search

ben-sb / deobfuscator-io-archived

73 stars 17 forks source link

Problem obfuscation code #4

Closed Aerovin closed 3 years ago

Aerovin commented 3 years ago

Hi thanks for this awesome project. btw i try to deobfus this code but not working:

https://pastebin.com/gCqCrgeP

error log:

> deobfuscator-io@1.0.0 start
> node src/deobfuscator.js

Removed a self defending expression
Removed string array wrappers
Reversed string obfuscation
Unescaped strings

G:\NodeJS\deobfuscator-io\node_modules\esprima\dist\esprima.js:5035
                throw this.createError(index, line, col, description);
                ^
Error: Line 1: Unexpected token ILLEGAL
    at ErrorHandler.constructError (G:\NodeJS\deobfuscator-io\node_modules\esprima\dist\esprima.js:5012:22)
    at ErrorHandler.createError (G:\NodeJS\deobfuscator-io\node_modules\esprima\dist\esprima.js:5028:27)
    at ErrorHandler.throwError (G:\NodeJS\deobfuscator-io\node_modules\esprima\dist\esprima.js:5035:21)
    at Scanner.throwUnexpectedToken (G:\NodeJS\deobfuscator-io\node_modules\esprima\dist\esprima.js:5164:35)
    at Scanner.scanStringLiteral (G:\NodeJS\deobfuscator-io\node_modules\esprima\dist\esprima.js:5938:19)
    at Scanner.lex (G:\NodeJS\deobfuscator-io\node_modules\esprima\dist\esprima.js:6240:26)
    at Parser.nextToken (G:\NodeJS\deobfuscator-io\node_modules\esprima\dist\esprima.js:2079:34)
    at Parser.parseBinaryExpression (G:\NodeJS\deobfuscator-io\node_modules\esprima\dist\esprima.js:3117:34)
    at Parser.inheritCoverGrammar (G:\NodeJS\deobfuscator-io\node_modules\esprima\dist\esprima.js:2285:37)
    at Parser.parseConditionalExpression (G:\NodeJS\deobfuscator-io\node_modules\esprima\dist\esprima.js:3141:26) {
  index: 155983,
  lineNumber: 1,
  description: 'Unexpected token ILLEGAL'
}
npm ERR! code 1
npm ERR! path G:\NodeJS\deobfuscator-io
npm ERR! command failed
npm ERR! command C:\Windows\system32\cmd.exe /d /s /c node src/deobfuscator.js

windows 10 64 bit + latest nodejs

ben-sb commented 3 years ago

The issue was caused by newline characters in strings, I've fixed it in the latest commit.

It also looks like obfuscator.io have made a lot of changes to their string array wrapper functions (which isn't a very difficult fix but I suspect they'll just change it again if I release it publicly) so it won't fully deobfuscate that script.