Forums

Community Links
1. Terms, Privacy Policy & Frequently Asked Questions
  Terms, Privacy Policy & Frequently Asked Questions
  
  Very important! Please read before sign up and posting...
  
  Collection 2011
  
  Downloads
  
  Website Archives
  
  Telegram
  254,441 visits to this link
Community Discussions
1. Site Bug Reports and Feedback
  Site Bug Reports and Feedback
  
  Bugs, feedback and ideas regarding this site...
  - 2.3k posts
  Code Blocks Formatting
  
  whoknows, August 26Aug 26
Developers Forums
1. Programming and Coding
  Programming and Coding
  
  Programming and coding tips, help and solutions...
  - 12.8k posts
  Crystaldisk Info csharp Ata ssd and nvme information c# format
  
  jackyjask, Yesterday at 06:17 PM1 day
2. Programming Resources
  Programming Resources
  
  Share an interesting blog, news page or other resource...
  - 453 posts
  [Release source code(Make Public) fo Code Deobfuscator x86_32/64]
  
  root, 4 minutes ago4 min
3. Software Security
  Software Security
  
  Securing your software against reverse engineering...
  - 946 posts
  Best .Net Obfuscator
  
  Fr0Mu, August 12Aug 12
Reverse Code Engineering
1. Challenge of Reverse Engineering
  Challenge of Reverse Engineering
  
  Try a challenge or contribute your own, any platform or operating system...
  
  CrackMe
  
  KeygenMe
  
  UnPackMe
  
  UnPackMe (.NET)
  - 14.7k posts
  VMProtectDDK v3.84 x64 No.2 2024
  
  boot, Yesterday at 04:49 AM1 day
2. Hardware Reverse Engineering
  Hardware Reverse Engineering
  
  Reverse engineering of circuitry hardware and firmware...
  - 253 posts
  Help: Sentinel SuperPro LPT Backup/Emulation for Industrial Software (PPI)
  
  BfoX, August 23Aug 23
3. Network Security
  Network Security
  
  Discussions on network security, holes, exploits and other issues...
  - 452 posts
  Get past an Incapsula block HTTP request
  
  Progman, March 12Mar 12
4. Malware Reverse Engineering
  Malware Reverse Engineering
  
  Debugging, disassembling and documenting interesting malware...
  - 1.7k posts
  Live Malware Samples...
  
  ibay770, July 24Jul 24
5. Reverse Engineering Articles
  Reverse Engineering Articles
  
  Share an interesting blog, news page or other RE related site...
  - 2.5k posts
  Revteam Reverse Engineering Collection
  
  .hloire, August 2Aug 2
6. Employment and Careers
  Employment and Careers
  
  Discussions on employment and career paths in the industry...
  - 199 posts
  Software Reverse Engineer
  
  derekb, July 8Jul 8
Community Projects
1. Scylla Imports Reconstruction
  Scylla Imports Reconstruction
  
  Development and support forum for the Scylla project...
  - 506 posts
  Scylla Imports Reconstruction Source
  
  Progman, June 11, 20241 yr
2. x64dbg
  x64dbg
  
  An open-source x64/x32 debugger for windows...
  - 1.3k posts
  I have a compiled Python project designed to bypass security checks.
  
  jackyjask, August 7Aug 7
3. Future Community Projects
  Future Community Projects
  
  Looking for support and interested partners for a future project?
  - 148 posts
  [C++] The Enigma Protector Devirtualizer Source Code
  
  Progman, May 29, 20241 yr
4. Community Projects Archive
  Community Projects Archive
  
  Old and inactive projects moved to long term support...
  
  uPPP
  
  Imports Fixer
  
  TitanEngine CE
  - 827 posts
  TitanEngine retarged solution problem
  
  MR.Med.Ali, Yesterday at 08:27 PM1 day

27,080 Total Members
7,713 Most Online
jay1972 Newest Member · 3 hours ago3 hr

[Release source code(Make Public) fo Code Deobfuscator x86_32/64]

The tool was designed for obfuscated code, not for handling standard code with external calls (iat, etc.).
So, when splitting blocks, an address will likely be invalid.
There's nothing stopping you from implementing and adding new features to the code.

