Closed menchaca88 closed 2 years ago
Hi, can you upload the sample to Pastebin please
is too big for pastebin. Let me try to find a smaller sample with the same issuee.
Hi! I got the same issue. The code: https://pastebin.com/tV2pbHL0 My logs:
PS C:\Users\elias\Desktop\deob\javascript-deobfuscator> npm run start
javascript-deobfuscator@1.0.8 start tsc && node dist/run.js
[2022-03-11T08:07:45.579Z]: Executing FunctionExecutor
[2022-03-11T08:07:45.671Z]: Executing ProxyRemover
C:\Users\elias\Desktop\deob\javascript-deobfuscator\dist\graph\graph.js:62
throw new Error(Cannot add duplicate edge ${edge.name}
);
^
Error: Cannot add duplicate edge 9021165fb4514548bf76f5ab3b64565c -> e9c17571e6794732a261cd154193a5de
at Graph.addEdge (C:\Users\elias\Desktop\deob\javascript-deobfuscator\dist\graph\graph.js:62:19)
at Controller.enter (C:\Users\elias\Desktop\deob\javascript-deobfuscator\dist\modifications\proxies\proxyRemover.js:137:44)
at Controller.__execute (C:\Users\elias\Desktop\deob\javascript-deobfuscator\node_modules\estraverse\estraverse.js:397:31)
at Controller.traverse (C:\Users\elias\Desktop\deob\javascript-deobfuscator\node_modules\estraverse\estraverse.js:501:28)
at Object.traverse (C:\Users\elias\Desktop\deob\javascript-deobfuscator\node_modules\estraverse\estraverse.js:713:27)
at ProxyRemover.findCycles (C:\Users\elias\Desktop\deob\javascript-deobfuscator\dist\modifications\proxies\proxyRemover.js:126:24)
at ProxyRemover.execute (C:\Users\elias\Desktop\deob\javascript-deobfuscator\dist\modifications\proxies\proxyRemover.js:37:14)
at Object.deobfuscate (C:\Users\elias\Desktop\deob\javascript-deobfuscator\dist\index.js:65:22)
at Object.
Should be fixed in 318c731d7e006054238e9745beaea5f2a1c279ee
Thanks, the error is gone but it's not deobfuscated, unfortunately. :/
Yes that script is obfuscated with a custom obfuscator so you'll need to make a custom deobfuscator for it (this repo is for general deobfuscation, not targeted towards any specific obfuscator). It shouldn't be too hard, looks like some standard string encoding and a confused attempt at control flow flattening.
throw new Error(
Cannot add duplicate edge ${edge.name}
); ^Error: Cannot add duplicate edge 2ce1078d75cc4f1d8a304a9f751328dd -> 1cc2b1e3099740bda8186cc9f072f0f8 at Graph.addEdge (/Projects/javascript-deobfuscator-master/dist/graph/graph.js:62:19) at Controller.enter (/Projects/javascript-deobfuscator-master/dist/modifications/proxies/proxyRemover.js:137:44) at Controller.__execute (/Projects/javascript-deobfuscator-master/node_modules/estraverse/estraverse.js:397:31) at Controller.traverse (/Projects/javascript-deobfuscator-master/node_modules/estraverse/estraverse.js:501:28) at Object.traverse (/Projects/javascript-deobfuscator-master/node_modules/estraverse/estraverse.js:713:27) at ProxyRemover.findCycles (/Projects/javascript-deobfuscator-master/dist/modifications/proxies/proxyRemover.js:126:24) at ProxyRemover.execute (/Projects/javascript-deobfuscator-master/dist/modifications/proxies/proxyRemover.js:37:14) at Object.deobfuscate (/Projects/javascript-deobfuscator-master/dist/index.js:65:22) at Object. (/Projects/javascript-deobfuscator-master/dist/run.js:28:24)
at Module._compile (node:internal/modules/cjs/loader:1097:14)
source.js
Hi, I don't know if it is due to some anti-tampering mechanism.
If so, how could I identify it to remove it?