Questions tagged [obfuscation]

Concealing the nature of how things truly function or work.

Filter by
Sorted by
Tagged with
11
votes
3answers
5k views

What are the available libraries to statically modify ELF executables?

I would like to be able to rewrite or reorganize an ELF binary program directly from the executable format (not at compile-time). The only library I know to do this is elfesteem (used in Miasm). But,...
0
votes
0answers
35 views

Confusing objdump with data as code

I am trying to confuse objdump to solve the first exercise of chapter 6 in Practical Binary Analysis. Admittedly I am super weak with inline assembler but I made a best-effort attempt and tried to get ...
2
votes
1answer
600 views

How to reverse engineer an exe built using nexe?

I am working on an express application. I obfuscate the source code using javascript-obfuscator. I am using nexe cli for generating a single exe from the obfuscated code. Can anyone tell me if there ...
4
votes
1answer
130 views

Fixing/recompiling a heavily control flow obfuscated function

I've recently come across a binary that has been obfuscated with a very obscure protection. Obfuscation From what I understand, the obfuscator is effective in several ways. Multiple JMPs via relative ...
0
votes
0answers
84 views

How to disassemble an obfuscated .NET DLL?

I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL: Any idea how to unpack it?
0
votes
1answer
115 views

Best way to protect source code of exe that being loaded by Assembly.Load method

I am protecting an exe that being loaded by Assembly.Load... This makes everything difficult because most obfuscators causing it to not work properly or not load at all. I used confuserEx Ameteurz ...
6
votes
3answers
2k views

How to design opaque predicates?

Opaque predicate are used to disrupt automatic analysis of the binary code by reaching the limits of what can do an analyzer. Can somebody give an example (or a few examples) of an opaque predicate ...
0
votes
1answer
133 views

What is the obfuscation method utilised in Playdead's 'LIMBO' video game?

The game uses Unity3D engine, perhaps with a custom render pipeline. Reports have been made, it is not possible to disassemble it. How did they achieve that?
0
votes
0answers
42 views

How can I connect basic blocks seperated by unconditional jmps?

I'm analyzing an obfuscated code which splits its code into multiple blocks seperated by many, many unconditional jmps. Here is a picture of what the obfuscation looks like: I wrote an IDAPython ...
1
vote
1answer
241 views

devirtualize? or what is this obfuscator? and how to get rid of this

from previous question i still dont get any info or any process at all... now i asking again with this question is this virtualize code or something? i try many thing and it still didnt work [i unpack ...
0
votes
1answer
77 views

How can I reverse this python code (obfuscated by b64, gzip and many more)

How can I Deobfuscate this python code Link to code I tried to replace eval places by print. but it won't work and output is also obfuscated Head of the code looks like this can anyone please help me
1
vote
1answer
38 views

Is there a way in ida pro to see the address where I have explicitly marked them as code or data, etc?

I'm analyzing an obfuscated binary. IDA did a pretty good job of doing the initial auto-analysis. Later, I went through and marked some sections as undefined, or code, etc. Now IDA can't re-create ...
0
votes
0answers
38 views

new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?

just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
0
votes
0answers
61 views

how to get rid of this obfuscator?

i somehow know that this is Confuserex but noting working agter many try the file is still unreadable. is there a way to? or im just bad... ps.i unpack this from the exe file that only has PE(maybe ...
62
votes
6answers
29k views

Where to find (free) training in reverse engineering? [closed]

Can someone give a list of websites with good (and free) reverse engineering training exercises ?
0
votes
1answer
122 views

What are the way I can reverse engineer an obfuscated C++ program?

