96
The .so file is a compiled library, in most cases from C or C++ source code. .so stands for Shared Object, it doesn't have anything to do with obfusation, it just means someone wrote parts of the app in C.
In some cases, there is existing C code and it's just easier for the programmer to build a JNI interface to call the library from java; in other cases, ...
25
Besides Guntram's suggestions, check out the retargetable decompiler aka retdec. It can decompile the binary to Python or C code. At least for me, it reads easier than pure assembly (and it works for ARM binaries).
It works very well for sketching you the rough workings of the shared object.
A plugin for select IDA versions exists, but the main limitation ...
24
There are a few tools that you might try when wanting to analyze JavaScript:
JSDetox
Malzilla
JavaScript Deobfuscator
ExtractScript
JS-Beautifier
JS-Unpack (see also blog)
Rhino Debugger
Firebug
SpiderMonkey
V8
JSNice
PoisonJS
See also a few tutorials on analyzing obfuscated JavaScript:
Analyzing Malicious JavaScript by Dejan Lukan.
Advanced obfuscated ...
16
These techniques of mutating code (and still keeping it semantically equivalent) are known as polymorphic code.
The software that can achieve a mutations of the code is usually called a polymorphic engine. It is a quite widely used technique in Malware design to evade pattern-matching detection of the anti-virus software.
With these key words in hand (and ...
13
You can also try a dynamic approach by hooking APIs and observing arguments and return values. This will allow you to look at data going into crypto APIs, which may help a lot when dealing with network protocols. Check out the Frida instrumentation toolkit for an open source cross-platform solution (Android, iOS, Windows, Mac and Linux). There's a tutorial ...
12
Use android-ndk, https://developer.android.com/ndk/downloads/index.html.
You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and get a .so library out of it, I will do :
./android-ndk-r15b/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-objdump -T "...
9
Most tools don't support a 'ignore that byte for disassembly' feature, only IDA, Hopper and a few others do.
The only alternative is to patch the byte at 8049444 with a 90 NOP, or change your mind and not rely on basic tools.
9
I would start with not have critical strings in memory in linear manner
Instead each character can be offseted by some offset like by table mixing all the strings together. For example you got 0123456789 if you store them in memory like this:
|0x1xx2xxx3xxxx4|
|xxxxx5xxxxxx6xx|
|xxxx7xxxxxxxx8x|
|xxxxxxxx9xxxxxx|
where x is anything or another string ... ...
9
UPDATE
Based on @ws's comment and @nderscore's code, use this JSFiddle to decode the thing.
To find the password that this script asks for, you can use a simple debugging trick.
Go to JSFuck and uncheck the Eval Source option.
Paste the obfuscated JavaScript
Run
You'll see:
It seems to be calling prompt(), so put a breakpoint on it, like this:
(I'll be ...
8
That's not obfuscation, that's just the output of a lousy disassembler engine.
Use IDA Pro instead. You can download an evaluation version for Linux from here.
8
I wouldn't say that obfuscation detection is strictly related to entropy.
When I detected obfuscated code areas I did it by simple statistical comparison of probabilities of appearances of specific assembly commands.
For example number of jump related commands will be significantly larger in a binary with control flow obfuscation.
Number of arithmetic ...
8
There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose.
The way Python works is fully documented and open-source. For instance, consider the pyc file format. Much of the code which deals with reading/writing pyc's ...
7
I do not think code morphism is the or an answer to this question.
What the question was about is obfuscating the algorithm implementation by using less common or undocumented assembly instructions. This can actually be done by some compilers when extensive optimizations are turned on. For example compilers like the Intel C Compiler, GCC, or PGI can ...
7
Some plugins like reflexil provide this functionality.
7
The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is done by pushing the address to the stack and relying on the fact that retn will get what's on the top of the stack and redirect the execution there.
Well, it depends on what you mean by damaging the stack. The stack is just a place in memory and the damage can only ...
7
Stripping line numbers has a minimal impact on the difficulty of reverse engineering code. If it is causing you problems, I would recommend disabling it.
