Skip to main content
19 votes

What is a good Java decompiler and deobfuscator?

Old and Lacking Entries JAD Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to ...
12 votes

How do I reverse-engineer .so files found in Android APKs?

Use android-ndk, https://developer.android.com/ndk/downloads/index.html. You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and ...
Shailesh Mota's user avatar
8 votes
Accepted

Extracting classes from running JVM

I would recommend using a Java Agent to extract classes from the running JVM instance. An agent is a tool that provides instrumentation capability for an application. Speaking of agents, there are two ...
0xec's user avatar
  • 6,090
6 votes

How do I reverse-engineer .so files found in Android APKs?

You can also reverse-engineer APK files directly on an android device. Java part: Show Java .so files: Android disassembler. (Disclaimer: I 'm the developer) Version 1.4.2 release. Android-...
Hyeonseo Yang's user avatar
6 votes
Accepted

How can I deobfuscate this javascript code

The special "accent" letters are just a distraction. You can use a text-editor to replace them with "standard" letters and the code would still work. Let's add a newline after each semicolon: É=-~-~[...
Dvd848's user avatar
  • 559
6 votes

i need software to decode this subtitle xml file, anyone know what it encodes with?

It's AES encrypted, but fortunately it's pretty trivial to see what's going on in the JavaScript file responsible for decoding (https://www.gohitv.com/series/js/hiplayer.min.js) by using browser ...
user7290573's user avatar
5 votes

Animal Crossing: Pocket Camp .zdat File

The file does not appear to be obfuscated or encrypted in any way. The header appears to be trivial. I have included a description of the header for the .zdata you posted. The .unity3d files contained ...
TkTech's user avatar
  • 326
5 votes

Extracting classes from running JVM

You can dump bytecode at runtime using HotSpot tools, and use a decompiler to reverse the bytecode. I made a proof of concept, available here It requires 3 dependencies: JDK libraries (sa-jdi.jar, ...
georges abitbol's user avatar
5 votes

Analyzing highly obfuscated JavaScript

In addition to the other useful links here, I recommend to try Malware-Jail Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js malware-...
api pota's user avatar
  • 193
5 votes
Accepted

Obfuscated code analysis - can unused variables be ignored?

This might be true that those variables are added only to confuse analysis but remember that in Javascript there are so many ways to access the variable that I would take such info from an automated ...
Paweł Łukasik's user avatar
4 votes
Accepted

How to get address where MakeFunction() failed in IDA Pro

Solution: find_func_bounds() does the trick (see SDK documentation). That's how it works: pfn = func_t() find_func_bounds(ea, pfn, FIND_FUNC_NORMAL) pfn.endEA If the return value of ...
nebu's user avatar
  • 61
4 votes

How do I reverse-engineer .so files found in Android APKs?

You can also try the Snowman tool: https://derevenets.com/. NB: the original author appears to have "pulled" it. Several forks exist, e.g. this one not connected to original) or these. ...
Adrian Paul's user avatar
4 votes

How to deobfuscate native Android library obfuscated with OLLVM?

You're in luck; I wrote an article about that last year. I didn't know at the time that the obfuscator in question was Obfuscator-LLVM, but indeed, it was (albeit a version that was integrated into ...
Rolf Rolles's user avatar
  • 9,198
4 votes
Accepted

Dealing with heavily obfuscated Java, possibly on bytecode level

First off, you should never use javap when dealing with obfuscated applications, because javap is not designed to handle malicious bytecode, and can easily be thwarted in a number of ways. Luckily, ...
Antimony's user avatar
  • 2,012
4 votes

Obfuscated VBE malware script analysis

This script is mostly obfuscated through renaming of variables and function names. I recommend using a tool such as Visual Studio Code Where you can right click the variable or function and select ...
chentiangemalc's user avatar
4 votes

Dealing with obfuscated PUSH PUSH RET instructions

The RET instruction transfers control to the return address located on the stack. Normally this is used to go back from a function to where the function was called, as the address of the next ...
Ana María Martínez Gómez's user avatar
3 votes
Accepted

Decompiling and deobfuscating APK file

Yes, this is indeed possible. IDA Pro, starting from version 6.6 supports source code level debugging for Dalvik Bytecode. You can find more details here: https://www.hex-rays.com/products/ida/...
c0d3inj3cT's user avatar
3 votes

What is a good Java decompiler and deobfuscator?

I'm using https://github.com/JetBrains/intellij-community/tree/master/plugins/java-decompiler/engine It's the decompiler from IntelliJ, it decompile codes where JD-GUI fail. It's a unofficial mirror ...
3 votes
Accepted

How decrypt hexadecimal javascript code?

Those hex values could represent anything. Look for online converters that convert hexadecimal to text (consider various formats), dec, etc. and see if the results make any sense. If not, then they ...
dsasmblr's user avatar
  • 2,234
3 votes
Accepted

Is deobfuscation of my javascript code hard or easy?

Resolved. generally nothing in js is impossible to reverse in this case the 'alert' string in plain text give me a big help, because I simply started to resolve function value one step back at time. ...
realtebo's user avatar
  • 183
3 votes

(de4dot) The file isn't a .NET PE file

As a programmer myself, I have to again and again tell and shout, that if the purpose is cracking/stealing, then you should not do that for the sake of honesty. If the purpose is good, then I'll share ...
T.Todua's user avatar
  • 643
3 votes

What's this obfuscation technique?

I could be wrong, but it looks like VMProtect v3. For this version, this obfuscator inlines all handlers, so that's normal you don't find any dispatcher.
wisk's user avatar
  • 1,154
3 votes
Accepted

Is it possible to completely reverse this code?

Having such code the first thing to do is to analyze what part is the obfuscation algorithm and what's the actual code. Here' it's not that difficult as all the code is on top. So let's analyze it ...
Paweł Łukasik's user avatar
3 votes
Accepted

Virtual machine code obfuscation implementation details

You will need to go through each of the over 200 instructions, and figure out how to do the "same" thing in your instruction set. So you'll need to see how the stack may be changing, the stack pointer,...
auspicious99's user avatar
3 votes

Virtual machine code obfuscation implementation details

If you want proof-of-concept VM based obfuscator, you can actually skip the virtualization step and bytecode generation step. You can write an interpreter of x86 instructions in x86 assembler so that ...
MazeGen's user avatar
  • 143
3 votes

How can I extract the password from an installer/self-extracting archive?

Well, you need to analyze the installer for the password. This usually involves decompiling. Static analysis is a good place to start. You may find the password stored as a string in the installer or ...
Nick's user avatar
  • 31
2 votes

Try to deobfuscate multi layered javascript

You could try using de4js. For the javascript snippet in the original post, de4js produces the following output: var _0x2815 = ["3 1(){2 0=5;4 0}", "|", "split", "x|myFunction|var|function|return|", "...
user29581's user avatar
2 votes

How do I reverse-engineer .so files found in Android APKs?

You can try Ghidra. Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-...
SafariBest's user avatar
2 votes

How to call an item of a Javascript array?

The variable _0xe984 in your example is an array of strings, therefore, calling it with _0xe984("0xa") is actually to call as if it was a function that gets the string "0xa" as a parameter. Thus, the ...
Megabeets's user avatar
  • 8,999
2 votes

how to deobfuscate Autoit strings?

The function STRINGDEC isn't a built-in autoit function. It was implemented by the programmer to create some sort of Substitution cipher. You can see the source code of the function at the bottom of ...
Megabeets's user avatar
  • 8,999

Only top scored, non community-wiki answers of a minimum length are eligible