Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options user 1562

Concealing the nature of how things truly function or work.

5
votes
It's something that their marketing team made up. There is no such "hacker protection factor" rating in the industry.
answered Jun 30 '13 by Jason Geffner
5
votes
Metamorphism wasn't used for obfuscation as much as it was used to defeat static AV signatures. In terms of modern* obfuscation: A custom virtual machine can be a pain to analyze, especially if … it's a custom crafted one (as opposed to something like VMProtect which is more widely studied). Obfuscation that involves code running in the kernel can also be challenging for many reversers, since …
answered Sep 8 '14 by Jason Geffner
2
votes
The blog post to which you linked has incorrect information. 0x004DC8D0 is not the OEP. Rather, 0x0041A4E3 is the OEP. After reaching 0x004DC8D0, right-click on the machine code in the disassembly pa …
answered Mar 6 '16 by Jason Geffner
8
votes
That's not obfuscation, that's just the output of a lousy disassembler engine. Use IDA Pro instead. You can download an evaluation version for Linux from here. …
answered Oct 15 '13 by Jason Geffner
4
votes
You should disable /DEBUG (linker option), which is enabled by default even for Release configurations. Note that although certain compiler/linker options will make reverse engineering your software …
answered Jun 16 '13 by Jason Geffner
1
vote
This would likely fall into the category of "advanced metamorphic malware", though I'm not aware of any real-world malware that automatically changes the order of high-level run-time functionality fro …
answered Jul 27 '16 by Jason Geffner
11
votes
Why limit yourself to static deobfuscation? If you run that script through a JavaScript debugger and break on the return statement, you can see that _0xf81fx1 = function myFunction(){var x=5;return x} …
answered May 26 '13 by Jason Geffner
2
votes
Is there any static opcode usage or number in the assembly of an RC4 encryption? Opcode: Search the disassembly for xor <x>, <y> where <x> != <y>. Number: Search for 0x100 Obviously both …
answered Feb 1 '15 by Jason Geffner