{"id":4701,"date":"2025-03-19T14:07:27","date_gmt":"2025-03-19T13:07:27","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=4701"},"modified":"2025-03-19T14:10:43","modified_gmt":"2025-03-19T13:10:43","slug":"code-deobfuscation","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=4701","title":{"rendered":"Code deobfuscation"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Tools:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/github.com\/mindedsecurity\/JStillery\">JStillery<\/a><\/li>\n\n\n\n<li><a href=\"http:\/\/jsnice.org\/\"><span class=\"caps\">JS<\/span> Nice<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/beautifier\/js-beautify\"><span class=\"caps\">JS<\/span> Beau\u00adti\u00adfy<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Exe\u00adcu\u00adtion pos\u00adsi\u00adbil\u00adi\u00adties for a dynam\u00adic analy\u00adsis, if deob\u00adfus\u00adca\u00adtion is not soooo&nbsp;good:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Spi\u00adder\u00admon\u00adkey<\/li>\n\n\n\n<li>Slimer\u00adJS<\/li>\n\n\n\n<li>Phan\u00adtomJS<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Tipp: Over\u00adwrite sen\u00adsi\u00adble meth\u00adods, if the lan\u00adguage allows it. For exam\u00adple, in JavaScript:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">eval = print<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Now, each eval state\u00adment is not exe\u00adcut\u00aded, but just printed&nbsp;:-).<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Tools: Exe\u00adcu\u00adtion pos\u00adsi\u00adbil\u00adi\u00adties for a dynam\u00adic analy\u00adsis, if deob\u00adfus\u00adca\u00adtion is not soooo&nbsp;good: Tipp: Over\u00adwrite sen\u00adsi\u00adble meth\u00adods, if the lan\u00adguage allows it. For exam\u00adple, in JavaScript: eval = print Now, each eval state\u00adment is not exe\u00adcut\u00aded, but just printed&nbsp;:-).<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[523],"tags":[524,22],"class_list":["post-4701","post","type-post","status-publish","format-standard","hentry","category-forensic","tag-deobfuscation","tag-malware"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/4701","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4701"}],"version-history":[{"count":3,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/4701\/revisions"}],"predecessor-version":[{"id":4704,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/4701\/revisions\/4704"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4701"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4701"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}