Col-E's answer is a red herring because it is fairly easy for a reverse engineer to insert synthetic line numbers into the bytecode to disambiguate stack traces (assuming they don't just rename the methods ...
6
As others have said, this is for getting current instruction's address. But it's not recommended as it'll hurt performance because it won't return anywhere, causing disagreement of return addresses in data stack and in the CPU's internal calling stack
The recommended way is
GetCurrentAddress:
mov eax, [esp]
ret
...
call GetCurrentAddress
mov [...
6
I recently tried http://www.jsnice.org/ on 50+KB of a single minified JavaScript file containing lots of dynamic modification code that Cordova's runtime refused to execute (for an app targeted at Windows Phone 8.1 and Windows 10). The results were amazing as it recognises matching code fragments that are available unminified from thousands of opensource ...
6
This problem comes from the way objdump disassemble a binary. The technique used here is called linear sweep, it is done by starting at the beginning of each symbol in all the sections that are flagged as CODE and disassemble instruction after instruction, supposing that what follow an instruction is also an instruction. The problem with this disassembly ...
6
There are a number of ways to accomplish what you've stated. Generally, more robust techniques, while affording a higher level of protection, will also put more burden on the programmer creating the software. So in approximately increasing order of difficulty, here are some ideas:
Store the data non-contiguously
The simplest approach is to simply not ...
6
Unfortunately it is not enough code to say exactly what it is, but,
as @0xec said, it looks very much like control flow flattening.
Usually such kind of code transformations are done automatically with obfuscators.
There are some obfuscating compilers, and one of them does CFG flattening. As far as I know this compiler is not one-of-a-kind, there are a ...
5
Metamorphism wasn't used for obfuscation as much as it was used to defeat static AV signatures.
In terms of modern* obfuscation:
A custom virtual machine can be a pain to analyze, especially if it's a custom crafted one (as opposed to something like VMProtect which is more widely studied).
Obfuscation that involves code running in the kernel can also be ...
5
I figured it out! Some of the comments on this web site made me go back and think harder - actually to think differently.
I thought that I should post the analysis that I did on these messages to try to determine the CRC algorighm.
My analysis is based on a paper written by Greg Ewing http://www.cosc.canterbury.ac.nz/greg.ewing/essays/CRC-Reverse-...
5
I have spent some time to look into Apple's airplay mirroring support, which is encrypted by fairplay protocol. After investigating serveral existing commercial applications I have finally managed to get a way of decrypting fairplay protected streams.
I have extended the shairplay code to demostrate this ability. Please look at https://github.com/foxsen/...
5
Here is a pretty old challenge with, among other stuff, a VM in the end. You have both the write-ups of many candidates, and the official write-up of the author, with explanations as how to do such VM-based obfuscation.
5
You should not confuse "code protection" and "code obfuscation". "Code protection" techniques target in recognizing code modifications (you mention a checksum) and take suitable means like crashing or delivering wrong results when tampering with the code has been recognized. Anti-Debug measures also belong into this category.
"Code obfuscation" in a binary ...
5
This might be true that those variables are added only to confuse analysis but remember that in Javascript there are so many ways to access the variable that I would take such info from an automated tool with a little grain of salt.
It might be true but it also might be that this code uses non-direct access to those 82 variables.
Having such code:
re = '...
5
that instrumentation is not easily possible because of JIT compilation of IL instructions.
Well it's actually the opposite. Tracing methods is quite easy - it would be difficult if we would like to trace fields usages. .NET assemblies contain rich type/method information that can be used to inspect/modify them. There's also a great library that does that ...
5
When I assembled the code, the offending instruction was:
0x6c 40 ff d1 call rcx
You will need to use Change Stack Pointer command in IDA to fix this in disassembly. As per IDA documentation:
This command allows you to specify how the stack pointer (SP) is modified by the current instruction.
You cannot use this command if ...
4
As everybody else is saying, in this case it is due to linear sweep.
However, I would like to add that even IDA can be fooled with Junk Bytes and you can only trust the disassembly while debugging a sample. As encoders can change the code on the run, only trust the value on the EIP and nothing else to be correct code.
Only top voted, non community-wiki answers of a minimum length are eligible