99 votes
Accepted

How do I reverse engineer .so files found in android APKs?

The .so file is a compiled library, in most cases from C or C++ source code. .so stands for Shared Object, it doesn't have anything to do with obfusation, it just means someone wrote parts of the app ...
user avatar
25 votes

How do I reverse engineer .so files found in android APKs?

Besides Guntram's suggestions, check out the retargetable decompiler aka retdec. It can decompile the binary to Python or C code. At least for me, it reads easier than pure assembly (and it works for ...
user avatar
  • 351
24 votes

How to deobfuscate an obfuscated javascript file like this?

There are a few tools that you might try when wanting to analyze JavaScript: JSDetox Malzilla JavaScript Deobfuscator ExtractScript JS-Beautifier JS-Unpack (see also blog) Rhino Debugger Firebug ...
user avatar
  • 18.1k
19 votes

What is a good Java decompiler and deobfuscator?

Old and Lacking Entries JAD Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to ...
17 votes
Accepted

How can I decode this php code?

I wrote a small Python script to deobfuscate the majority of the string obfuscation: import urllib import re php = urllib.urlopen("http://pastebin.com/raw.php?i=wVs8w44v").read() # Slight ...
user avatar
14 votes

How do I reverse engineer .so files found in android APKs?

You can also try a dynamic approach by hooking APIs and observing arguments and return values. This will allow you to look at data going into crypto APIs, which may help a lot when dealing with ...
user avatar
13 votes
Accepted

Guessing CRC checksum algorithm

Got it. Here's how to calculate, using your first string as a simple example: 1f456e01 First, we rearrange the packet, omitting the checksum. 1f 01 Then prepend the values A3 02: a3 02 1f 01 ...
user avatar
  • 2,416
12 votes

How do I reverse engineer .so files found in android APKs?

Use android-ndk, https://developer.android.com/ndk/downloads/index.html. You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and ...
user avatar
8 votes

Guessing CRC checksum algorithm

I'd assume the first byte is a message type ID, the 2nd and 3rd bytes are checksum, and the rest is payload. As the game is probably an i386 game, the payload ought to be little-endian. Now, if we ...
user avatar
7 votes

Guessing CRC checksum algorithm

The checksum is very simple, as can be seen from the minimal difference in checksum between 11111111111111111111111111111 and 11111111111111111111111111112, the difference is 0x21 (33 in decimal). ...
user avatar
  • 425
7 votes
Accepted

Extracting classes from running JVM

I would recommend using a Java Agent to extract classes from the running JVM instance. An agent is a tool that provides instrumentation capability for an application. Speaking of agents, there are two ...
user avatar
  • 5,850
6 votes

Need help in figuring out checksum used in this small wireless packet

(I don't have quite enough reputation for a comment so please excuse a very partial answer.) You need to consider whether some of the bits are not part of the packet data but part of an encoding for ...
user avatar
  • 2,164
5 votes

What kind of obfuscate is this?

This is definitely one of the naming schemes from Crypto Obfuscator. As listed on their features page: Fake Renaming Scheme Crypto Obfuscator also has a renaming mode which renames all ...
user avatar
  • 151
5 votes

What is a good Java decompiler and deobfuscator?

Try taking a look at Bytecode Viewer https://github.com/Konloch/bytecode-viewer It has the option to decompile using 5 different decompilers: FernFlower Procyon CFR Krakatau JD-GUI
5 votes
Accepted

What kind of compression/obfuscation algorithm is this?

The gzip headers are valid, but the deflate compressed data format is violated almost immediately, within less than ten bytes in for all of the files. For all of the example files provided, the first ...
user avatar
5 votes

Animal Crossing: Pocket Camp .zdat File

The file does not appear to be obfuscated or encrypted in any way. The header appears to be trivial. I have included a description of the header for the .zdata you posted. The .unity3d files contained ...
user avatar
  • 326
5 votes
Accepted

Obfuscated code analysis - can unused variables be ignored?

This might be true that those variables are added only to confuse analysis but remember that in Javascript there are so many ways to access the variable that I would take such info from an automated ...
user avatar
5 votes
Accepted

How can I deobfuscate this javascript code

The special "accent" letters are just a distraction. You can use a text-editor to replace them with "standard" letters and the code would still work. Let's add a newline after each semicolon: É=-~-~[...
user avatar
  • 469
4 votes

Analyzing highly obfuscated JavaScript

In addition to the other useful links here, I recommend to try Malware-Jail Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js malware-...
user avatar
  • 183
4 votes
Accepted

IDA PRO Hex-Rays 1.5 pseudo code understanding -=0x3FFFFFFFu; += 0x3FFFFFFFu;

I think it should look like this I am 99.9% feel it's a element shifter something tells me that 0x3FFFFFFF is max bounds of a array so it's some compiler thing that it appends to make sure it gets the ...
user avatar
  • 729
4 votes

Protect a key from being recovered by decompilation

Here are some thoughts on the fundamental problem and a possible solution; even if the full system goes way beyond your dev budget, some key ideas might still be useful for fashioning your own ...
user avatar
  • 1,960
4 votes

Any good deobfuscators for java?

Proguard's "optimisation" stage results in deobfuscating junk as I wrote up here - http://www.surrendercontrol.com/2016/03/using-proguard-to-deobfuscate-code.html. Also, Caleb Fention's Simplify ...
user avatar
4 votes
Accepted

How to get address where MakeFunction() failed in IDA Pro

Solution: find_func_bounds() does the trick (see SDK documentation). That's how it works: pfn = func_t() find_func_bounds(ea, pfn, FIND_FUNC_NORMAL) pfn.endEA If the return value of ...
user avatar
  • 61
4 votes

Extracting classes from running JVM

You can dump bytecode at runtime using HotSpot tools, and use a decompiler to reverse the bytecode. I made a proof of concept, available here It requires 3 dependencies: JDK libraries (sa-jdi.jar, ...
user avatar
4 votes

How to deobfuscate native Android library obfuscated with OLLVM?

You're in luck; I wrote an article about that last year. I didn't know at the time that the obfuscator in question was Obfuscator-LLVM, but indeed, it was (albeit a version that was integrated into ...
user avatar
  • 7,814
4 votes

Obfuscated VBE malware script analysis

This script is mostly obfuscated through renaming of variables and function names. I recommend using a tool such as Visual Studio Code Where you can right click the variable or function and select ...
user avatar
4 votes

Dealing with obfuscated PUSH PUSH RET instructions

The RET instruction transfers control to the return address located on the stack. Normally this is used to go back from a function to where the function was called, as the address of the next ...
user avatar
3 votes
Accepted

Deobfuscating IDA Pseudocode

IDA Pro is no magic tool to automatically decompile binaries to their source code. The decompiler output should not be relied every time (as compiling leads to loss of information) although IDA boasts ...
user avatar
  • 5,850
3 votes
Accepted

Deobfuscating a javascript file

Well, so, you can use http://jsbeautifier.org/ with unescape printable chars to get the top var decoded, then, if you look closely, you should see that the values of the var are used everywhere with ...
user avatar
  • 586
3 votes

How do I reverse engineer .so files found in android APKs?

You can also reverse-engineer APK files directly on an android device. Java part: Show Java .so files: Android disassembler. (Disclaimer: I 'm the developer) Version 1.4.2 release. Android-...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible