Questions tagged [deobfuscation]

Techniques to remove obfuscation from a piece of program.

Deobfuscation is about all the techniques used to simplify and filter out all the attempts to obfuscate the code. These techniques may be automated or not but must result in a simpler version of the original obfuscated program (possibly in a non-executable form).

161 questions
6
votes
1 answer

How to efficiently simplify obfuscated formula in QF_BV logic with Z3?

I would like to know if there are efficient ways to simplify arithmetic formula expression over bit-vectors with Microsoft Z3. But, first, I would like to explain a bit the problem. Lets start with an example: x + y == (x ^ y) + 2 * (x & y) Both x…
perror
  • 19,083
  • 29
  • 87
  • 150
2
votes
0 answers

Reverse engineering hidden audio track in this MPEG-1 video file?

No matter what video player or video analysis software I throw this video at, neither are able to reproduce or detect the audio track of the video: Introduction video of Wipeout XL PC version (OneDrive link), it should be downloaded as the online…
Eric Cartman
  • 239
  • 2
  • 7
2
votes
0 answers

Do any known deobfuscateors work on Agile.net 6.4?

As a company we are going to start obfuscating our released binaries, so far the best front runner we have found has been Agile.net 6.4. I took one of our binaries we obfuscated with the trial version of 6.4 and was not able to re-fill the method…
1
vote
0 answers

Looking for obfuscation patterns within jumps

I'm working on an obfuscated binary. I recognized some patterns used to confuse the disassembler, some used to obfuscate function calls, some other for conditional jumps and so on. The idea was to search these patterns along the binary. The problem…
stokdam
  • 11
  • 3
1
vote
2 answers

how to deobfuscate Autoit strings?

The code is: https://pastebin.com/ZwvySjgy Is it possible to deobfuscate the strings protected with STRINGDEC?
sir mirror
  • 19
  • 3