Questions tagged [obfuscation]
Concealing the nature of how things truly function or work.
159
questions
92
votes
9
answers
304k
views
How do I reverse-engineer .so files found in Android APKs?
I know how to reverse-engineer normal Android APKs using tools like apktool and dex2jar, but I don't know how to work with obfuscation.
When I extract everything from APK, I get some Smali files (I ...
- 1,195
63
votes
6
answers
32k
views
Where to find (free) training in reverse engineering? [closed]
Can someone give a list of websites with good (and free) reverse engineering training exercises ?
- 18.9k
37
votes
5
answers
8k
views
What is the reason for this method to call itself?
While reversing a 32bit Mach-O binary with Hopper, I noticed this peculiar method. The instruction on 0x0000e506 seems to be calling an address right below the instruction.
What would be the reason ...
- 497
32
votes
5
answers
24k
views
What is a good tools to reverse the effects of Minify on JavaScript?
Are there any scripts and/or online tools that can reverse the effects of minification?
I'm specifically looking to unminify a minified JavaScript file. Variable renaming is not a big issue, I want ...
- 816
32
votes
1
answer
9k
views
What kinds of steps can I take to make my C++ application harder to reverse engineer?
If I am building a C++ application and I want to make it more difficult to reverse engineer, what steps can I take to do this?
Does the choice of compiler affect this?
What about compiler flags, ...
- 927
29
votes
3
answers
20k
views
What is a "control-flow flattening" obfuscation technique?
I recently heard about the "control-flow flattening" obfuscation which seems to be is used to break the structure of the CFG of the binary program (see Symbolic Execution and CFG Flattening)....
- 18.9k
23
votes
4
answers
8k
views
What is "overlapping instructions" obfuscation?
I analyzed some binaries in x86/x86-64 using some obfuscation tricks. One was called overlapping instructions. Can someone explain how does this obfuscation work and how to work around?
- 18.9k
23
votes
4
answers
19k
views
Firmware analysis and file system extraction?
I'm trying to analyse the firmware image of a NAS device.
I used various tools to help the analysis (binwalk, deezee, signsrch, firmware-mod-kit which uses binwalk AFAIK), but all of them have been ...
- 333
21
votes
3
answers
6k
views
Anti-debug techniques on Unix platforms?
I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more).
I am thinking about techniques such as the PTRACE test at the beginning of ...
- 18.9k
20
votes
4
answers
7k
views
How common are virtualized packers in the wild?
I'm just getting into the RE field, and I learned about virtualized packers (like VMProtect or Themida) in a class about a year ago. How often is malware in the wild really packed with virtualized ...
- 413
19
votes
4
answers
12k
views
What is an "opaque predicate"?
I saw the term of opaque predicates several times in obfuscation papers. As far as I understand it, it refers to predicates that are hard to evaluate in an automated manner. Placing it at strategical ...
- 18.9k
17
votes
4
answers
2k
views
Obfuscating JavaScript with zero-width characters - pros and cons?
This comes from comments on a question on StackOverflow about JavaScript Variables: Why aren't ◎ܫ◎ and ☺ valid JavaScript variable names?
JavaScript accepts zero-width characters as valid variable ...
- 273
16
votes
1
answer
124k
views
How to deobfuscate an obfuscated javascript file like this? [duplicate]
I'm having serious problems deobfuscating a JavaScript file at work. This file is inside a web app that I was left in charge to improve it. The problem is that I can do it without having access to ...
- 169
16
votes
3
answers
1k
views
Are there any metrics for code obfuscation?
Is source code obfuscation quantifiable ?
Are there any metrics that measure the degree of obfuscation in a source file ?
- 2,445
15
votes
2
answers
12k
views
What are the different types of packers?
I know the basic principle of a packer. Basically, it is a small routine launched at the beginning of the program that decompress the actual program and jump to it once achieved.
Yet, it seems that ...
- 18.9k
12
votes
2
answers
3k
views
Replacing common x86 instructions with less known ones
Is there any kind of software or research or paper which discusses replacement of frequent x86 instructions with ones which are less common and thus less understandable to the attacker (floating point/...
- 223
12
votes
3
answers
709
views
Trying to reverse engineer dump of a timestamp
I have the following hex parts and I have a strong suspicion that behind them is a date of an event:
2013.05.23 20:35:00 08014273ed2071a6800017
2013.05.23 21:45:00 08014273ed246cf0000017
2013....
