Questions tagged [obfuscation]

Concealing the nature of how things truly function or work.

Filter by
Sorted by
Tagged with
1
vote
1answer
5k views

Tools for automated deobfuscation

To evaluate different Java obfuscators, I want also consider if the obfuscators use preventive techniques against common tools used for automated deobfuscation. Therefore I plan to obfuscate a test ...
1
vote
1answer
171 views

Large memcpy operation before possible obfuscation [closed]

I am currently reversing a binary and I am stuck at understanding what the application is trying to do. There is a memcpy operation which is copying almost 1MB from a .data section to a .bss section. ...
1
vote
0answers
171 views

Guidelines for dealing with obfuscated code

I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
1
vote
0answers
61 views

Trying to replicate encryption of an android app

I was trying to replicate/copy the encryption of an android app which uses CryptoJS with sha256 encryption as having seen in the source code of the android app. fingerprinting the app, it was built ...
1
vote
0answers
43 views

Possibly infected image

Long story short I'v downloaded a template for my website and instead of images it has the .html files included, and at the beginning those html files do include PNG IHDR , and they are being loaded ...
1
vote
0answers
82 views

API Hiding Issue

I'm trying to analyze a malware which is hiding API names. When I open it with CFF Explorer, except a few API like GetProcAddress, nothing appears. Basically, I know how API hiding works. I set a ...
1
vote
0answers
218 views

Mysterious chunk of code in IOLI crackme0x06 challenge

I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge. Context But first of all, here is the context : I've successfully cracked the ...
1
vote
0answers
50 views

How to choose a .NET software protector which will have a small impact on run-time performance speed? [closed]

I am writing a .NET software which is doing calculations and drawing in real-time i.e when the user is moving the mouse. I want to protect this software from being reverse engineered and restrict its ...
1
vote
1answer
2k views

Analyzing and deobfuscating complex JS code [duplicate]

I am looking to reverse engineer a very ugly piece of JS found here. As far as I can tell, this script generates and sets some cookies on my browser that identify it on the site. Deobfuscating it ...
1
vote
0answers
459 views

C# Hidden Method through transparent proxy object?

I'm dealing with an interesting form of obfuscation. A C# program I am reversing has a central API, let's call it "Central API". This Central API has several functions that aren't exactly defined. ...
1
vote
0answers
73 views

Missing Map from Java Native Method to C Code

When writing a C implementation for a native Java method in Android, the rule is to name the C function according to the convention "Java_com_...". But I encountered an APK in which there are no such ...
1
vote
1answer
644 views

Map an obfuscated javascript file to the original

Among other approaches, there are ways to "prettify" obfuscated javascript. But most of such approaches are geared towards someone trying to understand code that's not their own (e.g. from a website, ...
1
vote
0answers
1k views

de4dot and Dotfuscator: IL looks different, not DotPeek decompiled code

From the obfuscated to the deobfuscated assemblies, IL code looks different using ILDASM; however, DotPeek decompiled C# code looks exactly the same for both. Any clue why? The obfuscation software ...
1
vote
0answers
105 views

How to hide / obfuscate the function of an IC?

Let's say I have an IC (integrated circuit) and I want to hide it's function. What would be best practice to do that? Removing the markings with sandpaper or acid? (E.g. atmega328, ATtiny85,... ) ...
1
vote
0answers
349 views

Discovering byte array obfuscation function

I'm in the middle of reverse engineering SafeNet (formerly Rainbow) iKey 1000 USB dongle protocol, in order to create Linux driver for it. I'm using Windows as guest in virtual machine on Linux host ...
1
vote
0answers
68 views

Java source code deobfuscator? [duplicate]

Does anyone know of any source code deobfuscator in java? I'm currently writing an obfuscator for java source code and I want to test how well I have made it with an deobfuscator.
1
vote
0answers
80 views

Where to identify and access the main object/closure in a JavaScript web app?

I want to add missing functionality to a web app's front end code JavaScript code. I can find the code in the browser's developer tools by setting breakpoints and stepping through. But in a large ...
0
votes
4answers
3k views

Where to find a hard crackme [closed]

I'd like to improve my skill as a reverse engineer. And thus I am looking for a location to find these.
0
votes
2answers
1k views

What kind of JS obfuscation is this? [closed]

I have read about de-obfuscating JS files and about multi-layered obfuscation. I have come across a file (which I have uploaded here) and it doesn't seem to be obfuscated except for lines 21 and 42. I ...
0
votes
2answers
1k views

Android App's hardcoded local keystore password r3versing

Novice Android security researcher here. Recently I was tasked with the task/challenge of exposing a certain app's hardcoded local keystore password. I've decompiled it with JEB2 and obviously within ...
0
votes
1answer
84 views

How can I reverse this python code (obfuscated by b64, gzip and many more)

How can I Deobfuscate this python code Link to code I tried to replace eval places by print. but it won't work and output is also obfuscated Head of the code looks like this can anyone please help me
0
votes
2answers
1k views

Obfuscating jar already obfuscated [closed]

I'm wondering what happens if we try to run a jar through Proguard that has already been obfuscated by another obfuscator or Proguard itself? Will the obfuscated class names and methods names be ...
0
votes
1answer
151 views

What are the way I can reverse engineer an obfuscated C++ program?

