deobfuscation

What does this bit of javascript do? This was marked by ESET as trojan

送分小仙女□ 提交于 2019-12-05 05:30:25
问题 I received a spam email that contained an attachment with a .js file, and out of curiosity I opened it up in notepad (didn't run it of course). Had to disable ESET temporarily as it was marking this as a trojan. I was wondering what this actually does: autonomousRadio = eval(('transport', 'caste', 'acoustic', 'primitive', 'absurd', 'clip', '\u0074phenomenon'.e()) + 'h' + ('station', '\u0069program(me)'.e()) + 's'); autonomousRadio = autonomousRadio[('barbarian', '\u0041ruin'.e()) + 'ct' + (

Preventing reverse engineering with binary code and secret key

被刻印的时光 ゝ 提交于 2019-12-04 17:31:47
I am working on a software program that has to be deployed on private cloud server of a client, who has root access. I can communicate with the software through a secure port. I want to prevent client from reverse engineering my program, or at least make it "hard enough". Below is my approach: Write code in Go and compile the software into binary code (may be with obfuscation) Make sure that program can only be initiated with secret key that can be sent through the secure port. The secret key can be changing depending on time. Every time I need to start/stop the program, I can send commands

How can I generate all ordered combinations of length k in Perl?

[亡魂溺海] 提交于 2019-12-04 14:42:33
I need a subroutine that, given a set of characters, will generate all possible combinations of those characters of length k. Order matters and reuse is allowed, so if k = 2 then AB != BA and AA is an option. I found some working examples on PerlMonks , but unfortunately they are code golf and not easy for me to wrap my mind around. Can someone please do one or more of the following? Give a breakdown and explanation of how the first algorithm works. De-obfuscate the code so that the meaning is clearer. Point me toward another example that is clearer. Thanks! cjm You can use variations_with

How would you reverse engineer this?

我的梦境 提交于 2019-12-04 12:33:32
问题 I've got some code that was at the bottom of a php file that is in javascript. It goes through lots of weird contortions like converting hex to ascii then doing regex replacements, executing code and so on... Is there any way to find out what it's executing before it actually does it? The code is here: http://pastebin.ca/1303597 回答1: You can just go through it stage by stage - since it's Javascript, and it's interpreted, it needs to be its own decryptor. If you have access to a command-line

Help Deobfuscate This JS attack

谁说胖子不能爱 提交于 2019-12-04 12:06:07
问题 I have a piece of nasty javascript that I would like to de-obfuscate. I know that I can spin up a VM and behold the malware in all of its glory, but I am more interested in not having it run, but viewing it in a non-obfuscated form. If it needs to run in order to do this, then so be it, I guess. Anyone know how to do this without compromising myself? Thanks, Tim EDIT: here's the code (one liner, it was between script tags). This was sent to me, I don't have access to the server. var $a=

Firebase Crashlytics: Upload missing dSYMs to see crashes from 1 versions.(iOS)

本小妞迷上赌 提交于 2019-12-03 22:29:37
Error Message: Upload missing dSYMs to see crashes from 1 versions. Versions affected: 1.0 (1) I am trying to implement Firebase Crashlytics in my iOS project. I did all the setups according to Firebase Crashlytics Doucmentation . The crash is performed manually when the button is clicked just to see whether the crashlytics is working. @IBAction func onTestCrashButtonClick(_ sender: UIButton) { Crashlytics.sharedInstance().crash() } But when i tried to see the error report in the firebase console, it shows something like this image. After reading Get Deobfuscated crash reports I just Set Debug

What does this bit of javascript do? This was marked by ESET as trojan

走远了吗. 提交于 2019-12-03 20:57:36
I received a spam email that contained an attachment with a .js file, and out of curiosity I opened it up in notepad (didn't run it of course). Had to disable ESET temporarily as it was marking this as a trojan. I was wondering what this actually does: autonomousRadio = eval(('transport', 'caste', 'acoustic', 'primitive', 'absurd', 'clip', '\u0074phenomenon'.e()) + 'h' + ('station', '\u0069program(me)'.e()) + 's'); autonomousRadio = autonomousRadio[('barbarian', '\u0041ruin'.e()) + 'ct' + ('state', 'prologue', 'accompany', 'orientation', 'chance', 'unison', '\u0069cyclone'.e()) + 've' + (

How to de-obfuscate the ctk.c code the winner of 2001's IOCCC?

走远了吗. 提交于 2019-12-03 13:23:42
问题 I have seen ctk.c obfuscated code, but How can I start to de-obfuscate it? #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/time.h> #include <signal.h> #define m(b)a=b;z=*a;while(*++a){y=*a;*a=z;z=y;} #define h(u)G=u<<3;printf("\e[%uq",l[u]) #define c(n,s)case n:s;continue char x[]="((((((((((((((((((((((",w[]= "\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b";char r[]={92,124,47},l[]={2,3,1 ,0};char*T[]={" |"," |","%\\|/%"," %%%",""};char d=1,p=40,o=40,k=0,*a,y,z,g= -1,G

How would you reverse engineer this?

泄露秘密 提交于 2019-12-03 08:50:19
I've got some code that was at the bottom of a php file that is in javascript. It goes through lots of weird contortions like converting hex to ascii then doing regex replacements, executing code and so on... Is there any way to find out what it's executing before it actually does it? The code is here: http://pastebin.ca/1303597 You can just go through it stage by stage - since it's Javascript, and it's interpreted, it needs to be its own decryptor. If you have access to a command-line Javascript interpreter (such as the Console in Firebug ), this will be fairly straightforward. I'll have a

Understanding an uncommon argument to main

混江龙づ霸主 提交于 2019-12-03 07:07:37
问题 The following question was given in a college programming contest. We were asked to guess the output and/or explain its working. Needless to say, none of us succeeded. main(_){write(read(0,&_,1)&&main());} Some short Googling led me to this exact question, asked in codegolf.stackexchange.com : https://codegolf.stackexchange.com/a/1336/4085 There, its explained what it does : Reverse stdin and place on stdout , but not how . I also found some help in this question : Three arguments to main,