ben-sb / javascript-deobfuscator

General purpose JavaScript deobfuscator
https://deobfuscate.io
Apache License 2.0
747 stars 106 forks source link

nested references #28

Closed acuifex closed 2 years ago

acuifex commented 2 years ago

Hello! found an interesting piece of scam code in the "wild": https://gofile.io/d/jhJW5T

it contains arrays with references to other arrays. that code doesn't get untangled in a single pass

example:

const firststage = ['\x54\x6f\x74a\x6c', '\x6c\x6f\x67', '\x3a\x20'];
const secondstage = [firststage[0], firststage[1], firststage[2]];
const thirdstage = [secondstage[0], secondstage[1], secondstage[2]];
const fourthstage = [thirdstage[0], thirdstage[1], thirdstage[2]];
console.log(fourthstage[0], fourthstage[1], fourthstage[2]);

first pass:

const secondstage = ["Total", "log", ": "];
const thirdstage = [secondstage[0], secondstage[1], secondstage[2]];
const fourthstage = [thirdstage[0], thirdstage[1], thirdstage[2]];
console.log(fourthstage[0], fourthstage[1], fourthstage[2]);

second pass:

const thirdstage = ["Total", "log", ": "];
const fourthstage = [thirdstage[0], thirdstage[1], thirdstage[2]];
console.log(fourthstage[0], fourthstage[1], fourthstage[2]);

... you get the idea

expected after first pass:

console.log("Total", "log", ": ");
ben-sb commented 2 years ago

Should be implemented in 97fbf2250bc27ed78e2d3acffd4527423817b31b