2

You're on the right track with replacing exec with print, you just didn't go deep enough. The file you posted is, effectively, 7 python commands each wrapped up in a bunch of obfuscation (not including the initial import statement). If you deobfuscate each command by printing the result, the first one results in an import statement and a set of 4 more ...


1

Since this is obviously a pain to do statically or by hand in a dynamic fashion, I would suggest trying another approach. I personally would try to do it by writing a small emulator. Since it is mostly 'stack arithmetic' and junk code, this would be perfect. Take a look at the emulation framework named 'Unicorn'. With this option, you don't have to re-...


1

According to the descriptions provided in the question, Enigma Virtual Box does not necessarily virtualize a code, but rather allows the application's files and records to be consolidated into a single executable file, ie the reason for not being able to analyze is that the new file generated is a loader, already the .Net binary using ConfuserEx can be ...


1

No, IDA does not keep a separate list of addresses handled by the user. Normally the message you quote should mention the address of the problem so you can double-click it to jump there and fix the issue (e.g. convert data to code). If there are many such places, you can also try a mass selection and force everything in a range to code (though this may ...


1

If a packer with virtualization is used then code will become obfuscated but for different reason. It will be under virtual machine which will completely destroy the code when trying to load it in IDA. You should scan the program with programs like DIE, ExeInfo, PEID or similar to determine what packer was used and what version. Then you have to: ...


1

e9patch E9Patch is different to other tools in that it can statically rewrite x86_64 Linux ELF binaries without modifying the set of jump targets. To do so, E9Patch uses a set of novel low-level binary rewriting techniques, such as instruction punning, padding and eviction that can insert or replace binary code without the need to move existing instructions....


Only top voted, non community-wiki answers of a minimum length are eligible