Questions tagged [obfuscation]

Obfuscation refers to hiding the intended meaning of communication.

Filter by
Sorted by
Tagged with
0
votes
0answers
55 views

Securely unpack malware

I'm trying to find a way to securely unpack Windows Malware packed with UPX, I need to unpack a lot for analysis so automating the process as much as possible is beneficial. I've found a few methods ...
0
votes
1answer
98 views

Should I complie software after making all the variable and function names “1-2 character”? [duplicate]

In JavaScript, it seems common for the official release of the code to use only single-character variable and function names (of course, after converting the original code which uses clearer names) in ...
1
vote
1answer
166 views

How can I obfuscate a 64-bit executable Windows file? [closed]

Hyperion works OK when scrambling/obfuscating win32 files, but I am trying a program that seems to be a Win64 executable, and it fails: C:\Hyperion>hyperion.exe -v mimikatz.exe output.exe -------...
76
votes
5answers
12k views

Does code obfuscation give any measurable security benefit?

I've always firmly held the belief that obfuscation is essentially useless. Obfuscated code is not impossible to read, only harder to read. I had the belief that a sufficiently skilled attacker would ...
0
votes
0answers
31 views

What are good examples of “Dynamic opaque predicates”?

I am studying the concept of software obfuscation and come across this interesting scheme, dynamic opaque predicate: Basically it either goes two false branches, or two true branches, and ...
0
votes
0answers
61 views

How can Runtime-Crypters stay FUD

A Runtime Crypter always works with the same principle: It decrypts its payload, starts up a process in suspended state, inserts the payload and resumes the suspended process under false flag. All ...
0
votes
3answers
172 views

Prevent finding key in C++ application binary

I need to store a key (symmetric-key cryptography) within my C++ application binary (based on OpenCV) so that the key as unidentifiable as possible. Can someone help me choose the key so that is ...
2
votes
1answer
94 views

Obfuscating “sensitive” strings in mobile client

We have a client that runs some native (C++) code on both Android and iOS, to mitigate MITM attacks we use certificate pinning. This means that the binary includes some strings (const char * const ...
0
votes
3answers
155 views

Are there types of malware that are so time-intensive to detect that AV vendors simply choose to not detect them? [closed]

I've been reading a lot about how AVs use different heuristic methods to detect obfuscated malware and it seems like some of these methods are very time/processor intensive. For example, to detect ...
-4
votes
3answers
131 views

Is code obfuscation common in FOSS?

I am a learner of FOSS licensing, security and privacy. I ask this question because one of the arguments persuading users to use or switch to FOSS is the fact that since the code is open, an expert ...
0
votes
1answer
237 views

Is security by obscurity / obfuscation a valid option, or do the crawlers have JavaScript enabled?

I'm creating a new website, so I am thinking about how to protect my email address and phone number against crawlers, I actually mean email harvesters (most of which I suppose don't have JavaScript ...
0
votes
1answer
105 views

What does the attached php malware do? [duplicate]

Found this on a WordPress server under the filename wp-includes/class-wp-image-editor-fd.php when WordFence picked it up as being an unexpected file. Link to source is here: https://pastebin.com/...
0
votes
1answer
92 views

Filtering Obfuscated Spam Emails In Exchange

So the past few weeks we have been trying to cut back on the amount of spam reaching our users in our organization. We have been successful in implementing hard filtering rules like if an email ...
1
vote
1answer
99 views

What notable examples of metamorphic engines are there? [closed]

I am doing a research project on metamorphic malware and would like to have access to a metamorphic engine I could demo. Are there any good open-source (or easily obtainable) metamorphic engines I ...
0
votes
0answers
70 views

Junk code insertion in Smali

I was trying to obfuscate android by adding junk code in Smali. Understood that by adding nop/goto instruction to it works well. However when I tried to add (const/4 v0, 0x4) my app crash after ...
0
votes
3answers
157 views

What string encoding options are there besides xor? [closed]

When attempting to obfuscate strings in a modern program, xor is probably the most common option. By this I mean running each char of a string through a function which xors the char with some given ...
2
votes
2answers
90 views

Could always-listening mobile apps secretly spy on conversations?

Various apps and services available on modern smartphones constantly listen with the mic (e.g. Siri or Google Assistant listening for wake word, "Now Playing" feature on Pixel phones). To settle user ...
-1
votes
2answers
223 views

Why are there no GPU Obfuscators? [closed]

Rationale: I need to figure out ways to protect Intellectual Property contained in NVIDIA CUDA/GPU code. That said, I'm surprised that there are literally zero GPU code obfuscators. On stack ...
0
votes
1answer
416 views

Key Encryption / Obfuscation

I got a GUI Program, which loads the Logic from a webserver if the entered License Key is valid. The actual connection string I hexed and xor'd with a secret key. (which is unfortunately static) The ...
1
vote
1answer
61 views

How can I make sure that my Python code cannot be accessed by the user of my web app?

I have a Python Program whose code I would like to protect. For sake of example, let's say I coded a novel function called "add" which does the following: def add(n1, n2): return n1 + n2 I'd ...
0
votes
1answer
264 views

Is this strange PHP file that I found on my server malicious? [duplicate]

I found a PHP file that I don't know where it came from on my server: <?php $ojcsoo = '_-bHft\'dik1x6cn9leapm0y4s7vg5*r8ou#2';$zjdtjcd = Array();$zjdtjcd[] = $ojcsoo[3].$ojcsoo[29];$zjdtjcd[] = $...
3
votes
1answer
314 views

C++ binary obfuscation: how to get around license checks being a simple if/then branches?

I'm looking into binary obfuscation for an exectuable binary written in C++. I realize preventing cracks is impossible, but making it slightly harder would be nice. No matter how complex the actual ...
0
votes
1answer
143 views

Are auto-type features of password managers actually effective against keyloggers?

Of course if you think of a "keylogger" as a program that can only read keystrokes, then copy-pasting on the clipboard is going to be enough. But we know that keyloggers are not really only "logging ...
2
votes
0answers
303 views

How to obfuscate C++ code with movfuscator?

I want to obfuscate a C++ application using movfuscator, but movfuscator currently uses C as the source language and not C++. I tried to do the followings (as they recommended, but with no success): ...
5
votes
4answers
1k views

Does appending randomness to a token before encrypting it, make it more secure?

Scenario: User requests page on my site Server builds up token using various values, encrypts it (via an industry-standard algorithm, nothing homegrown) using a key only the server knows, and returns ...
1
vote
2answers
275 views

How to obfuscate a assemblies binary compiled with .NET framework?

How to obfuscate a binary compile with .NET framework? Tools such as Ebowla and Pecloak.py will encrypt it but the program won't run. Even UPX can't pack it. Wondering are there any ways to obfuscate ...
-1
votes
1answer
633 views

Obfuscated PHP code found on Wordpress site - has it been compromised? [duplicate]

Firstly - I expect the answer to be yes. But I never dealt with something like this so I would like some advice. A client has recently complained that their website went down. So I started ...
2
votes
1answer
488 views

How to obfuscate SSH tunnel Mac?

I am looking to test a DPI (deep packet inspector). I currently have it set up to block SSH connections (which it does successfully). I have learned that DPI can be bypassed by obfuscating/encrypting ...
1
vote
2answers
489 views

How to make a well-known malicious programs undetectable by anti-virus solutions? [closed]

I want to make well-known malicious programs, like Mimikatz and Incognito, undetectable by anti-virus solutions. I have already tried various approaches myself, like packing the binary with UPX or ...
0
votes
2answers
751 views

Extract URL from obfuscate javascript

I have an obfuscated script. I was asked to de-obfuscate the code and extract the URL from the script. However, I used multiple de-obfuscation tools such as https://www.javascriptdeobfuscator.com/ ...
1
vote
1answer
366 views

Extract urls from obfuscated android malware

Working on android malwares, i have faced many android malwares that typically contain urls which are bank phishing page. This type of malwares are growing in number so an automated detection system ...
4
votes
1answer
949 views

Trying to understand what this PHP malware does [closed]

My server has been hacked recently and the hacker has uploaded multiple malicious source code to the web server. I have already de-obfuscate the code, but I still don't understand what it does. It ...
0
votes
0answers
34 views