I am reverse engineering an program. I encountered a problem where I can't reverse engineer it as the program code is obfuscated. I realised the program is obfuscated thanks to my friend who noticed ...
0
votes
0answers
30 views

Methods to alert inappropriate use of JS code

Let's say we have a JS code library that is not for sale, just internal. Of course, anyone who can access the website will be able to download that and reuse it. To avoid others to reuse that library, ...
1
vote
2answers
207 views

J2ME games obfuscator - Spyro and Tekken 5

While reversing some J2ME games like Spyro or Tekken 5 Mobile I have encountered a weird obfuscation where all fields, methods and classes have names like A, a, B, b, Aa, Bb etc. It's really hard to ...
0
votes
0answers
42 views

Remapping Branch Instructions After Obfuscation

Recently I've been working on a project. I've already got a hint for a problem that I had here: (Garbage Assembly Code Generationat at random offsets) however, the accepted answer's solution doesn't ...
18
votes
3answers
4k views

Anti-debug techniques on Unix platforms?

I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more). I am thinking about techniques such as the PTRACE test at the beginning of ...
1
vote
2answers
108 views

Wave File obfuscation

I have this file here, that is supposed to be a wave audio file, but seems to have some obfuscation applied to it. The file header is here: https://pastebin.com/LD5aA1EG Any suggestions where else ...
75
votes
8answers
239k views

How do I reverse engineer .so files found in android APKs?

I know how to reverse engineer normal android APKs using tools like APK-tool anddex2jar but i don't know how to work with obfuscation. Can anyone help or atleast provide some pointers? I know this ...
36
votes
5answers
7k views

What is the reason for this method to call itself?

While reversing a 32bit Mach-O binary with Hopper, I noticed this peculiar method. The instruction on 0x0000e506 seems to be calling an address right below the instruction. What would be the reason ...
0
votes
0answers
85 views

.NET - What kind of obfuscation is this?

I'm currently performing some malicious DLL malware analysis, and I'm having some issues figuring out how to de-obfuscate this particular sample. It uses a lot of Reflective Assembly calls, and, a lot ...
24
votes
2answers
13k views

What is a “control-flow flattening” obfuscation technique?

I recently heard about the "control-flow flattening" obfuscation which seems to be is used to break the structure of the CFG of the binary program (see Diablo obfuscation module and Symbolic Execution ...
1
vote
0answers
163 views

Guidelines for dealing with obfuscated code

I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
2
votes
2answers
637 views

Virtual machine code obfuscation implementation details

I want to implement a VM based simple proof-of-concept obfuscator. It should take an exe file as input and produce a new pe file with appended vm section. For simplicity let's say the exe file is ...
6
votes
3answers
2k views

What is this obfuscation method called?

I have recently seen the following code obfuscation method: ... jump loc_1234 ;------------------------- Bunch of junk ;------------------------- loc_1234: code continued... The logic ...
1
vote
0answers
61 views

Trying to replicate encryption of an android app

I was trying to replicate/copy the encryption of an android app which uses CryptoJS with sha256 encryption as having seen in the source code of the android app. fingerprinting the app, it was built ...
1
vote
1answer
213 views

Reverse Engineering Java - Deobfuscating symbols

I'm new to Java and working on cleaning up a fairly large Java .jar sample where the obfuscator has renamed symbols into invalid names. For example: import org.lib.00.0.2; public final class 90 ...
0
votes
0answers
83 views

How to call strongly encrypted DLL from Resources?

There is a program. This program accepts plugins. Plugins written with C#. I have to encrypt it. But when I use strong obfuscators I have exception. Program doesn't read. How can I fix that ? How can ...
18
votes
4answers
10k views

What is an “opaque predicate”?

I saw the term of opaque predicates several times in obfuscation papers. As far as I understand it, it refers to predicates that are hard to evaluate in an automated manner. Placing it at strategical ...
3
votes
1answer
6k views

Best way to protect source code of .exe program running on Python?

