Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

flow is so bad #7

Closed
3jq opened this issue Jul 29, 2021 · 9 comments
Closed

flow is so bad #7

3jq opened this issue Jul 29, 2021 · 9 comments
Labels
enhancement New feature or request

Comments

@3jq
Copy link

3jq commented Jul 29, 2021

its so easy to remove, u just have to find method calls and remove everything before and after it.

@vimasig
Copy link
Owner

vimasig commented Jul 30, 2021

You have to find real jumps as well because flow obfuscation is applied to if statements (if you want a runnable application & correct flow. Otherwise you cannot correctly understand the execution order).
If you say "method calls are visible, I can see the code" you don't need deobfuscation to see them, they are already visible. We need reference obfuscation to hide them.

Can you explain a little more like can you find real jumps easily and output is completely clean and correct code?

@3jq
Copy link
Author

3jq commented Jul 30, 2021

Ok. I meant to say, that method calls are like too easy to find. For example, in binscure, you can only find method calls in switch-cases or if cases, where they are getting called only in one case, and there are loo-ots of cases.

@3jq
Copy link
Author

3jq commented Jul 30, 2021

Example:
switch (a) {
case -1234783274823:
throw null;
break;
case 483274237:
break;
case 9245375:
break;
case -2184738742983:
MethodCall();
break;
case -43279847238987:
throw null;
break;
other cases
default:
break;
}

And there are lots of switch cases, is statements and other things like that.

@3jq
Copy link
Author

3jq commented Jul 30, 2021

And in binscure, its much harder to find the method calls to understand what happens in code. In bozar, its really easy.

@vimasig vimasig added the enhancement New feature or request label Jul 31, 2021
@vimasig
Copy link
Owner

vimasig commented Jul 31, 2021

So you mean continuous method calls without if statements like this right?

@3jq
Copy link
Author

3jq commented Jul 31, 2021

Yea as most bozar flow looks mostly just like this

@ghost
Copy link

ghost commented Aug 5, 2021

And in binscure, its much harder to find the method calls to understand what happens in code. In bozar, its really easy.

binscure < bozar, binscure is very easy to deobfuscate lol

@3jq
Copy link
Author

3jq commented Aug 5, 2021

k, deobf pyro

@vimasig
Copy link
Owner

vimasig commented Aug 8, 2021

Now it's better with v1.7.0

@vimasig vimasig closed this as completed Aug 8, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants