Questions tagged [obfuscation]
Concealing the nature of how things truly function or work.
25 questions
64
votes
6
answers
33k
views
Where to find (free) training in reverse engineering? [closed]
Can someone give a list of websites with good (and free) reverse engineering training exercises ?
- 19.2k
94
votes
9
answers
322k
views
How do I reverse-engineer .so files found in Android APKs?
I know how to reverse-engineer normal Android APKs using tools like apktool and dex2jar, but I don't know how to work with obfuscation.
When I extract everything from APK, I get some Smali files (I ...
- 1,215
29
votes
3
answers
22k
views
What is a "control-flow flattening" obfuscation technique?
I recently heard about the "control-flow flattening" obfuscation which seems to be is used to break the structure of the CFG of the binary program (see Symbolic Execution and CFG Flattening)....
- 19.2k
11
votes
3
answers
7k
views
What are the available libraries to statically modify ELF executables?
I would like to be able to rewrite or reorganize an ELF binary program directly from the executable format (not at compile-time).
The only library I know to do this is elfesteem (used in Miasm). But,...
- 19.2k
32
votes
1
answer
10k
views
What kinds of steps can I take to make my C++ application harder to reverse engineer?
If I am building a C++ application and I want to make it more difficult to reverse engineer, what steps can I take to do this?
Does the choice of compiler affect this?
What about compiler flags, ...
- 937
15
votes
2
answers
12k
views
What are the different types of packers?
I know the basic principle of a packer. Basically, it is a small routine launched at the beginning of the program that decompress the actual program and jump to it once achieved.
Yet, it seems that ...
- 19.2k
11
votes
4
answers
24k
views
Try to deobfuscate multi layered javascript
According to the techy zilla blog
It will be much harder to deobfuscate code that has been obfuscated using multiple obfuscating algorithms. According to them, jsbeautifier can't fix this obfuscated ...
- 211
33
votes
5
answers
25k
views
What is a good tools to reverse the effects of Minify on JavaScript?
Are there any scripts and/or online tools that can reverse the effects of minification?
I'm specifically looking to unminify a minified JavaScript file. Variable renaming is not a big issue, I want ...
- 826
22
votes
3
answers
6k
views
Anti-debug techniques on Unix platforms?
I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more).
I am thinking about techniques such as the PTRACE test at the beginning of ...
- 19.2k
16
votes
1
answer
125k
views
How to deobfuscate an obfuscated javascript file like this? [duplicate]
I'm having serious problems deobfuscating a JavaScript file at work. This file is inside a web app that I was left in charge to improve it. The problem is that I can do it without having access to ...
- 169
11
votes
2
answers
3k
views
Protect data stored in binary
Let's say I've some function(i.e. hash function), that generates value from input seed and some precomputed hash values, that are stored somewhere in binary. What are the possible approaches for:
...
- 823
2
votes
1
answer
2k
views
Any good deobfuscators for java?
So I've built an obfuscator for java source code, would anyone know if there is any good deobfuscators which i could test how well my obfuscator is?
I know there are many deobfuscators out there, ...
- 31
23
votes
4
answers
19k
views
Firmware analysis and file system extraction?
I'm trying to analyse the firmware image of a NAS device.
I used various tools to help the analysis (binwalk, deezee, signsrch, firmware-mod-kit which uses binwalk AFAIK), but all of them have been ...
- 333
20
votes
4
answers
13k
views
What is an "opaque predicate"?
I saw the term of opaque predicates several times in obfuscation papers. As far as I understand it, it refers to predicates that are hard to evaluate in an automated manner. Placing it at strategical ...
- 19.2k
20
votes
4
answers
7k
views
How common are virtualized packers in the wild?
I'm just getting into the RE field, and I learned about virtualized packers (like VMProtect or Themida) in a class about a year ago. How often is malware in the wild really packed with virtualized ...
- 413
16
votes
3
answers
1k
views
Are there any metrics for code obfuscation?
Is source code obfuscation quantifiable ?
Are there any metrics that measure the degree of obfuscation in a source file ?
- 2,465
10
votes
2
answers
1k
views
What is "instruction camouflage" obfuscation?
I have an obfuscated binary which only print a simple Hello World!
and exit like this:
Hello World!
But, when I am looking at the assembly with objdump, I cannot find any
call to printf or write, ...
- 19.2k
9
votes
5
answers
20k
views
What are the techniques and tools to obfuscate Python programs?
This question is related to this other one. I just wonder what are the techniques applicable and which can be found in the real world to obfuscate Python program (similar questions can be found on ...
- 19.2k
9
votes
2
answers
7k
views
What are the differences between metamorphic, oligomorphic and polymorphic malware?
Malware use several methods to evade anti-virus software, one is to change their code when they are replicating. I saw mainly three type of techniques in the wild which are: metamorphic malware, ...
- 19.2k
9
votes
2
answers
2k
views
What is this 'mathematical jigsaw puzzles' obfuscation?
You must have heard about it, it all over the on-line newspapers. Some researchers from UCLA claims to have achieved a breakthrough in software obfuscation through 'mathematical jigsaw puzzles'.
...
- 19.2k
8
votes
3
answers
3k
views
Writeup of reverse engineering VM based obfuscation
I've seen quite a few crackmes on reverse engineering VM's. I've also come across "Unpacking Virtualization Obfuscators". Are there any other writeups that you could point me to that discuss the RE'...
user1743
5
votes
3
answers
1k
views
Origin of "Hacker Protection Factor"
Dexguard claims a "hacker protection factor" of 35 without any explanation of where the number comes from or what it means. I figure the actual statement is meaningless, but I'm very curious to see ...
- 2,012
4
votes
3
answers
9k
views
Exe protection by TLS callback, trying to understand the behaviour
I have an app, obfuscated by FSG protector. When i tried to unpack it, the first thign that i had is, when i start the process with the debugger/or attach debugger later, i immediatly receive ACCESS ...
4
votes
1
answer
12k
views
Best way to protect source code of .exe program running on Python?
I am developing proprietary software that would be distributed in a form of .exe file. In order to use it, users will have to authenticate with their whitelist credentials (username + password).
The ...
- 141
1
vote
3
answers
8k
views
How to obfuscate x86 assembly code?
For my project, I am performing a kind of checksum operation on a portion of code to protect it and therefore do not want its template to be easily visible and therefore need obfuscation.
I have ...
- 123