid?
(E.g. atmega328, ATtiny85,... ) ...
- 111
1
vote
0
answers
367
views
Discovering byte array obfuscation function
I'm in the middle of reverse engineering SafeNet (formerly Rainbow) iKey 1000 USB dongle protocol, in order to create Linux driver for it. I'm using Windows as guest in virtual machine on Linux host ...
- 11
1
vote
0
answers
84
views
Where to identify and access the main object/closure in a JavaScript web app?
I want to add missing functionality to a web app's front end code JavaScript code.
I can find the code in the browser's developer tools by setting breakpoints and stepping through.
But in a large ...
- 485
0
votes
0
answers
449
views
How to deobfuscate Java application
Hi i am unable to deobfuscate the Advanced String Obfuscation Jar on tryHackMe
I tried
dumping the classes using a dumper javaagent
deobfuscate the jar with java-deobfuscator
threadtear functions
...
0
votes
0
answers
2k
views
How to disassemble an obfuscated .NET DLL?
I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL:
Any idea how to unpack it?
- 1,639
0
votes
0
answers
212
views
new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?
just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
0
votes
0
answers
37
views
Methods to alert inappropriate use of JS code
Let's say we have a JS code library that is not for sale, just internal. Of course, anyone who can access the website will be able to download that and reuse it.
To avoid others to reuse that library, ...
- 101
0
votes
0
answers
137
views
How to call strongly encrypted DLL from Resources?
There is a program. This program accepts plugins. Plugins written with C#. I have to encrypt it. But when I use strong obfuscators I have exception. Program doesn't read. How can I fix that ? How can ...
- 1
0
votes
0
answers
117
views
Encrypting and packing at functional boundaries for obfuscation
I am interested in software obfuscation techniques. I found your excellent summary of obfuscation in order to avoid (as possible) reverse engineering.
One of the proposed technique you quoted:
...
