Questions tagged [obfuscation]

Concealing the nature of how things truly function or work.

Filter by
Sorted by
Tagged with
75
votes
8answers
239k views

How do I reverse engineer .so files found in android APKs?

I know how to reverse engineer normal android APKs using tools like APK-tool anddex2jar but i don't know how to work with obfuscation. Can anyone help or atleast provide some pointers? I know this ...
16
votes
1answer
110k views

How to deobfuscate an obfuscated javascript file like this? [duplicate]

I'm having serious problems deobfuscating a JavaScript file at work. This file is inside a web app that I was left in charge to improve it. The problem is that I can do it without having access to ...
1
vote
1answer
168 views

Large memcpy operation before possible obfuscation [closed]

I am currently reversing a binary and I am stuck at understanding what the application is trying to do. There is a memcpy operation which is copying almost 1MB from a .data section to a .bss section. ...
3
votes
1answer
414 views

Experiences from reverse engineers in detecting recursive calls

I have absolutely no experience in reversing real-world binary codes, so I wonder how the obfuscated codes prevent reversers. I doubt that the reverses always find some ways to understand what are ...
11
votes
2answers
2k views

Replacing common x86 instructions with less known ones

Is there any kind of software or research or paper which discusses replacement of frequent x86 instructions with ones which are less common and thus less understandable to the attacker (floating point/...
5
votes
2answers
3k views

Retrieving encryption/encoding logic from dll

I am trying to retrieve a decrypting/deconing logic from a program. Unfortunately I have virtually no experiencing in reverse engineering. I am building an alternative controller application for a ...
1
vote
1answer
263 views

What is the difficulty/advantage to obfuscate a multi-thread program?

According to my knowledge, several obfuscation strategies are widely used(or at least described in academic) like: complicating control flow inserting bogus control-flow control-flow flattening jump ...
10
votes
1answer
2k views

Rename obfuscated names with .NET Reflector?

I have some obfuscated C# .NET code I want to analyze. Is it possible to rename those obfuscated symbols? So I can more easily track them? Like IDA Pro can work with renaming functions and so forth.
6
votes
1answer
330 views

Semantics-based obfuscation

I have some (very blurred as usual) thinking about the semantics obfuscation, that come from this question and the excellent answers of @RolfRolles and @Andrew. As far as I understand, the ideas of ...
3
votes
1answer
822 views

On the indistinguishability obfuscation (informally)

I have some superficial thinking about the indistinguishability obfuscation, these come from this question of @perror and the answer of @mikeazo herein about a construction of the indistinguishability ...
6
votes
1answer
250 views

How are achieved PUFs (Physicaly Unclonable Functions) and can we workaround?

I would like to know how are achieved PUFs (Physicaly Unclonable Functions) and if there is a way reverse these hardware electronic components ? Recent papers such as "Invasive PUF Analysis" present ...
7
votes
4answers
2k views

Deal with obfuscated assembly

When using objdump I see the following disassembled code: 8049436: 89 04 24 mov DWORD PTR [esp],eax 8049439: e8 52 f7 ff ff call 8048b90 <gtk_entry_get_text@plt&...
21
votes
4answers
18k views

Firmware analysis and file system extraction?

I'm trying to analyse the firmware image of a NAS device. I used various tools to help the analysis (binwalk, deezee, signsrch, firmware-mod-kit which uses binwalk AFAIK), but all of them have been ...
9
votes
2answers
2k views

What is this 'mathematical jigsaw puzzles' obfuscation?

You must have heard about it, it all over the on-line newspapers. Some researchers from UCLA claims to have achieved a breakthrough in software obfuscation through 'mathematical jigsaw puzzles'. ...
8
votes
1answer
351 views

Where and how is variable entanglement obfuscation used?

I don't know the exact name of this obfuscation, so I call it variable entanglement for now. I already saw this principle in a few binaries but I never found a complete description of what was ...
5
votes
2answers
399 views

Formal obfuscation

My question is related to this question with the excellent answer of @Rolf Rolles. Since the paper of M.D. Preda et al is quite technique so I wonder whether I understand their idea or not. The ...
5
votes
3answers
983 views

Origin of “Hacker Protection Factor”

Dexguard claims a "hacker protection factor" of 35 without any explanation of where the number comes from or what it means. I figure the actual statement is meaningless, but I'm very curious to see ...
6
votes
3answers
2k views

How to design opaque predicates?

Opaque predicate are used to disrupt automatic analysis of the binary code by reaching the limits of what can do an analyzer. Can somebody give an example (or a few examples) of an opaque predicate ...
6
votes
3answers
2k views

What is this obfuscation method called?

I have recently seen the following code obfuscation method: ... jump loc_1234 ;------------------------- Bunch of junk ;------------------------- loc_1234: code continued... The logic ...
6
votes
2answers
1k views

Making Visual C++ harder to reverse engineer

This is similar in nature to this question and this question; I'm interested in what compiler settings to enabled/disable to make a Visual C++ harder to reverse engineer. Here's a few compiler flags ...
24
votes
2answers
13k views

What is a “control-flow flattening” obfuscation technique?

I recently heard about the "control-flow flattening" obfuscation which seems to be is used to break the structure of the CFG of the binary program (see Diablo obfuscation module and Symbolic Execution ...
10
votes
2answers
539 views

Trying to reverse engineer dump of a timestamp

I have the following hex parts and I have a strong suspicion that behind them is a date of an event: 2013.05.23 20:35:00 08014273ed2071a6800017 2013.05.23 21:45:00 08014273ed246cf0000017 2013....
10
votes
4answers
22k views

Try to deobfuscate multi layered javascript

According to the techy zilla blog It will be much harder to deobfuscate code that has been obfuscated using multiple obfuscating algorithms. According to them, jsbeautifier can't fix this obfuscated ...
4
votes
1answer
657 views

On SPARC, what happens when a branch is placed in the branch-delay slot of another branch?