- 223
11
votes
4
answers
24k
views
Try to deobfuscate multi layered javascript
According to the techy zilla blog
It will be much harder to deobfuscate code that has been obfuscated using multiple obfuscating algorithms. According to them, jsbeautifier can't fix this obfuscated ...
- 211
11
votes
2
answers
3k
views
Protect data stored in binary
Let's say I've some function(i.e. hash function), that generates value from input seed and some precomputed hash values, that are stored somewhere in binary. What are the possible approaches for:
...
- 823
11
votes
3
answers
7k
views
What are the available libraries to statically modify ELF executables?
I would like to be able to rewrite or reorganize an ELF binary program directly from the executable format (not at compile-time).
The only library I know to do this is elfesteem (used in Miasm). But,...
- 18.9k
11
votes
1
answer
2k
views
Rename obfuscated names with .NET Reflector?
I have some obfuscated C# .NET code I want to analyze.
Is it possible to rename those obfuscated symbols? So I can more easily track them? Like IDA Pro can work with renaming functions and so forth.
- 3,059
10
votes
2
answers
466
views
What is a correct disassembler?
A disassembler is supposed to produce a human readable representation of the binary program. But the most well known techniques: linear sweep and recursive traversal (see this comment for more) are ...
- 18.9k
10
votes
2
answers
1k
views
What is "instruction camouflage" obfuscation?
I have an obfuscated binary which only print a simple Hello World!
and exit like this:
Hello World!
But, when I am looking at the assembly with objdump, I cannot find any
call to printf or write, ...
- 18.9k
10
votes
3
answers
558
views
Usage of FHE in obfuscation?
FHE (Fully Homomorphic Encryption) is a cryptographic encryption schema in which it is possible to perform arithmetic operations on the ciphered text without deciphering it.
Though there is no really ...
- 18.9k
10
votes
4
answers
17k
views
AirPlay Mirroring decryption (FairPlay)
I've been spending a good chunk of time looking at some 3rd party applications that were successful in "reproducing" (although I believe not necessarily by understanding the algorithm completely but ...
- 346
9
votes
5
answers
19k
views
What are the techniques and tools to obfuscate Python programs?
This question is related to this other one. I just wonder what are the techniques applicable and which can be found in the real world to obfuscate Python program (similar questions can be found on ...
- 18.9k
9
votes
3
answers
1k
views
Is there a name for this kind of "obfuscation" for the machine code from C++?
I was trying to reverse engineer an android ndk (arm) using ida pro on a static analysis. However, it appears there are a lot of useless jumps to the same place and with random values set to R1 to ...
- 118
9
votes
2
answers
7k
views
What are the differences between metamorphic, oligomorphic and polymorphic malware?
Malware use several methods to evade anti-virus software, one is to change their code when they are replicating. I saw mainly three type of techniques in the wild which are: metamorphic malware, ...
- 18.9k
9
votes
2
answers
2k
views
What is this 'mathematical jigsaw puzzles' obfuscation?
You must have heard about it, it all over the on-line newspapers. Some researchers from UCLA claims to have achieved a breakthrough in software obfuscation through 'mathematical jigsaw puzzles'.
...
- 18.9k
9
votes
2
answers
2k
views
Obfuscating Windows Executables
GCC allows you to write optimization plugins that can be used to obfuscate your compiled executable, but this wasn't ported to mingw. LLVM allows something similar but barfs when including Windows.h.
...
- 4,056
9
votes
1
answer
3k
views
Encrypting text in binary files
Text strings are usually easily read in a binary file using any editor that supports ASCII encoding of hexadecimal values. These text snippets can be easily studied and altered by a reverse engineer.
...
- 4,785
8
votes
4
answers
2k
views
Deal with obfuscated assembly
When using objdump I see the following disassembled code:
8049436: 89 04 24 mov DWORD PTR [esp],eax
8049439: e8 52 f7 ff ff call 8048b90 <gtk_entry_get_text@plt&...
- 183
8
votes
4
answers
4k
views
Unpacking binary statically
Say I have a binary that I'm not able to execute (for example it runs on some device that I don't have one of), but I can disassemble it. I can get the docs on the architecture. (It's MIPS little ...
- 638
8
votes
3
answers
3k
views
Writeup of reverse engineering VM based obfuscation
I've seen quite a few crackmes on reverse engineering VM's. I've also come across "Unpacking Virtualization Obfuscators". Are there any other writeups that you could point me to that discuss the RE'...
user1743
8
votes
1
answer
362
views
Where and how is variable entanglement obfuscation used?
I don't know the exact name of this obfuscation, so I call it variable entanglement for now.
I already saw this principle in a few binaries but I never found a complete description of what was ...
- 18.9k
8
votes
1
answer
388
views
Semantics-based obfuscation
I have some (very blurred as usual) thinking about the semantics obfuscation, that come from this question and the excellent answers of @RolfRolles and @Andrew. As far as I understand, the ideas of ...
- 1,410
7
votes
2
answers
2k
views
How are obfuscators detected?
I'm guessing that tools like PeiD detect packers by looking for signatures inside the packed binary and by measuring the entropy. Is there any other work that tries to determine if a binary is ...
user1743
7
votes
3
answers
2k
views
What is this obfuscation method called?
I have recently seen the following code obfuscation method:
...
jump loc_1234
;-------------------------
Bunch of junk
;-------------------------
loc_1234:
code continued...
The logic ...
- 3,088
7
votes
2
answers
696
views
Why do obfuscators remove line numbers, and can I safely leave them in?
Application security engineer here. When we compile our java code, we obfuscate it using KlassMaster and have it remove line numbers (see KlassMaster docs) because of a handwavy explanation "it makes ...
- 173
7
votes
2
answers
1k
views
Making Visual C++ harder to reverse engineer
This is similar in nature to this question and this question; I'm interested in what compiler settings to enabled/disable to make a Visual C++ harder to reverse engineer.
Here's a few compiler flags ...
- 173
6
votes
3
answers
2k
views
How to design opaque predicates?
Opaque predicate are used to disrupt automatic analysis of the binary code by reaching the limits of what can do an analyzer.
Can somebody give an example (or a few examples) of an opaque predicate ...
- 18.9k
6
votes
2
answers
2k
views
Determining CRC algorithm (16 bit?) over RS-232
I give up.... I've tried for two years to determine which CRC algorithm is being
using over an RS-232 serial connection between two pieces of equipment. The equipment
dates from about 2002. I'm only ...
- 121
6
votes
2
answers
3k
views
Retrieving encryption/encoding logic from dll
I am trying to retrieve a decrypting/deconing logic from a program. Unfortunately I have virtually no experiencing in reverse engineering.
I am building an alternative controller application for a ...
- 161
6
votes
1
answer
258
views
How are achieved PUFs (Physicaly Unclonable Functions) and can we workaround?
I would like to know how are achieved PUFs (Physicaly Unclonable Functions) and if there is a way reverse these hardware electronic components ?
Recent papers such as "Invasive PUF Analysis" present ...
- 18.9k
6
votes
1
answer
742
views
Simplifying assembly
I'm analysing some binary trace, it's pretty much obfuscated. What I need to do is to understand work flow of its alghoritms. However I cannot find any reliable tool which would help me with that.
I ...
- 103
5
votes
3
answers
1k
views
Origin of "Hacker Protection Factor"
Dexguard claims a "hacker protection factor" of 35 without any explanation of where the number comes from or what it means. I figure the actual statement is meaningless, but I'm very curious to see ...
- 2,002
5
votes
2
answers
439
views
Formal obfuscation
My question is related to this question with the excellent answer of @Rolf Rolles. Since the paper of M.D. Preda et al is quite technique so I wonder whether I understand their idea or not. The ...
- 1,410
5
votes
2
answers
2k
views
Trace Method Calls in .NET/C# Binary
I have a heavily obfuscated Windows service binary. Fields, types and methods are renamed. While it is possible to decompile the binary using dnSpy, it is still very cumbersome to identify important/...
- 151
5
votes
2
answers
4k
views
Dealing with heavily obfuscated Java, possibly on bytecode level
I've got a jarfile from a friend, he told me to put it thru an decompiler. So I did, but:
JD-GUI basically spit out just the imports and didn't show any class data
CFR dumped out stack trace on ...
- 153
5
votes
1
answer
2k
views
Obfuscated AES decryption assembly
I have recently been sifting my way through a whole load of assembly to try to identify how a program is decrypting some data. Thus far I have identified how the IV is extracted, that the IV is 16 ...
- 109