I am developing proprietary software that would be distributed in a form of .exe file. In order to use it, users will have to authenticate with their whitelist credentials (username + password). The ...
-1
votes
1answer
530 views

De-obfuscate JS code [closed]

I came across a script that converts font files from one type to another (i.e. WOFF to TTF, etc). I would like to understand it and incorporate some of the code into a personal project. The script ...
2
votes
2answers
2k views

Dealing with heavily obfuscated Java, possibly on bytecode level

I've got a jarfile from a friend, he told me to put it thru an decompiler. So I did, but: JD-GUI basically spit out just the imports and didn't show any class data CFR dumped out stack trace on ...
2
votes
1answer
312 views

Stack-pointer analysis failed

I'm testing my toy obfuscating C compiler against IDA's decompiler, but IDA refuses always functions (then the decompilation is not possible). For example, at one of lowest-levels of obfuscating, a ...
1
vote
1answer
251 views

Python self decryption script, as mean of obfuscation

I have a software with an embedded python interpreter. The software can open upon startup a given .py script and execute it. Let's assume that in my python environment I can't open other files, and I ...
1
vote
1answer
241 views

Is it possible to completely reverse this code?

i have this code i'm trying to deobfuscate https://pastebin.com/g5mHpWE4 I used https://beautifier.io/ and http://www.jsnice.org/ but the result is still not good, current code: https://pastebin.com/...
0
votes
1answer
255 views

Error After de4dot - Application Does Not Start

There is an application that has been obfuscation to learn. So in an unpack me style. In the first stage I would unpack with de4dot. After you unpack, the running application stops working. dump and ...
1
vote
0answers
43 views

Possibly infected image

Long story short I'v downloaded a template for my website and instead of images it has the .html files included, and at the beginning those html files do include PNG IHDR , and they are being loaded ...
2
votes
2answers
662 views

Static analysis obfuscated code

I'm reversing a code that is heavily obfuscated. It uses opaque predicates, call stack tampering, junk code and control flow flattering. Call stack tampering uses indirect branches (push register / ...
1
vote
0answers
82 views

API Hiding Issue

I'm trying to analyze a malware which is hiding API names. When I open it with CFF Explorer, except a few API like GetProcAddress, nothing appears. Basically, I know how API hiding works. I set a ...
5
votes
2answers
1k views

Trace Method Calls in .NET/C# Binary

I have a heavily obfuscated Windows service binary. Fields, types and methods are renamed. While it is possible to decompile the binary using dnSpy, it is still very cumbersome to identify important/...
10
votes
4answers
22k views

Try to deobfuscate multi layered javascript

According to the techy zilla blog It will be much harder to deobfuscate code that has been obfuscated using multiple obfuscating algorithms. According to them, jsbeautifier can't fix this obfuscated ...
9
votes
5answers
19k views

What are the techniques and tools to obfuscate Python programs?

This question is related to this other one. I just wonder what are the techniques applicable and which can be found in the real world to obfuscate Python program (similar questions can be found on ...
1
vote
3answers
5k views

How to obfuscate x86 assembly code?

For my project, I am performing a kind of checksum operation on a portion of code to protect it and therefore do not want its template to be easily visible and therefore need obfuscation. I have ...
0
votes
2answers
1k views

verifyError in youtube android app modification

I try to decompile youtube android application and modify it but when I build the application and install on a virtual device faced with below error: E/AndroidRuntime(1782): java.lang.VerifyError: ...
0
votes
0answers
1k views

Obfuscate JSON file that is served client-side

Through some research I have found that obfuscation won't block hackers from retrieving your .json file, but I'd like to have at least a level of obfuscation that deters some people. I ran into a npm ...
1
vote
0answers
217 views

Mysterious chunk of code in IOLI crackme0x06 challenge

I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge. Context But first of all, here is the context : I've successfully cracked the ...
1
vote
0answers
50 views

How to choose a .NET software protector which will have a small impact on run-time performance speed? [closed]

I am writing a .NET software which is doing calculations and drawing in real-time i.e when the user is moving the mouse. I want to protect this software from being reverse engineered and restrict its ...