procedure TCFG_Analysis.SplitBlock( split_addr: UInt64); (* Split basic block @ split_addr and create a new basic_blocks[] entry. *) var bb_head,orig_head : UInt64; instr : TCfGIns; tmpIns : TIns; begin OutDbg( Format('>Function:SplitBlock - Entry splitting @ [%08x] ',[split_addr])); if Fbasic_blocks.ContainsKey(split_addr) then Exit; bb_head := split_addr; orig_head := DFSBBSearchHead(split_addr); if orig_head = 0 then begin OutDbg(Format('>Function:SplitBlock - Failed @ [%08x]: orig_head=None ',[split_addr])); // raise Exception.Create('SplitBlock: orig_head not found'); end; OutDbg(Format('>Function:SplitBlock - Got orig_head [%08x] ',[orig_head])); // Create new BBlock Fbasic_blocks.Add(bb_head,[]) ; if Length(Fbasic_blocks[orig_head]) > 0 then begin tmpIns:= Fbasic_blocks[orig_head]; instr := tmpIns[ High(Fbasic_blocks[orig_head]) ]; SetLength(tmpIns, Length(Fbasic_blocks[orig_head])-1); Fbasic_blocks[orig_head] := tmpIns; end else Exit; while True do begin tmpIns:= Fbasic_blocks[orig_head]; Insert(instr,tmpIns,0 ); Fbasic_blocks[orig_head] := tmpIns; if instr.OriginEA = bb_head then break ; tmpIns:= Fbasic_blocks[orig_head]; instr := tmpIns[ High(Fbasic_blocks[orig_head]) ]; SetLength(tmpIns, Length(Fbasic_blocks[orig_head])-1); Fbasic_blocks[orig_head] := tmpIns; end; OutDbg(Format('>>Function:SplitBlock - Split @ [%08x]; original @ [%08x]',[split_addr,orig_head])); end;

By root · 4 minutes ago4 min
[Release source code(Make Public) fo Code Deobfuscator x86_32/64]

I fully agree
but the question was about this - why?
>EListError: Item not found

By jackyjask · 9 hours ago9 hr
[Release source code(Make Public) fo Code Deobfuscator x86_32/64]

