12 votes

How do I reverse-engineer .so files found in Android APKs?

Use android-ndk, https://developer.android.com/ndk/downloads/index.html. You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and ...
Shailesh Mota's user avatar
9 votes
Accepted

How to deobfuscated javascript?

UPDATE Based on @ws's comment and @nderscore's code, use this JSFiddle to decode the thing. To find the password that this script asks for, you can use a simple debugging trick. Go to JSFuck and ...
rev's user avatar
  • 1,293
8 votes

Best way to protect source code of .exe program running on Python?

There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose. ...
0xec's user avatar
  • 6,050
7 votes
Accepted

Is there a name for this kind of "obfuscation" for the machine code from C++?

Unfortunately it is not enough code to say exactly what it is, but, as @0xec said, it looks very much like control flow flattening. Usually such kind of code transformations are done automatically ...
w s's user avatar
  • 8,428
7 votes

Why doesn't this retn instruction return from the function?

The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is done by pushing the address to the stack and relying on the fact that retn will get what's on the top of ...
Paweł Łukasik's user avatar
7 votes
Accepted

Why do obfuscators remove line numbers, and can I safely leave them in?

Stripping line numbers has a minimal impact on the difficulty of reverse engineering code. If it is causing you problems, I would recommend disabling it. Col-E's answer is a red herring because it is ...
Antimony's user avatar
  • 2,002
6 votes

What is a good tools to reverse the effects of Minify on JavaScript?

I recently tried http://www.jsnice.org/ on 50+KB of a single minified JavaScript file containing lots of dynamic modification code that Cordova's runtime refused to execute (for an app targeted at ...
JulianHarty's user avatar
6 votes

How do I reverse-engineer .so files found in Android APKs?

You can also reverse-engineer APK files directly on an android device. Java part: Show Java .so files: Android disassembler. (Disclaimer: I 'm the developer) Version 1.4.2 release. Android-...
KYHSGeekCode's user avatar
5 votes

Is there a name for this kind of "obfuscation" for the machine code from C++?

Here's a blog post describing this technique in a little more detail as well as some hints on how to undo it: https://blog.quarkslab.com/deobfuscation-recovering-an-ollvm-protected-program.html EDIT ...
Igor Skochinsky's user avatar
  • 36.4k
5 votes
Accepted

How to obfuscate x86 assembly code?

You should not confuse "code protection" and "code obfuscation". "Code protection" techniques target in recognizing code modifications (you mention a checksum) and take suitable means like crashing or ...
josh's user avatar
  • 1,964
5 votes
Accepted

Obfuscated code analysis - can unused variables be ignored?

This might be true that those variables are added only to confuse analysis but remember that in Javascript there are so many ways to access the variable that I would take such info from an automated ...
Paweł Łukasik's user avatar
5 votes

Jump in the middle trick

Yes, this is indeed possible to employ consistently throughout the entire assembly listing, making manual analysis or adjustments a pain. Disassemblers are often divided into two categories: linear ...
NirIzr's user avatar
  • 11.7k
5 votes

Trace Method Calls in .NET/C# Binary

that instrumentation is not easily possible because of JIT compilation of IL instructions. Well it's actually the opposite. Tracing methods is quite easy - it would be difficult if we would like to ...
Paweł Łukasik's user avatar
5 votes
Accepted

Stack-pointer analysis failed

When I assembled the code, the offending instruction was: 0x6c 40 ff d1 call rcx You will need to use Change Stack Pointer command in IDA to fix this in disassembly. As ...
chentiangemalc's user avatar
4 votes

How do I reverse-engineer .so files found in Android APKs?

You can also try the Snowman tool: https://derevenets.com/. NB: the original author appears to have "pulled" it. Several forks exist, e.g. this one not connected to original) or these. ...
Adrian Paul's user avatar
4 votes

Any good deobfuscators for java?

Proguard's "optimisation" stage results in deobfuscating junk as I wrote up here - http://www.surrendercontrol.com/2016/03/using-proguard-to-deobfuscate-code.html. Also, Caleb Fention's Simplify ...
Vitaly Osipov's user avatar
4 votes
Accepted

Distribution of malware obfuscation types

Unfortunately it seems so that there are no existing publications/statistics from av vendors. Reffered to [A] and the mentioned entropy analysis, 90% of the used samples are obfuscated by a ...
knx's user avatar
  • 1,257
4 votes
Accepted

reverse javascript crackme encryption method algorithm

To extend on EWD-0- about the reversibility of RC4 here's how I tried it: From your actual code and reversing it a little to get "input128" encoded: arr = [99, 116, 115, 37, 16, 120, 211, 90, 197, ...
Tensibai's user avatar
  • 156
4 votes

Exe protection by TLS callback, trying to understand the behaviour

It is an old anti-debugging trick to use the TLS callback. The code in the TLS gets executed before the executables entry point and the debugger gains control. This allows the TLS to check for the ...
Crudd's user avatar
  • 41
4 votes

How to deobfuscate native Android library obfuscated with OLLVM?

You're in luck; I wrote an article about that last year. I didn't know at the time that the obfuscator in question was Obfuscator-LLVM, but indeed, it was (albeit a version that was integrated into ...
Rolf Rolles's user avatar
  • 9,178
4 votes
Accepted

Dealing with heavily obfuscated Java, possibly on bytecode level

First off, you should never use javap when dealing with obfuscated applications, because javap is not designed to handle malicious bytecode, and can easily be thwarted in a number of ways. Luckily, ...
Antimony's user avatar
  • 2,002
3 votes

Techniques to hide a process (procmon)?

You have to write a rootkit for this purpose. Look at this two. https://github.com/landhb/HideProcess https://www.codeproject.com/Articles/167583/Driver-to-Hide-Processes-and-Files-Second-Edition
EWD-0-'s user avatar
  • 119
3 votes

Obfuscated AES decryption assembly

I think you identified the purpose of the functions and its parameters correctly. So, the function sub_44d84 has four parameters: (<decryptionFunction=0x1>, <IV>, <bytesToDecrypt>, &...
ebux's user avatar
  • 1,759
3 votes

Anti-debug techniques on Unix platforms?

They aren't any, do not try to do the mathematically impossible. For now, all the techniques I found on Internet were easily worked around as soon as the anti-debug technique has been understood. So, ...
12431234123412341234123's user avatar
3 votes
Accepted

IDA pro obfuscation instance

IDA is good at recognising such tricks, but if it didn't you can press D having the call instruction selected. This will convert the opcode to a data, displaying just bunch of dbs. After that, ...
Paweł Łukasik's user avatar
3 votes

Why doesn't this retn instruction return from the function?

My answers: Why is that? The program you are looking at is probably using some software obfuscation because this is not a usual way to return from a function. My guess is that this function is just ...
perror's user avatar
  • 18.9k
3 votes
Accepted

Is deobfuscation of my javascript code hard or easy?

Resolved. generally nothing in js is impossible to reverse in this case the 'alert' string in plain text give me a big help, because I simply started to resolve function value one step back at time. ...
realtebo's user avatar
  • 183
3 votes

What's this obfuscation technique?

I could be wrong, but it looks like VMProtect v3. For this version, this obfuscator inlines all handlers, so that's normal you don't find any dispatcher.
wisk's user avatar
  • 1,124
3 votes

Trace Method Calls in .NET/C# Binary

You can use de4dot (https://github.com/0xd4d/de4dot) to deobfuscate the binary. Static analysis of dotnet binaries can be done easily by using de4dot and then using ILSpy to create a visual studio ...
oridamari's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible