Questions tagged [obfuscation]

Concealing the nature of how things truly function or work.

Filter by
Sorted by
Tagged with
1
vote
2answers
677 views

Debugging Win32.Upatre - why does Ollydbg fail to analyze this?

So I've been looking at this thread - Where can I, as an individual, get malware samples to analyze? And grabbed myself a binary sample of Win32.Upatre from Halvar Flake's blog. I started analyzing ...
6
votes
2answers
2k views

How are obfuscators detected?

I'm guessing that tools like PeiD detect packers by looking for signatures inside the packed binary and by measuring the entropy. Is there any other work that tries to determine if a binary is ...
3
votes
1answer
106 views

Expressing trace semantics as a solution for a fixpoint equation

I was reading through the chapter on Obfuscation in "Practical Reverse Engineering" I encountered the following statement. Where X is the set of execution traces (finite and infinite), you can ...
1
vote
0answers
80 views

Where to identify and access the main object/closure in a JavaScript web app?

I want to add missing functionality to a web app's front end code JavaScript code. I can find the code in the browser's developer tools by setting breakpoints and stepping through. But in a large ...
4
votes
1answer
426 views

Which virtualized target is recommended for newbie on vm-obfuscation?

I'm newbie on virtualized code obfuscation. I can break many features to avoid debugging/reversing and packer/protector (even Themida, without vm option), but I'm not good at virtualized code. Though ...
0
votes
2answers
1k views

Obfuscating jar already obfuscated [closed]

I'm wondering what happens if we try to run a jar through Proguard that has already been obfuscated by another obfuscator or Proguard itself? Will the obfuscated class names and methods names be ...
8
votes
2answers
2k views

Obfuscating Windows Executables

GCC allows you to write optimization plugins that can be used to obfuscate your compiled executable, but this wasn't ported to mingw. LLVM allows something similar but barfs when including Windows.h. ...
21
votes
4answers
18k views

Firmware analysis and file system extraction?

I'm trying to analyse the firmware image of a NAS device. I used various tools to help the analysis (binwalk, deezee, signsrch, firmware-mod-kit which uses binwalk AFAIK), but all of them have been ...
2
votes
1answer
1k views

finding a RC4 Encryption function in obfuscated assembly code with no symbols

RC4 encryption is quite basic and its Pseudo random generation algorithm is given at Wikipedia When Looking for a hashing algorithm like MD5 or SHAx it is pretty simple to look for the Hashing ...
8
votes
3answers
2k views

Writeup of reverse engineering VM based obfuscation

I've seen quite a few crackmes on reverse engineering VM's. I've also come across "Unpacking Virtualization Obfuscators". Are there any other writeups that you could point me to that discuss the RE'...
1
vote
1answer
4k views

How to start learning reverse engineering to eventually help exploiting of modern consoles like Xbox One, PS4? [duplicate]

How can someone with little programming knowledge except for some Ruby on Rails/Ruby begin on a path of Reverse Engineering as a hobbyist to help the exploitation process of modern-day gaming consoles ...
2
votes
0answers
62 views

How to know the C++ try/throw/catch block size and address from machine code? [duplicate]

I'm doing a project that reorders basic blocks inside a function at runtime in C++ under 64-bit Linux. The reordering process includes updating instructions like "jmp". One problem is that if the ...
0
votes
2answers
1k views

What kind of JS obfuscation is this? [closed]

I have read about de-obfuscating JS files and about multi-layered obfuscation. I have come across a file (which I have uploaded here) and it doesn't seem to be obfuscated except for lines 21 and 42. I ...
-3
votes
1answer
244 views

Trying to deobfuscate multi layered javascript [closed]

Can someone deobfuscate this code? I am not getting any way to deobfuscate this. Unable to paste it over here as it over passed 30,000 word limit. http://pastebin.com/V327Q8Hg Thanks
4
votes
1answer
540 views

Computer Malware: More complex than metamorphic?

I have read the topic on oligo-, poly- and metamorphic malware. I have done a quick google search, and it seems like the concept of metamorphic malware was already known in the DOS age and in the ...
-2
votes
1answer
2k views

Trying to decrypt javascript code [duplicate]

Is it possible to deobfuscate/decrypt this javascript code? ;eval(function(w,i,s,e){var lIll=0;var ll1I=0;var Il1l=0;var ll1l=[];var l1lI=[];while(true){if(lIll<5)l1lI.push(w.charAt(lIll));else if(...
9
votes
2answers
2k views

What is this 'mathematical jigsaw puzzles' obfuscation?

You must have heard about it, it all over the on-line newspapers. Some researchers from UCLA claims to have achieved a breakthrough in software obfuscation through 'mathematical jigsaw puzzles'. ...
3
votes
1answer
414 views

Experiences from reverse engineers in detecting recursive calls

I have absolutely no experience in reversing real-world binary codes, so I wonder how the obfuscated codes prevent reversers. I doubt that the reverses always find some ways to understand what are ...
1
vote
1answer
171 views

Large memcpy operation before possible obfuscation [closed]

I am currently reversing a binary and I am stuck at understanding what the application is trying to do. There is a memcpy operation which is copying almost 1MB from a .data section to a .bss section. ...
11
votes
2answers
2k views

Replacing common x86 instructions with less known ones

Is there any kind of software or research or paper which discusses replacement of frequent x86 instructions with ones which are less common and thus less understandable to the attacker (floating point/...
5
votes
2answers
3k views

Retrieving encryption/encoding logic from dll

I am trying to retrieve a decrypting/deconing logic from a program. Unfortunately I have virtually no experiencing in reverse engineering. I am building an alternative controller application for a ...
6
votes
1answer
330 views

Semantics-based obfuscation

I have some (very blurred as usual) thinking about the semantics obfuscation, that come from this question and the excellent answers of @RolfRolles and @Andrew. As far as I understand, the ideas of ...
6
votes
1answer
250 views

How are achieved PUFs (Physicaly Unclonable Functions) and can we workaround?

I would like to know how are achieved PUFs (Physicaly Unclonable Functions) and if there is a way reverse these hardware electronic components ? Recent papers such as "Invasive PUF Analysis" present ...
1
vote
1answer
263 views

What is the difficulty/advantage to obfuscate a multi-thread program?

According to my knowledge, several obfuscation strategies are widely used(or at least described in academic) like: complicating control flow inserting bogus control-flow control-flow flattening jump ...
3
votes
1answer
822 views

On the indistinguishability obfuscation (informally)

I have some superficial thinking about the indistinguishability obfuscation, these come from this question of @perror and the answer of @mikeazo herein about a construction of the indistinguishability ...
13
votes
2answers
10k views

What are the different types of packers?

I know the basic principle of a packer. Basically, it is a small routine launched at the beginning of the program that decompress the actual program and jump to it once achieved. Yet, it seems that ...
10
votes
2answers
546 views

Trying to reverse engineer dump of a timestamp

I have the following hex parts and I have a strong suspicion that behind them is a date of an event: 2013.05.23 20:35:00 08014273ed2071a6800017 2013.05.23 21:45:00 08014273ed246cf0000017 2013....
10
votes
1answer
2k views

Rename obfuscated names with .NET Reflector?

I have some obfuscated C# .NET code I want to analyze. Is it possible to rename those obfuscated symbols? So I can more easily track them? Like IDA Pro can work with renaming functions and so forth.
7
votes
4answers
2k views

Deal with obfuscated assembly

When using objdump I see the following disassembled code: 8049436: 89 04 24 mov DWORD PTR [esp],eax 8049439: e8 52 f7 ff ff call 8048b90 <gtk_entry_get_text@plt&...
8
votes
1answer
353 views

Where and how is variable entanglement obfuscation used?