there is nothing to deobfuscate in that code, the list remains empty

text:0000000000400250 .text:0000000000400250 ; =============== S U B R O U T I N E ======================================= .text:0000000000400250 .text:0000000000400250 ; Attributes: bp-based frame .text:0000000000400250 .text:0000000000400250 public start .text:0000000000400250 start proc near ; DATA XREF: HEADER:00000000004000B0↑o .text:0000000000400250 .text:0000000000400250 var_20 = qword ptr -20h .text:0000000000400250 .text:0000000000400250 enter 40h, 0 .text:0000000000400254 and [rsp+40h+var_20], 0 .text:000000000040025A mov ecx, offset __ImageBase ; hInstance .text:000000000040025F mov edx, 64h ; 'd' ; lpTemplateName .text:0000000000400264 xor r8d, r8d ; hWndParent .text:0000000000400267 lea r9, DialogFunc ; lpDialogFunc .text:000000000040026E call cs:DialogBoxParamA .text:0000000000400274 xor ecx, ecx .text:0000000000400276 call cs:RtlExitUserProcess .text:0000000000400276 start endp ; sp-analysis failed .text:0000000000400276 .text:000000000040027C .text:000000000040027C ; =============== S U B R O U T I N E ======================================= .text:000000000040027C .text:000000000040027C ; Attributes: bp-based frame .text:000000000040027C .text:000000000040027C ; INT_PTR __stdcall DialogFunc(HWND, UINT, WPARAM, LPARAM) .text:000000000040027C DialogFunc proc near ; DATA XREF: start+17↑o .text:000000000040027C .text:000000000040027C format = dword ptr -80h .text:000000000040027C h = qword ptr -5Ch .text:000000000040027C ho = qword ptr -54h .text:000000000040027C Paint = tagPAINTSTRUCT ptr -48h .text:000000000040027C hWnd = qword ptr 10h .text:000000000040027C .text:000000000040027C enter 0A0h, 0 .text:0000000000400280 mov [rbp+hWnd], rcx .text:0000000000400284 cmp edx, 110h .text:000000000040028A jz short loc_4002E5 .text:000000000040028C cmp edx, 111h .text:0000000000400292 jz loc_400654 .text:0000000000400298 cmp edx, 10h .text:000000000040029B jz loc_40065A .text:00000000004002A1 cmp edx, 113h .text:00000000004002A7 jz loc_4003C2 .text:00000000004002AD cmp edx, 0Fh .text:00000000004002B0 jz loc_4004BC .text:00000000004002B6 cmp edx, 201h .text:00000000004002BC jnz loc_40067C .text:00000000004002C2 call cs:ReleaseCapture .text:00000000004002C8 mov rcx, [rbp+hWnd] ; hWnd .text:00000000004002CC mov edx, 112h ; Msg .text:00000000004002D1 mov r8d, 0F012h ; wParam .text:00000000004002D7 xor r9d, r9d ; lParam .text:00000000004002DA call cs:SendMessageA .text:00000000004002E0 jmp loc_40067C .text:00000000004002E5 ; --------------------------------------------------------------------------- .text:00000000004002E5 .text:00000000004002E5 loc_4002E5: ; CODE XREF: DialogFunc+E↑j .text:00000000004002E5 call cs:GetTickCount .text:00000000004002EB mov cs:dword_400800, eax .text:00000000004002F1 push offset pszFaceName ; pszFaceName .text:00000000004002F6 push 1 ; iPitchAndFamily .text:00000000004002F8 push 2 ; iQuality .text:00000000004002FA push 0 ; iClipPrecision .text:00000000004002FC push 6 ; iOutPrecision .text:00000000004002FE push 0 ; iCharSet .text:0000000000400300 push 0 ; bStrikeOut .text:0000000000400302 push 0 ; bUnderline .text:0000000000400304 push 0 ; bItalic .text:0000000000400306 push 2BCh ; cWeight .text:000000000040030B sub esp, 20h .text:000000000040030E mov ecx, 50h ; 'P' ; cHeight .text:0000000000400313 mov edx, 19h ; cWidth .text:0000000000400318 xor r8d, r8d ; cEscapement .text:000000000040031B xor r9d, r9d ; cOrientation .text:000000000040031E call cs:CreateFontA .text:0000000000400324 mov cs:h, rax .text:000000000040032B mov ecx, 40h ; '@' ; uFlags .text:0000000000400330 mov edx, 400h ; dwBytes .text:0000000000400335 call cs:GlobalAlloc .text:000000000040033B mov cs:qword_4007F8, rax .text:0000000000400342 mov edi, eax .text:0000000000400344 mov ecx, 40h ; '@'

By root · 11 hours ago11 hr
[Release source code(Make Public) fo Code Deobfuscator x86_32/64]

1st issue on sample masm binary -
(400250 = EP VA)
c:\CodeDeob-main\Win32\Debug\123>Deob1.exe fire.exe $400250
CodeDeob cli demo util v0.1 (c) 2025 by jj
EListError: Item not found
fire.zip

By jackyjask · 12 hours ago12 hr
TitanEngine retarged solution problem

btw any documentation for the lib ?

By MR.Med.Ali · Yesterday at 08:27 PM1 day

AT4RE Power Loader

New Version 0.7.7 Published
Release Date: 28/08/2025

By m!x0r · Thursday at 12:25 PM4 days
AT4RE Power Loader

There is not any version 0.7.6 Check www.at4re.net latest one is 0.7.5
Any new version like 0.7.6 is backdoored.

By m!x0r · August 26Aug 26
AT4RE Power Loader

Version 7.6 is out, if not linked later will add it on here

By H1TC43R · August 25Aug 25
Baymax Patch toOls

what maximum number of hijacking dll?If i added 28 dll and make hijack patch-its loaded empty

By igorca · August 21Aug 21
AT4RE Power Loader

False report our tools are 100% clean and because the PECompact Packer you got this fake result, unpack the tools manually and will become clean.

By m!x0r · August 18Aug 18

Love Tuts 4 You? Tell a friend!

Sign In

Member Statistics

Configure browser push notifications

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)