Our team recently had to look at SPARC assembly specifications, the problem is that I do not have a SPARC processor to try things on it (I should set up a simulator or get one of these old Sparc ...
9
votes
5answers
19k views

What are the techniques and tools to obfuscate Python programs?

This question is related to this other one. I just wonder what are the techniques applicable and which can be found in the real world to obfuscate Python program (similar questions can be found on ...
11
votes
3answers
5k views

What are the available libraries to statically modify ELF executables?

I would like to be able to rewrite or reorganize an ELF binary program directly from the executable format (not at compile-time). The only library I know to do this is elfesteem (used in Miasm). But,...
13
votes
2answers
10k views

What are the different types of packers?

I know the basic principle of a packer. Basically, it is a small routine launched at the beginning of the program that decompress the actual program and jump to it once achieved. Yet, it seems that ...
-6
votes
1answer
598 views

What is Data Interleaving? [closed]

What is data interleaving? Is this something I can use to obfuscate collections of variables?
9
votes
2answers
7k views

What are the differences between metamorphic, oligomorphic and polymorphic malware?

Malware use several methods to evade anti-virus software, one is to change their code when they are replicating. I saw mainly three type of techniques in the wild which are: metamorphic malware, ...
4
votes
1answer
420 views

How to produce binaries with “instruction camouflage” obfuscation?

I would like to know what is the simplest way to produce code binaries with instruction camouflage (see this question). The problem here is that you first have to produce a correct assembly code and ...
9
votes
2answers
1k views

What is “instruction camouflage” obfuscation?

I have an obfuscated binary which only print a simple Hello World! and exit like this: Hello World! But, when I am looking at the assembly with objdump, I cannot find any call to printf or write, ...
18
votes
4answers
10k views

What is an “opaque predicate”?

I saw the term of opaque predicates several times in obfuscation papers. As far as I understand it, it refers to predicates that are hard to evaluate in an automated manner. Placing it at strategical ...
36
votes
5answers
7k views

What is the reason for this method to call itself?

While reversing a 32bit Mach-O binary with Hopper, I noticed this peculiar method. The instruction on 0x0000e506 seems to be calling an address right below the instruction. What would be the reason ...
0
votes
4answers
3k views

Where to find a hard crackme [closed]

I'd like to improve my skill as a reverse engineer. And thus I am looking for a location to find these.
21
votes
4answers
6k views

What is “overlapping instructions” obfuscation?

I analyzed some binaries in x86/x86-64 using some obfuscation tricks. One was called overlapping instructions. Can someone explain how does this obfuscation work and how to work around?
19
votes
4answers
6k views

How common are virtualized packers in the wild?

I'm just getting into the RE field, and I learned about virtualized packers (like VMProtect or Themida) in a class about a year ago. How often is malware in the wild really packed with virtualized ...
8
votes
1answer
3k views

Encrypting text in binary files

Text strings are usually easily read in a binary file using any editor that supports ASCII encoding of hexadecimal values. These text snippets can be easily studied and altered by a reverse engineer. ...
62
votes
6answers
29k views

Where to find (free) training in reverse engineering? [closed]

Can someone give a list of websites with good (and free) reverse engineering training exercises ?
9
votes
2answers
394 views

What is a correct disassembler?

A disassembler is supposed to produce a human readable representation of the binary program. But the most well known techniques: linear sweep and recursive traversal (see this comment for more) are ...
14
votes
2answers
883 views

Are there any metrics for code obfuscation?

Is source code obfuscation quantifiable ? Are there any metrics that measure the degree of obfuscation in a source file ?
8
votes
2answers
2k views

Obfuscating Windows Executables

GCC allows you to write optimization plugins that can be used to obfuscate your compiled executable, but this wasn't ported to mingw. LLVM allows something similar but barfs when including Windows.h. ...
29
votes
1answer
8k views

What kinds of steps can I take to make my C++ application harder to reverse engineer?

If I am building a C++ application and I want to make it more difficult to reverse engineer, what steps can I take to do this? Does the choice of compiler affect this? What about compiler flags, ...
6
votes
4answers
3k views

Unpacking binary statically

Say I have a binary that I'm not able to execute (for example it runs on some device that I don't have one of), but I can disassemble it. I can get the docs on the architecture. (It's MIPS little ...
28
votes
4answers
18k views

What is a good tools to reverse the effects of Minify on JavaScript?

Are there any scripts and/or online tools that can reverse the effects of minification? I'm specifically looking to unminify a minified JavaScript file. Variable renaming is not a big issue, I want ...
16
votes
4answers
2k views

Obfuscating JavaScript with zero-width characters - pros and cons?

This comes from comments on a question on StackOverflow about JavaScript Variables: Why aren't ◎ܫ◎ and ☺ valid JavaScript variable names? JavaScript accepts zero-width characters as valid variable ...
10
votes
3answers
458 views

Usage of FHE in obfuscation?

FHE (Fully Homomorphic Encryption) is a cryptographic encryption schema in which it is possible to perform arithmetic operations on the ciphered text without deciphering it. Though there is no really ...
18
votes
3answers
4k views

Anti-debug techniques on Unix platforms?

I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more). I am thinking about techniques such as the PTRACE test at the beginning of ...

1 2
3