deobfuscation | 易学教程

Replace array-mapped variables with the actual variable name/string?

阅读更多关于 Replace array-mapped variables with the actual variable name/string?

问题 I am trying to edit a Greasemonkey/jQuery script. I can't post the link here. The code is obfuscated and compressed with minify. It starts like this: var _0x21e9 = ["\x67\x65\x74\x4D\x6F\x6E\x74\x68", "\x67\x65\x74\x55\x54\x43\x44\x61\x74\x65", ... After "decoding" it, I got this: var _0x21e9=["getMonth","getUTCDate","getFullYear", ... It is a huge list (500+ ). Then, it has some variables like this: month = date[_0x21e9[0]](), day = date[_0x21e9[1]](), ... _0x21e9[0] is getMonth, _0x21e9[1]

How do you interpret a deobfuscated Android crash report?

阅读更多关于 How do you interpret a deobfuscated Android crash report?

I downloaded a crash report from my app's Google Play admin area, ran it through retrace.sh to deobfuscate the Proguard mapping, and it produced the output below. Questions: What is Unknown Source? showHeader , showPhoto , etc. are indeed methods in my SummaryFragment class, but why are they listed in the order shown? These methods do not follow any sort of logical or execution order in my code. In which method was the NPE actually thrown? Caused by: java.lang.NullPointerException at com.myapp.SummaryFragment.selectMenuItemAuth(Unknown Source) showHeader photoButtonClicked showPhoto

Concept behind these four lines of tricky C code

阅读更多关于 Concept behind these four lines of tricky C code

问题 Why does this code give the output C++Sucks ? What is the concept behind it? #include <stdio.h> double m[] = {7709179928849219.0, 771}; int main() { m[1]--?m[0]*=2,main():printf((char*)m); } Test it here. 回答1: The number 7709179928849219.0 has the following binary representation as a 64-bit double : 01000011 00111011 01100011 01110101 01010011 00101011 00101011 01000011 +^^^^^^^ ^^^^---- -------- -------- -------- -------- -------- -------- + shows the position of the sign; ^ of the exponent,

wordpress hacked: what does this script actually do?

阅读更多关于 wordpress hacked: what does this script actually do?

I maintain three wordpress blogs, and yesterday-morning, they were all hacked. Inside all my index.php the first line looked as follows: <?php eval(base64_decode(

Obfuscated C Code Contest 2006. Please explain sykes2.c

阅读更多关于 Obfuscated C Code Contest 2006. Please explain sykes2.c

How does this C program work? main(_){_^448&&main(-~_);putchar(--_%64?32|-~7[__TIME__-_/8%8][">'txiZ^(~z?"-48]>>";;;====~$::199"[_*2&8|_/64]/(_&2?1:8)%8&1:10);} It compiles as it is (tested on gcc 4.6.3 ). It prints the time when compiled. On my system: !! !!!!!! !! !!!!!! !! !!!!!! !! !! !! !! !! !! !! !! !! !! !! !! !! !! !! !! !! !!!!!! !! !! !! !! !! !!!!!! !! !! !! !! !! !! !! !! !! !! !! !! !! !! !! !!!!!! !! !! !! !!!!!! Source: sykes2 - A clock in one line , sykes2 author hints Some hints: No compile warnings per default. Compiled with -Wall , the following warnings are emitted: sykes2

(2009) - Tool to deobfuscate Java codes

阅读更多关于 (2009) - Tool to deobfuscate Java codes

问题 Is there a tool to deobfuscate java obfuscated codes? The codes is extracted from a compiled class but they are obfuscated and non-readable. 回答1: Did you try to make the code less obscure with Java Deobfuscator (aka JDO), a kind of smart decompiler? Currently JDO does the following: renames obfuscated methods, variables, constants and class names to be unique and more indicative of their type propogates changes throughout the entire source tree (beta) has an easy to use GUI allow you to

How to restore obfuscated property names?

阅读更多关于 How to restore obfuscated property names?

So I'm decrypting a javascript code, and after long time of looking on the internet I have no clue on how to decrypt this a quick way. The code starts off with a large Array containing all strings of the entire script. var _$_21e2 = ["jQuery", "userAgent", "test", "onmouseup", "onmousemove", "pink", "greenyellow", "gold"] There are more string in the array, but this is just an example. And then in the rest of the code it just calls the string from the array, by id. _$_21e2[29] I know I can just do this manually but there are around 120 strings so it would be taking too much time to do this. Is

De-obfuscate Javascript code to make it readable again

阅读更多关于 De-obfuscate Javascript code to make it readable again

I hate to bring this here, while doing the learning of obfuscating the JS code, I encoded my code and then over wrote the orginal one without any backup :) Following is my obfuscated code. var _0xf17f=["\x28","\x29","\x64\x69\x76","\x63\x72\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74","\x69\x64","\x53\x74\x75\x64\x65\x6E\x74\x5F\x6E\x61\x6D\x65","\x73\x74\x75\x64\x65\x6E\x74\x5F\x64\x6F\x62","\x3C\x62\x3E\x49\x44\x3A\x3C\x2F\x62\x3E","\x3C\x61\x20\x68\x72\x65\x66\x3D\x22\x2F\x6C\x65\x61\x72\x6E\x69\x6E\x67\x79\x69\x69\x2F\x69\x6E\x64\x65\x78\x2E\x70\x68\x70\x3F\x72\x3D\x73\x74\x75\x64\x65\x6E

wordpress hacked: what does this script actually do?

阅读更多关于 wordpress hacked: what does this script actually do?

问题 I maintain three wordpress blogs, and yesterday-morning, they were all hacked. Inside all my index.php the first line looked as follows: <?php eval(base64_decode(

How to get rid of eval-base64_decode like PHP virus files?

阅读更多关于 How to get rid of eval-base64_decode like PHP virus files?

My site (very large community website) was recently infected with a virus. Every index.php file was changed so that the opening php tag of these files it was changed to the following line: <?php eval(base64_decode(