I am reverse engineering an program. I encountered a problem where I can't reverse engineer it as the program code is obfuscated. I realised the program is obfuscated thanks to my friend who noticed ...
0
votes
1answer
722 views

ARM ELF Obfuscation [closed]

Metamorphic is a technique to obfuscate a binary and change the opcode sequence and create new samples with same functionality. In my case, I have some elf binary of ARM processor type and their ...
0
votes
1answer
294 views

How does the different types of executable packing work?

Reference to this thread: What are the different types of packers? Q1: How do packing methods like compression, protection, and encryption work, how do they differ, and which is more secure? Q2: ...
0
votes
1answer
134 views

What do the unusually named packages and files usually mean?

When decompiling an apk with apktool, the classes.dex file is decompiled into folders smali_classes#, and sorted their respective packages. I recognize some of the files, as they are mentioned in ...
0
votes
0answers
47 views

Confusing objdump with data as code

I am trying to confuse objdump to solve the first exercise of chapter 6 in Practical Binary Analysis. Admittedly I am super weak with inline assembler but I made a best-effort attempt and tried to get ...
0
votes
0answers
163 views

How to disassemble an obfuscated .NET DLL?

I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL: Any idea how to unpack it?
0
votes
0answers
44 views

How can I connect basic blocks seperated by unconditional jmps?

I'm analyzing an obfuscated code which splits its code into multiple blocks seperated by many, many unconditional jmps. Here is a picture of what the obfuscation looks like: I wrote an IDAPython ...
0
votes
0answers
43 views

new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?

just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
0
votes
0answers
62 views

how to get rid of this obfuscator?

i somehow know that this is Confuserex but noting working agter many try the file is still unreadable. is there a way to? or im just bad... ps.i unpack this from the exe file that only has PE(maybe ...
0
votes
1answer
134 views

Best way to protect source code of exe that being loaded by Assembly.Load method

I am protecting an exe that being loaded by Assembly.Load... This makes everything difficult because most obfuscators causing it to not work properly or not load at all. I used confuserEx Ameteurz ...
0
votes
1answer
136 views

What is the obfuscation method utilised in Playdead's 'LIMBO' video game?

The game uses Unity3D engine, perhaps with a custom render pipeline. Reports have been made, it is not possible to disassemble it. How did they achieve that?
0
votes
0answers
30 views

Methods to alert inappropriate use of JS code

Let's say we have a JS code library that is not for sale, just internal. Of course, anyone who can access the website will be able to download that and reuse it. To avoid others to reuse that library, ...
0
votes
0answers
42 views

Remapping Branch Instructions After Obfuscation

Recently I've been working on a project. I've already got a hint for a problem that I had here: (Garbage Assembly Code Generationat at random offsets) however, the accepted answer's solution doesn't ...
0
votes
0answers
85 views

How to call strongly encrypted DLL from Resources?

There is a program. This program accepts plugins. Plugins written with C#. I have to encrypt it. But when I use strong obfuscators I have exception. Program doesn't read. How can I fix that ? How can ...
0
votes
1answer
268 views

Error After de4dot - Application Does Not Start

There is an application that has been obfuscation to learn. So in an unpack me style. In the first stage I would unpack with de4dot. After you unpack, the running application stops working. dump and ...
0
votes
0answers
1k views

Obfuscate JSON file that is served client-side

Through some research I have found that obfuscation won't block hackers from retrieving your .json file, but I'd like to have at least a level of obfuscation that deters some people. I ran into a npm ...
0
votes
2answers
1k views

verifyError in youtube android app modification

I try to decompile youtube android application and modify it but when I build the application and install on a virtual device faced with below error: E/AndroidRuntime(1782): java.lang.VerifyError: ...
0
votes
0answers
105 views

Encrypting and packing at functional boundaries for obfuscation

I am interested in software obfuscation techniques. I found your excellent summary of obfuscation in order to avoid (as possible) reverse engineering. One of the proposed technique you quoted: ...
-1
votes
1answer
582 views

De-obfuscate JS code [closed]

I came across a script that converts font files from one type to another (i.e. WOFF to TTF, etc). I would like to understand it and incorporate some of the code into a personal project. The script ...
-2
votes
1answer
15k views

How do I decode this JavaScript code? [duplicate]

Each file starts with the same function: (function(_0x128f83, _0x1ae5b9) { var _0x1b5471 = function(_0x339be5) { while (--_0x339be5) { _0x128f83['push'](_0x128f83['shift']()); ...
-2
votes
1answer
2k views

Trying to decrypt javascript code [duplicate]

Is it possible to deobfuscate/decrypt this javascript code? ;eval(function(w,i,s,e){var lIll=0;var ll1I=0;var Il1l=0;var ll1l=[];var l1lI=[];while(true){if(lIll<5)l1lI.push(w.charAt(lIll));else if(...
-3
votes
1answer
8k views

How to deobfuscated javascript?

How to deobfuscate javascript file, i have a javascript code are deobfuscate . Code: http://pastebin.com/zFH2GidN Help me and thanks you.
-3
votes
1answer
244 views

Trying to deobfuscate multi layered javascript [closed]

Can someone deobfuscate this code? I am not getting any way to deobfuscate this. Unable to paste it over here as it over passed 30,000 word limit. http://pastebin.com/V327Q8Hg Thanks
-6
votes
1answer
605 views

What is Data Interleaving? [closed]

What is data interleaving? Is this something I can use to obfuscate collections of variables?

1 2
3