Security of password to database in 2-layer SW model

I'm struggling with kinda old application which is written for Windows and has a 2-layer approach, meaning that the client SW is connecting to backend database directly. This of course mean that the ...
1
vote
1answer
668 views

Android anti-tampering and SSL pinning bypass solid implementation [duplicate]

Is there any advance solution for Android application anti-tampering and bulletproof obfuscation implementation? I have been already using following protections in my application: Obsufcation using ...
-2
votes
1answer
87 views

Visual Studio anonymity

Recently me and me colleague was wondering about obfuscating / removing project info. If application is reverse engineered than what kind of information the engineer sees? Can he see the email of the ...
0
votes
1answer
738 views

Modify Win OS banner to avoid OS detection

I would like to modify Win OS banner to defeat OS detection from scanning tools like Nmap for example. Although, I know that Nmap does not take into account just the banner to do OS detection.
2
votes
1answer
298 views

Phishing email with encoded url params

I received a phishing email with the following format: hxxp://<%legitimateSite%>/~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%23$%25%5e&*()+~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%...
9
votes
1answer
570 views

How to Change a Culture of “Security Through Obscurity”

I have worked for a number of organizations in the past that utilize practices that are justified by what I would describe as "Security through Obscurity" including the following: Weak/Vulnerable two ...
1
vote
1answer
421 views

About the IEEE P1735 standard

I read this article from The hacker news (article). I understand the figure showing how P1735 works but I'm wondering, when you ship your IP (Intellectual Property) to a client, the code needs to be ...
2
votes
1answer
567 views

Generating request-specific token for an API

We have an API openly accessible through a data visualization on a website and an app. We'd like to make the life of potential data scrapers a bit more difficult. First thing we did was to add some ...
27
votes
8answers
6k views

Should firmware images for IoT be encrypted for security reasons?

When working with Internet of Things devices, is it recommend to obfuscate or encrypt firmware images pushed to clients? This to make reverse engineering harder. (They should be signed of course)
72
votes
3answers
11k views

Strange code running at startup

A piece of code was running on my Windows machine at startup. I would like to know exactly what this code is doing; it seems to refer to something like crackbook? @echo off if %...
1
vote
2answers
147 views

Is there a point to obfuscating form field values?

Our company provides omnichannel (web, mobile, etc.) solutions for the banking industry. One of our customers is pushing for obfuscating or encrypting the contents of the form fields (client-side, on ...
3
votes
2answers
239 views

Is it possible to send a message and 100% obfuscate the origin of the sender in a p2p networked message board?

I am thinking of an app that could allow people to share text so they can post grievances about a totalitarian government in a p2p network. It has to be p2p because a website can be blocked. This ...
2
votes
1answer
190 views

Dangers of jpeg with attachment

If anyone has any suggestions for tags, feel free to add them, seeing as i'm not yet familiar with the ones used on this site. I was wondering what the dangers are of appending a file to an image. ...
-1
votes
2answers
369 views

DRM on CSS or even HTML files through domain locking via Javascript?

If you are planning to downvote me to oblivion, let me clarify what this question is about: I am not interested to prevent someone from copying my website. I know there are no foolproof method. My ...
1
vote
3answers
154 views

What all file types can we hide an archive file inside?

This tutorial explains how you can "hide" an archive file like .zip inside an image file by using the command: copy /b image.jpg + hide.zip output.jpg Doing so allows you to right click output.jpg ...
1
vote
1answer
456 views

I'm an idiot. Need help with JavaScript “codebreaking” and analysis [duplicate]

I accidentally executed a .js file from a phishing source with Windows Script Host. If possible I really don't want to reformat. If anyone could analyse this file it'd be awesome. I'm running Windows ...
31
votes
3answers
6k views

How to deobfuscate suspicious JavaScript code? [duplicate]

I'm a sysadmin and one of my users just told me that he opened a JavaScript received by mail. Apparently there is no impact but since I don't know this language well, especially when its obfuscated, I ...
1
vote
1answer
388 views

How a packed malware runs the unpacked code?

When we run a packed malware it will unpack the code in dynamically allocated heap memory and heap can be kept non executable and I find no purpose to make heap executable. So, how the malware ...