78

The .so file is a compiled library, in most cases from C or C++ source code. .so stands for Shared Object, it doesn't have anything to do with obfusation, it just means someone wrote parts of the app in C. In some cases, there is existing C code and it's just easier for the programmer to build a JNI interface to call the library from java; in other cases, ...


36

I am the author of JSDetox, thanks to Jurriaan Bremer for mentioning it! As already said every obfuscation scheme is different. JSDetox does not try to deobfuscate everything automatically - the main purpose is to support manual analysis. It has two main features: static analysis tries to optimize code that is "bloated up", e.g. statements like var x = -~-...


32

My apologies for the belated reply. I have been working on a new, open source Java decompiler. Feel free to check it out.I have not tested it against any obfuscated code, but I have seen it decompile many methods that JD-GUI failed to handle. Note that it's a work in progress, and I'm sure you will find plenty of code that it will fail to decompile.


28

The paper Static Analysis of x86 Executables explains overlapping instructions quite well. The following example is taken from it (page 28): 0000: B8 00 03 C1 BB mov eax, 0xBBC10300 0005: B9 00 00 00 05 mov ecx, 0x05000000 000A: 03 C1 add eax, ecx 000C: EB F4 jmp $-10 000E: 03 C3 add eax, ebx 0010: C3 ret By ...


21

There are a few tools that you might try when wanting to analyze JavaScript: JSDetox Malzilla JavaScript Deobfuscator ExtractScript JS-Beautifier JS-Unpack (see also blog) Rhino Debugger Firebug SpiderMonkey V8 JSNice PoisonJS See also a few tutorials on analyzing obfuscated JavaScript: Analyzing Malicious JavaScript by Dejan Lukan. Advanced obfuscated ...


20

Besides Guntram's suggestions, check out the retargetable decompiler aka retdec. It can decompile the binary to Python or C code. At least for me, it reads easier than pure assembly (and it works for ARM binaries). It works very well for sketching you the rough workings of the shared object. A plugin for select IDA versions exists, but the main limitation ...


17

I'm a fan of Malzilla and its embedded SpiderMonkey JS engine which allows you to decode malicious javascript. Here's a tutorial using Malzilla to decode a LuckySploit attack. You can download the pre-built binary for Malzilla on SourceForge, here.


16

It's also known as the 'jump in the middle' trick. explanation execution rules most instructions take more than one byte to be encoded they can take up to 15 bytes on modern CPUs execution can start at any position as long as permissions are valid so any byte following the first one of an instruction can be re-used to start another instruction. ...


15

Using Malzilla, I was able to de-obfuscate this in ~30 seconds. Step 1, open Malzilla, select the Decoder tab, and paste the JavaScript. Step 2, you can optionally press the "Format Code" button to get a rudimentary re-formatting of the JS. Step 3, check Override eval(), and click the Run script button. You'll notice that in the output box, the de-...


14

Old and Lacking Entries JAD Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to it. Java DeObfuscator Also an older tool from fileoffset.com, but still works more or less. The interface is rather clunky to use for larger projects, but the ...


14

I wrote a small Python script to deobfuscate the majority of the string obfuscation: import urllib import re php = urllib.urlopen("http://pastebin.com/raw.php?i=wVs8w44v").read() # Slight modification below so that we don't escape $ z26 = "jmiO@sxhFnD>J\r/u+RcHz3}g\nd{^8 ?eVwl_T\\\t|N5q)LobU]40!p%,rC-97k<'y=W:P$1BI&S6\"E(K`Y~.Q;f[v2a#X*ZAGtM" # ...


12

You can also try a dynamic approach by hooking APIs and observing arguments and return values. This will allow you to look at data going into crypto APIs, which may help a lot when dealing with network protocols. Check out the Frida instrumentation toolkit for an open source cross-platform solution (Android, iOS, Windows, Mac and Linux). There's a tutorial ...


11

Why limit yourself to static deobfuscation? If you run that script through a JavaScript debugger and break on the return statement, you can see that _0xf81fx1 = function myFunction(){var x=5;return x}, which was the plain-text of the function before it was obfuscated. Furthermore, if you run it through http://jsbeautifier.org, the last line of the output is:...


11

Your best bet is to use an environment (eg FireFox) in which eval() can be overridden by using a proxy function, and the function just prints the output. That way, there is no risk in missing anything, even if the malware aliases it. Unfortunately, eval() is not designed to be overridden (and I believe is explicitly forbidden by recent ECMAScript spec), ...


