92

The .so file is a compiled library, in most cases from C or C++ source code. .so stands for Shared Object, it doesn't have anything to do with obfusation, it just means someone wrote parts of the app in C. In some cases, there is existing C code and it's just easier for the programmer to build a JNI interface to call the library from java; in other cases, ...


24

Besides Guntram's suggestions, check out the retargetable decompiler aka retdec. It can decompile the binary to Python or C code. At least for me, it reads easier than pure assembly (and it works for ARM binaries). It works very well for sketching you the rough workings of the shared object. A plugin for select IDA versions exists, but the main limitation ...


24

There are a few tools that you might try when wanting to analyze JavaScript: JSDetox Malzilla JavaScript Deobfuscator ExtractScript JS-Beautifier JS-Unpack (see also blog) Rhino Debugger Firebug SpiderMonkey V8 JSNice PoisonJS See also a few tutorials on analyzing obfuscated JavaScript: Analyzing Malicious JavaScript by Dejan Lukan. Advanced obfuscated ...


17

Old and Lacking Entries JAD Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to it. Java DeObfuscator Also an older tool from fileoffset.com, but still works more or less. The interface is rather clunky to use for larger projects, but the ...


16

I wrote a small Python script to deobfuscate the majority of the string obfuscation: import urllib import re php = urllib.urlopen("http://pastebin.com/raw.php?i=wVs8w44v").read() # Slight modification below so that we don't escape $ z26 = "jmiO@sxhFnD>J\r/u+RcHz3}g\nd{^8 ?eVwl_T\\\t|N5q)LobU]40!p%,rC-97k<'y=W:P$1BI&S6\"E(K`Y~.Q;f[v2a#X*ZAGtM" # ...


12

Got it. Here's how to calculate, using your first string as a simple example: 1f456e01 First, we rearrange the packet, omitting the checksum. 1f 01 Then prepend the values A3 02: a3 02 1f 01 Then calculate the checksum by starting with a sum of 0, multiplying the sum by 33 (decimal) each time and adding the value of the next byte. Here it is in C ...


12

You can also try a dynamic approach by hooking APIs and observing arguments and return values. This will allow you to look at data going into crypto APIs, which may help a lot when dealing with network protocols. Check out the Frida instrumentation toolkit for an open source cross-platform solution (Android, iOS, Windows, Mac and Linux). There's a tutorial ...


11

Use android-ndk, https://developer.android.com/ndk/downloads/index.html. You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and get a .so library out of it, I will do : ./android-ndk-r15b/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-objdump -T "...


7

I'd assume the first byte is a message type ID, the 2nd and 3rd bytes are checksum, and the rest is payload. As the game is probably an i386 game, the payload ought to be little-endian. Now, if we compare your first 4 examples, with bytes 2 and 3 written as a 16-bit-int, we have: 1f 6e45 01 1f 6e46 02 1f 6e49 05 1f 6e4b 07 1f 6e4c 08 in these cases the ...


7

You can give a try to binwalk. This tool is able to do a wild guess about the encryption/compression routine used, with the -BE option.


6

Z3 is an SMT solver. Its job is to decide the satisfiability of formulas passed in by a user, where the formulas may mix terms from the various theories that Z3 supports. Coincidentally, in order to make its own job easier by producing a "simpler" formula than the one passed in by the user, it implements a simplifier which is not very sophisticated ...


6

The checksum is very simple, as can be seen from the minimal difference in checksum between 11111111111111111111111111111 and 11111111111111111111111111112, the difference is 0x21 (33 in decimal). Then, difference between 11111111111111111111111111121 and 11111111111111111111111111111 is 0x441, that is 0x21^2. The checksum (I'll call it y) is clearly a ...


6

I would recommend using a Java Agent to extract classes from the running JVM instance. An agent is a tool that provides instrumentation capability for an application. Speaking of agents, there are two broad ways they can be developed: In pure java In C/C++ in the form of native agents. A native agent has more capability than a pure Java agent, but for ...


5

(I don't have quite enough reputation for a comment so please excuse a very partial answer.) You need to consider whether some of the bits are not part of the packet data but part of an encoding for transmission. e.g. the 1's at regularly spaced bit positions 8, 17, 26, 35 could well be there to prevent a run of 0's getting too long. (Knowing the ...


5

Try taking a look at Bytecode Viewer https://github.com/Konloch/bytecode-viewer It has the option to decompile using 5 different decompilers: FernFlower Procyon CFR Krakatau JD-GUI


5

This is definitely one of the naming schemes from Crypto Obfuscator. As listed on their features page: Fake Renaming Scheme Crypto Obfuscator also has a renaming mode which renames all classes, fields, methods, etc to fake but realistic names like Domain/Log/Stream/etc (for classes) or Open/Close/Clear/Delete/etc for methods and so on. This makes it ...


5

The gzip headers are valid, but the deflate compressed data format is violated almost immediately, within less than ten bytes in for all of the files. For all of the example files provided, the first deflate block is a dynamic block which has an oversubscribed code lengths code. That means that a Huffman code required to decode the code lengths for that ...


5

The file does not appear to be obfuscated or encrypted in any way. The header appears to be trivial. I have included a description of the header for the .zdata you posted. The .unity3d files contained within are the typical Unit3d webpack files. You can google around for a depacker for those, there are several.


5

This might be true that those variables are added only to confuse analysis but remember that in Javascript there are so many ways to access the variable that I would take such info from an automated tool with a little grain of salt. It might be true but it also might be that this code uses non-direct access to those 82 variables. Having such code: re = '...


4

In addition to the other useful links here, I recommend to try Malware-Jail Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js malware-jail is written for Node's 'vm' sandbox. Currently implements WScript (Windows Scripting Host) context env/wscript.js, at least the part frequently used by ...


4

I think it should look like this I am 99.9% feel it's a element shifter something tells me that 0x3FFFFFFF is max bounds of a array so it's some compiler thing that it appends to make sure it gets the end of the array. I was wrong 0x3FFFFFFF is used to create signed numbers to emulate subtracting by adding. See comment by DCoder if ( ZonePlayerCount > ...


4

Here are some thoughts on the fundamental problem and a possible solution; even if the full system goes way beyond your dev budget, some key ideas might still be useful for fashioning your own solution. Crypto is of little use if you don't have the leverage that makes the crypto algorithm itself the weakest link in the system, just like a ten-inch steel ...


4

Proguard's "optimisation" stage results in deobfuscating junk as I wrote up here - http://www.surrendercontrol.com/2016/03/using-proguard-to-deobfuscate-code.html. Also, Caleb Fention's Simplify engine has a bunch of very nice ideas and implements them for Dalvik code, if not straight for JVM - https://github.com/CalebFenton/simplify


4

Solution: find_func_bounds() does the trick (see SDK documentation). That's how it works: pfn = func_t() find_func_bounds(ea, pfn, FIND_FUNC_NORMAL) pfn.endEA If the return value of find_func_bounds() is FIND_FUNC_UNDEF (0), pfn.endEA contains the address where it encountered unexplored bytes.


4

You can dump bytecode at runtime using HotSpot tools, and use a decompiler to reverse the bytecode. I made a proof of concept, available here It requires 3 dependencies: JDK libraries (sa-jdi.jar, tools.jar) to dump bytecode Fernflower to decompile bytecode into java code RSyntaxTextArea to display java source code You could also have a look at the HSDB ...


4

You're in luck; I wrote an article about that last year. I didn't know at the time that the obfuscator in question was Obfuscator-LLVM, but indeed, it was (albeit a version that was integrated into the MSVC toolchain). I even published full source code.


4

This script is mostly obfuscated through renaming of variables and function names. I recommend using a tool such as Visual Studio Code Where you can right click the variable or function and select option "Rename all occurrences" and give everything human readable name. You can search for how a variable or function is generally used and give it a name based ...


4

The RET instruction transfers control to the return address located on the stack. Normally this is used to go back from a function to where the function was called, as the address of the next instruction was pushed into the stack by the CALL instruction. However, RET can be misused: a PUSH before a RET instruction is a typical obfuscation technique. In this ...


3

IDA Pro is no magic tool to automatically decompile binaries to their source code. The decompiler output should not be relied every time (as compiling leads to loss of information) although IDA boasts of the finest decompiler available. Instead focus on the disassembly listing. For specific parts, you can use the decompiler output as your reference. ...


3

You can also try the Snowman tool: https://derevenets.com/. Snowman is a native code to C/C++ decompiler It supports ARM, x86, and x86-64 architectures as specified on their website.


Only top voted, non community-wiki answers of a minimum length are eligible