99 votes
Accepted

How do I reverse engineer .so files found in android APKs?

The .so file is a compiled library, in most cases from C or C++ source code. .so stands for Shared Object, it doesn't have anything to do with obfusation, it just means someone wrote parts of the app ...
user avatar
25 votes

How do I reverse engineer .so files found in android APKs?

Besides Guntram's suggestions, check out the retargetable decompiler aka retdec. It can decompile the binary to Python or C code. At least for me, it reads easier than pure assembly (and it works for ...
user avatar
  • 351
24 votes

How to deobfuscate an obfuscated javascript file like this?

There are a few tools that you might try when wanting to analyze JavaScript: JSDetox Malzilla JavaScript Deobfuscator ExtractScript JS-Beautifier JS-Unpack (see also blog) Rhino Debugger Firebug ...
user avatar
  • 18.1k
14 votes

How do I reverse engineer .so files found in android APKs?

You can also try a dynamic approach by hooking APIs and observing arguments and return values. This will allow you to look at data going into crypto APIs, which may help a lot when dealing with ...
user avatar
12 votes

How do I reverse engineer .so files found in android APKs?

Use android-ndk, https://developer.android.com/ndk/downloads/index.html. You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and ...
user avatar
9 votes
Accepted

Protect data stored in binary

I would start with not have critical strings in memory in linear manner Instead each character can be offseted by some offset like by table mixing all the strings together. For example you got ...
user avatar
  • 1,374
9 votes
Accepted

How to deobfuscated javascript?

UPDATE Based on @ws's comment and @nderscore's code, use this JSFiddle to decode the thing. To find the password that this script asks for, you can use a simple debugging trick. Go to JSFuck and ...
user avatar
  • 1,253
8 votes

How are obfuscators detected?

I wouldn't say that obfuscation detection is strictly related to entropy. When I detected obfuscated code areas I did it by simple statistical comparison of probabilities of appearances of specific ...
user avatar
  • 7,720
8 votes

Best way to protect source code of .exe program running on Python?

There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose. ...
user avatar
  • 5,850
7 votes
Accepted

Replacing common x86 instructions with less known ones

I do not think code morphism is the or an answer to this question. What the question was about is obfuscating the algorithm implementation by using less common or undocumented assembly instructions. ...
user avatar
  • 2,603
7 votes

Why doesn't this retn instruction return from the function?

The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is done by pushing the address to the stack and relying on the fact that retn will get what's on the top of ...
user avatar
7 votes
Accepted

Why do obfuscators remove line numbers, and can I safely leave them in?

Stripping line numbers has a minimal impact on the difficulty of reverse engineering code. If it is causing you problems, I would recommend disabling it. Col-E's answer is a red herring because it is ...
user avatar
  • 1,972
6 votes

Determining CRC algorithm (16 bit?) over RS-232

I figured it out! Some of the comments on this web site made me go back and think harder - actually to think differently. I thought that I should post the analysis that I did on these messages to try ...
user avatar
6 votes

What is the reason for this method to call itself?

As others have said, this is for getting current instruction's address. But it's not recommended as it'll hurt performance because it won't return anywhere, causing disagreement of return addresses in ...
user avatar
  • 466
6 votes

What is a good tools to reverse the effects of Minify on JavaScript?

I recently tried http://www.jsnice.org/ on 50+KB of a single minified JavaScript file containing lots of dynamic modification code that Cordova's runtime refused to execute (for an app targeted at ...
user avatar
6 votes

Protect data stored in binary

There are a number of ways to accomplish what you've stated. Generally, more robust techniques, while affording a higher level of protection, will also put more burden on the programmer creating the ...
user avatar
  • 2,416
6 votes
Accepted

Is there a name for this kind of "obfuscation" for the machine code from C++?

Unfortunately it is not enough code to say exactly what it is, but, as @0xec said, it looks very much like control flow flattening. Usually such kind of code transformations are done automatically ...
user avatar
  • 7,720
5 votes

Computer Malware: More complex than metamorphic?

Metamorphism wasn't used for obfuscation as much as it was used to defeat static AV signatures. In terms of modern* obfuscation: A custom virtual machine can be a pain to analyze, especially if it's ...
user avatar
5 votes

Writeup of reverse engineering VM based obfuscation

Here is a pretty old challenge with, among other stuff, a VM in the end. You have both the write-ups of many candidates, and the official write-up of the author, with explanations as how to do such VM-...
user avatar
  • 565
5 votes
Accepted

AirPlay Mirroring decryption (FairPlay)

I have spent some time to look into Apple's airplay mirroring support, which is encrypted by fairplay protocol. After investigating serveral existing commercial applications I have finally managed to ...
user avatar
  • 66
5 votes
Accepted

How to obfuscate x86 assembly code?

You should not confuse "code protection" and "code obfuscation". "Code protection" techniques target in recognizing code modifications (you mention a checksum) and take suitable means like crashing or ...
user avatar
  • 1,814
5 votes
Accepted

Obfuscated code analysis - can unused variables be ignored?

This might be true that those variables are added only to confuse analysis but remember that in Javascript there are so many ways to access the variable that I would take such info from an automated ...
user avatar
5 votes

Trace Method Calls in .NET/C# Binary

that instrumentation is not easily possible because of JIT compilation of IL instructions. Well it's actually the opposite. Tracing methods is quite easy - it would be difficult if we would like to ...
user avatar
5 votes
Accepted

Stack-pointer analysis failed

When I assembled the code, the offending instruction was: 0x6c 40 ff d1 call rcx You will need to use Change Stack Pointer command in IDA to fix this in disassembly. As ...
user avatar
4 votes

Which virtualized target is recommended for newbie on vm-obfuscation?

You should take a look at crackmes.de, especially level 6, like this one, or this one.
user avatar
  • 2,486
4 votes
Accepted

How to start learning reverse engineering to eventually help exploiting of modern consoles like Xbox One, PS4?

Some things you will inevitably have to know at some degree to be able to reverse engineer Game Consoles: Learn a lower level language such as C or C++. Most, if not all, Console games, modern and ...
user avatar
  • 158
4 votes

How does PeID calculate entropy?

This is exactly a problem I dealt with several years ago because we also wanted to implement a close-as-possible solution for a project formerly based on PeID. Fortunately, in those days I found an ...
user avatar
  • 51
4 votes

Any good deobfuscators for java?

Proguard's "optimisation" stage results in deobfuscating junk as I wrote up here - http://www.surrendercontrol.com/2016/03/using-proguard-to-deobfuscate-code.html. Also, Caleb Fention's Simplify ...
user avatar
4 votes
Accepted

Distribution of malware obfuscation types

Unfortunately it seems so that there are no existing publications/statistics from av vendors. Reffered to [A] and the mentioned entropy analysis, 90% of the used samples are obfuscated by a ...
user avatar
  • 1,227
4 votes

Is there a name for this kind of "obfuscation" for the machine code from C++?

Here's a blog post describing this technique in a little more detail as well as some hints on how to undo it: https://blog.quarkslab.com/deobfuscation-recovering-an-ollvm-protected-program.html EDIT ...
user avatar
  • 34.7k

Only top scored, non community-wiki answers of a minimum length are eligible