I don't know the exact name of this obfuscation, so I call it variable entanglement for now. I already saw this principle in a few binaries but I never found a complete description of what was ...
5
votes
3answers
984 views

Origin of "Hacker Protection Factor"

Dexguard claims a "hacker protection factor" of 35 without any explanation of where the number comes from or what it means. I figure the actual statement is meaningless, but I'm very curious to see ...
5
votes
2answers
400 views

Formal obfuscation

My question is related to this question with the excellent answer of @Rolf Rolles. Since the paper of M.D. Preda et al is quite technique so I wonder whether I understand their idea or not. The ...
21
votes
4answers
6k views

What is "overlapping instructions" obfuscation?

I analyzed some binaries in x86/x86-64 using some obfuscation tricks. One was called overlapping instructions. Can someone explain how does this obfuscation work and how to work around?
6
votes
2answers
1k views

Making Visual C++ harder to reverse engineer

This is similar in nature to this question and this question; I'm interested in what compiler settings to enabled/disable to make a Visual C++ harder to reverse engineer. Here's a few compiler flags ...
4
votes
1answer
666 views

On SPARC, what happens when a branch is placed in the branch-delay slot of another branch?

Our team recently had to look at SPARC assembly specifications, the problem is that I do not have a SPARC processor to try things on it (I should set up a simulator or get one of these old Sparc ...
9
votes
2answers
7k views

What are the differences between metamorphic, oligomorphic and polymorphic malware?

Malware use several methods to evade anti-virus software, one is to change their code when they are replicating. I saw mainly three type of techniques in the wild which are: metamorphic malware, ...
9
votes
2answers
1k views

What is "instruction camouflage" obfuscation?

I have an obfuscated binary which only print a simple Hello World! and exit like this: Hello World! But, when I am looking at the assembly with objdump, I cannot find any call to printf or write, ...
4
votes
1answer
420 views

How to produce binaries with "instruction camouflage" obfuscation?

I would like to know what is the simplest way to produce code binaries with instruction camouflage (see this question). The problem here is that you first have to produce a correct assembly code and ...
-6
votes
1answer
605 views

What is Data Interleaving? [closed]

What is data interleaving? Is this something I can use to obfuscate collections of variables?
19
votes
4answers
6k views

How common are virtualized packers in the wild?

I'm just getting into the RE field, and I learned about virtualized packers (like VMProtect or Themida) in a class about a year ago. How often is malware in the wild really packed with virtualized ...
8
votes
1answer
3k views

Encrypting text in binary files

Text strings are usually easily read in a binary file using any editor that supports ASCII encoding of hexadecimal values. These text snippets can be easily studied and altered by a reverse engineer. ...
9
votes
2answers
395 views

What is a correct disassembler?

A disassembler is supposed to produce a human readable representation of the binary program. But the most well known techniques: linear sweep and recursive traversal (see this comment for more) are ...
6
votes
4answers
3k views

Unpacking binary statically

Say I have a binary that I'm not able to execute (for example it runs on some device that I don't have one of), but I can disassemble it. I can get the docs on the architecture. (It's MIPS little ...
14
votes
2answers
892 views

Are there any metrics for code obfuscation?

Is source code obfuscation quantifiable ? Are there any metrics that measure the degree of obfuscation in a source file ?
29
votes
1answer
8k views

What kinds of steps can I take to make my C++ application harder to reverse engineer?

If I am building a C++ application and I want to make it more difficult to reverse engineer, what steps can I take to do this? Does the choice of compiler affect this? What about compiler flags, ...
16
votes
4answers
2k views

Obfuscating JavaScript with zero-width characters - pros and cons?

This comes from comments on a question on StackOverflow about JavaScript Variables: Why aren't ◎ܫ◎ and ☺ valid JavaScript variable names? JavaScript accepts zero-width characters as valid variable ...

1 2
3