ObfuscationMania! HALP

[nippel]

Sooo, they finally decided to add more obfucation in some parts of the exe, adding additional 20mb to it. From what I see so far, their main purpose was to obfuscate the exposed lua parts.
So far the packed .reloc section didnt really bother me, but now the lua parts are annoying. Is there anyone who is able to unpack this, or better, transfer this knowlegde in a usable manner or maybe just give some hints ? Because none of us ever had to bother with this so far and time is rare these days to read into such stuff...

[nippel]

After looking a bit more at it, it seems to be just a huge scrambled piece of bananacode where functions in the .text segment jump into and this piece of reloc code does some funny things I dont understand and then either goes back into a target func in the .text ... but sometimes parts of the function's code is actually executed in that reloc section...really not sure.

Anyway, whoever relied on lua functions or made their lives easy while "just getting these" is now most likely unable to use whatever he was using. They moved big parts of their lua into that weirdly packed/obfuscated/banana reloc section, probably to prevent the cheap lua injection bots from working.

I'm still interested in some hints on what exactly the code is doing there because I dont understand it and ida shows garbage

[Sirmabus]

Yea they certainly did throw more of that in there I see.
Luckily got my offsets okay, didn't effect me anyhow.
I guess depending on what you were doing it could mess you up, otherwise the worst I see of it that it makes it harder to track down and reverse some stuff if you didn't already have it.

I've seen a lot de-obfucation stuff on other sites as IDA plug-in's and what not.
As I recall they recursively walk over sections of these code blocks and show them as readable pseudo code, but never messed with one.
Does seem to be some sort of pattern with it. The trick then is to find the new entry point for them and treat them just as functions still if possible.

[cute_star]

yes , i also found it . Maybe we need to get more detailed infos for obfuscated parts .