8 ms·
makes me sad to hear that :( I will say, as a reverse engineer, that javascript minifiers like closure compiler will optimize almost all obfuscation out, and th
by zemnmez 5y ago
makes me sad to hear that :( I will say, as a reverse engineer, that javascript minifiers like closure compiler will optimize almost all obfuscation out, and the rest you can usually translate to a form which it can understand and then it will do the rest.
The effect of obfuscation is not what you expect. It seems like it moves the whole difficulty up, but it only moves up the floor. By doing so it tends to remove all the signals that would warn non-experts of security issues. Remove the obfuscation and then you have all the catastrophic security issues that have accumulated in there like treasures in an egyptian king's tomb https://zemnmez.medium.com/how-to-hack-the-uk-tax-system-i-guess-3e84b70f8b https://zemnmez.medium.com/how-to-hack-the-uk-tax-system-i-g...
- slig 5y agoI'm curious: can you can undo the obfuscation of JScrambler and Obfuscator.io easily? Some time ago I tried to run both through Closure Compiler, but it was way harder than I thought would be.
- zemnmez 5y agoJScrambler I actually did de-obfuscate to bypass some very significant bot detection a few years ago, but it took a bit more doing -- it uses ES6 features IIRC so I had to transpile it down to ES5 via babel first, but it worked OK after that. has a pretty good crack at obfuscator.io, too: https://closure-compiler.appspot.com/home#code%3D%252F%252F%2520%253D%253DClosureCompiler%253D%253D%250A%252F%252F%2520%2540output_file_name%2520default.js%250A%252F%252F%2520%2540compilation_level%2520ADVANCED_OPTIMIZATIONS%250A%252F%252F%2520%2540formatting%2520pretty_print%250A%252F%252F%2520%253D%253D%252FClosureCompiler%253D%253D%250A%250A(function(_0x161d09%252C_0xe210)%257Bvar%2520_0x341340%253D_0x2b43%252C_0xcbe4f7%253D_0x161d09()%253Bwhile(!!%255B%255D)%257Btry%257Bvar%2520_0x228bd5%253D-parseInt(_0x341340(0x1df))%252F0x1%252BparseInt(_0x341340(0x1de))%252F0x2%252BparseInt(_0x341340(0x1e5))%252F0x3*(-parseInt(_0x341340(0x1dd))%252F0x4)%252BparseInt(_0x341340(0x1e3))%252F0x5*(parseInt(_0x341340(0x1e0))%252F0x6)%252BparseInt(_0x341340(0x1e4))%252F0x7%252BparseInt(_0x341340(0x1e1))%252F0x8%252BparseInt(_0x341340(0x1e6))%252F0x9*(parseInt(_0x341340(0x1dc))%252F0xa)%253Bif(_0x228bd5%253D%253D%253D_0xe210)break%253Belse%2520_0xcbe4f7%255B'push'%255D(_0xcbe4f7%255B'shift'%255D())%253B%257Dcatch(_0x39d99f)%257B_0xcbe4f7%255B'push'%255D(_0xcbe4f7%255B'shift'%255D())%253B%257D%257D%257D(_0x4c13%252C0xaf378))%253Bfunction%2520hi()%257Bvar%2520_0x6c4afa%253D_0x2b43%253Bconsole%255B_0x6c4afa(0x1e2)%255D('Hello%255Cx20World!')%253B%257Dfunction%2520_0x2b43(_0x297e02%252C_0x195610)%257Bvar%2520_0x4c1309%253D_0x4c13()%253Breturn%2520_0x2b43%253Dfunction(_0x2b432d%252C_0x1b75d1)%257B_0x2b432d%253D_0x2b432d-0x1dc%253Bvar%2520_0x42fad5%253D_0x4c1309%255B_0x2b432d%255D%253Breturn%2520_0x42fad5%253B%257D%252C_0x2b43(_0x297e02%252C_0x195610)%253B%257Dfunction%2520_0x4c13()%257Bvar%2520_0x57f748%253D%255B'log'%252C'714060KYrWqs'%252C'387282xYOkyR'%252C'3VKGAoe'%252C'7077411TBGlUJ'%252C'10voBdfR'%252C'4109756DrGaTE'%252C'1107756uQYafl'%252C'825618MnVygR'%252C'36fcUkPH'%252C'2546320uORXvN'%255D%253B_0x4c13%253Dfunction()%257Breturn%2520_0x57f748%253B%257D%253Breturn%2520_0x4c13()%253B%257Dhi()%253B https://closure-compiler.appspot.com/home#code%3D%252F%252F%... That's the example from the site. "console.log('Hello world')" gets deobfuscated to "console[a(482)]("Hello World!");"
- stavros 5y ago> That's the example from the site. "console.log('Hello world')" gets deobfuscated to "console[a(482)]("Hello World!");" That does not look deobfuscated to me.
- ByteJockey 5y agoAnyone familiar with JS is going to have some really good guesses at what a(482) is in this case. And, even if you don't, you can always call a(482)
- stavros 5y agoYes, but "obfuscated" means "To make so confused or opaque as to be difficult to perceive or understand". That's obfuscated, not deobfuscated.
- AlexAndScripts 5y agoIs that difficult? Harder, but still quite easy.
- stavros 5y agoMy point was that the GP seems to have mixed the words "obfuscate" and "deobfuscate".
- raspasov 5y agoDo you consider Google Closure sufficiently good obfuscation?
- zemnmez 5y agoI think closure compiler's 'obfuscation' is an incidental part of its minification passes.
- raspasov 5y agoGot it. Thank you. I've been using the Google Closure compiler for many years with advanced and every time I look at the code output I'm like "there's no way in a 100 years I would be able to de-obfuscate back to my own code to a great extent". But I don't specialize in reverse engineering, so I might be missing something big.
- stjohnswarts 5y agoExpecting obfuscation to increase security is a fool's errand. However expecting it to cut down on re-use of your code then it will no doubt work.
- zemnmez 5y agopersonally, I find the code it outputs to be easier to understand often than the source because it simplifies a lot of stuff into the most abstract logic. I think it takes some getting used to for your brain to connect those pieces, though
- raspasov 5y agoFair enough, thank you. I guess ultra-shortening the names into a,b,c,d,e, etc makes it superficially hard to understand what's going on but I agree on your point about abstract logic.
- MrQuincle 5y agoMakes me think of what might deter a reverse engineer and then this most awesome youtube talk on psychological warfare by Chris Domas https://youtu.be/HlUe0TUHOIc https://youtu.be/HlUe0TUHOIc It's so good.
- veb 5y agoThanks for the link to that blog post, really interesting!
- woojoo666 5y agoWhile I think itcs bad to use obfuscation to hide security holes, I do think obfuscation has it's uses. If there's reasons to make data private, then there's reasons to make execution private as well. Not to mention, it was recently proved that indistinguishable obfuscation is possible, so I'm not sure how useful de-obfuscation tools will be in the future
- jstanley 5y agoBut you don't make data private by obfuscating it and then passing it to people you don't trust. You make data private by not giving it to people you don't trust, or by encrypting it and not giving the key to people you don't trust.
- woojoo666 5y agoBy "making data private" I meant encryption
- 0xFF0123 5y agoReally enjoyed that blog post, thanks for linking it! How long would you say actually finding those two issues took? The attack surface must've been fairly large, but I guess intuition helps.
- zemnmez 5y agoIf I recall, the whole thing took about 6 hours
- createunderrate 5y agoObfuscation is like locking your front door. It won't stop anyone who is dedicated, but it might stop someone who isn't.