search

j4k0xb / webcrack

Deobfuscate obfuscator.io, unminify and unpack bundled javascript
https://webcrack.netlify.app
MIT License
1.06k stars 126 forks source link

Error: Cannot read properties of undefined (reading 'charAt') #113

Open ohnnnooo opened 2 months ago

ohnnnooo commented 2 months ago

Describe the bug

Getting Error: Cannot read properties of undefined (reading 'charAt') when using https://webcrack.netlify.app/ to deobfuscate

Expected Behaviour

Deobfuscate

Code

https://abs.twimg.com/responsive-web/client-web/ondemand.s.d0ac096a.js

Logs

No response

0xdevalias commented 2 months ago

Full error/stack:

DeobfuscateContext.tsx:55 Error: Cannot read properties of undefined (reading 'charAt')
    at c.onmessage (index.js:235:53)
(anonymous) @ DeobfuscateContext.tsx:55

Which seems to correspond to this section of the code:

https://github.com/j4k0xb/webcrack/blob/404a331efd1fb48b2b3080dd1d0b5b6f0f874854/apps/playground/src/context/DeobfuscateContext.tsx#L48-L56

Specifically that error seems to come from evalCode:

https://github.com/j4k0xb/webcrack/blob/404a331efd1fb48b2b3080dd1d0b5b6f0f874854/apps/playground/src/sandbox.ts#L11-L17

At a bit of an informed guess, I believe that is being triggered by this section of sandbox code as passed into the main webcrack function:

https://github.com/j4k0xb/webcrack/blob/404a331efd1fb48b2b3080dd1d0b5b6f0f874854/apps/playground/src/webcrack.worker.ts#L26-L54

With options.sandbox passed to applyTransformAsync here as part of options.deobfuscate:

https://github.com/j4k0xb/webcrack/blob/404a331efd1fb48b2b3080dd1d0b5b6f0f874854/packages/webcrack/src/index.ts#L158-L159

And applyTransformAsync is defined here:

https://github.com/j4k0xb/webcrack/blob/404a331efd1fb48b2b3080dd1d0b5b6f0f874854/packages/webcrack/src/ast-utils/transform.ts#L7-L21

As a naive guess, I think this may be caused by one of the 'deobfuscate' rules that relies on eval'ing the code; and presumably that code doesn't execute properly in eval in whatever state it is when it's being run (eg. maybe because it relies on not being unminified/etc at that point)

It looks like when this error is hit, the whole deobfuscate process may bail out. I haven't looked too deeply, but I wonder if it would be possible to skip the eval part when it errors out, or return the partially decrypted code at that point or similar?

I wonder if it also might be helpful to add some extra context to that evalCode catch within DeobfuscateContext.tsx so that it makes it more obvious that the error comes from trying to eval the minified code, and not from a bug in webcrack itself.