11

Got it. Here's how to calculate, using your first string as a simple example: 1f456e01 First, we rearrange the packet, omitting the checksum. 1f 01 Then prepend the values A3 02: a3 02 1f 01 Then calculate the checksum by starting with a sum of 0, multiplying the sum by 33 (decimal) each time and adding the value of the next byte. Here it is in C ...


10

I can't speak to which one of these is the best, but there are a few java decompilers out there as indicated by this SO question. None of these decompilers appear to attempt to actively handle obfuscation though and many of those projects are abandoned. I have not tried Krakatau, but it sounds like it may help with what you are looking for. From the readme:...


8

Almost any multi-byte instruction can be used as an overlapping instruction in x86/x86_64. The reason is very easy: x86 and x86_64 instruction sets are CISC. Which means, among other things, that the instructions doesn't have a fixed length. So, as the instruction are variable length, carefully writing that machine code, every instruction is susceptible of ...


8

jsbeautifier.org is not the source for JS deobfuscation, actually. See this question for more details Analyzing highly obfuscated JavaScript After multiple de-obfuscations, it seems that code behind is: //eval function myFunction(){var x=5;return x} http://jsunpack.jeek.org/?report=24921f4d96d1e05abfc0affd2233bd69874056c9


8

Well, after online tools, You may use Revelo by KahuSecurity http://www.kahusecurity.com/tools/Revelo_v0.5.1.zip It's have less automation in process, but more powerful in de-obfuscation of customized js. Documentation is included in ZIP, you also may see examples of it's usage in Kahu blog as well: http://www.kahusecurity.com/ p.s. don't forget to use VM!


8

Use android-ndk, https://developer.android.com/ndk/downloads/index.html. You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and get a .so library out of it, I will do : ./android-ndk-r15b/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-objdump -T "...


7

You might be lucky trying either JSDetox, http://www.relentless-coding.com/projects/jsdetox, which is an automated javascript+html unpacker in Ruby, or my own library which is work-in-progress and only supports javascript (but does a bit more than JSDetox), https://github.com/jbremer/jsunpck. For JSDetox you can give the html as input through the ...


7

You can give a try to binwalk. This tool is able to do a wild guess about the encryption/compression routine used, with the -BE option.


7

I just stumbled on this project ERESI. The project itself looks quite ambitious and supports mainly Intel and Sparc processors with some support for others. There are lots of tools as well that might come in handy. It does have one specific tool that sounds like if fits the bill exactly and quite a few others that are related: Evarista: A work-in-...


7

I'd assume the first byte is a message type ID, the 2nd and 3rd bytes are checksum, and the rest is payload. As the game is probably an i386 game, the payload ought to be little-endian. Now, if we compare your first 4 examples, with bytes 2 and 3 written as a 16-bit-int, we have: 1f 6e45 01 1f 6e46 02 1f 6e49 05 1f 6e4b 07 1f 6e4c 08 in these cases the ...


6

I think your best bet will be to take a low level ELF library and write a small program to do what you want. I like the ELF Toolchain Project. I've found the tests and documentation that the team puts together to be pretty good. Regardless of what tool you end up using, you definitely want to read A Whirlwind Tutorial on Creating Really Teensy ELF ...


6

Any obfuscation technique (or its formalization) targets one or more assumptions made by some class of analyses A -- in essence, the obfuscation transforms a program P0 into a different representation P1 that has the same execution behavior as P0 but which violates the assumptions made by the analyses A. In doing so, the obfuscation necessarily defines a ...


6

Well, personally i would either use JSDetox (http://relentless-coding.org/projects/jsdetox) if i'm feeling lazy to analyse it manually. It's probably one of the better tools out there.


6

Z3 is an SMT solver. Its job is to decide the satisfiability of formulas passed in by a user, where the formulas may mix terms from the various theories that Z3 supports. Coincidentally, in order to make its own job easier by producing a "simpler" formula than the one passed in by the user, it implements a simplifier which is not very sophisticated ...


6

The checksum is very simple, as can be seen from the minimal difference in checksum between 11111111111111111111111111111 and 11111111111111111111111111112, the difference is 0x21 (33 in decimal). Then, difference between 11111111111111111111111111121 and 11111111111111111111111111111 is 0x441, that is 0x21^2. The checksum (I'll call it y) is clearly a ...


6

The file does not appear to be obfuscated or encrypted in any way. The header appears to be trivial. I have included a description of the header for the .zdata you posted. The .unity3d files contained within are the typical Unit3d webpack files. You can google around for a depacker for those, there are several.


Only top voted, non community-wiki answers of a minimum length are eligible