javascript-obfuscator / gulp-javascript-obfuscator

Gulp plugin for javascript-obfuscator package.
100 stars 38 forks source link

Bad regex causes code to fail #27

Open greg00000 opened 4 years ago

greg00000 commented 4 years ago

When using these options: { compact: false, identifierNamesGenerator: 'mangled', stringArray: true, stringArrayEncoding: 'base64' }

This code:

main(); function main() { alert("Hello world!") }

Obfuscates as the following code, which fails due to the regex /=+$/:

var a = ['SGVsbG8gd29ybGQh']; (function (c, d) { var e = function (f) { while (--f) { c['push'](c['shift']()); } }; e(++d); }(a, 0x6f)); var b = function (c, d) { c = c - 0x0; var e = a[c]; if (b['yZthrT'] === undefined) { (function () { var f = function () { var g; try { g = Function('return\x20(function()\x20' + '{}.constructor(\x22return\x20this\x22)(\x20)' + ');')(); } catch (h) { g = window; } return g; }; var i = f(); var j = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='; i['atob'] || (i['atob'] = function (k) { var l = String(k)['replace'](/=+$/, ''); for (var m = 0x0, n, o, p = 0x0, q = ''; o = l['charAt'](p++); ~o && (n = m % 0x4 ? n * 0x40 + o : o, m++ % 0x4) ? q += String['fromCharCode'](0xff & n >> (-0x2 * m & 0x6)) : 0x0) { o = j['indexOf'](o); } return q; }); }()); b['aypUXW'] = function (r) { var s = atob(r); var t = []; for (var u = 0x0, v = s['length']; u < v; u++) { t += '%' + ('00' + s['charCodeAt'](u)['toString'](0x10))['slice'](-0x2); } return decodeURIComponent(t); }; b['EhRyAC'] = {}; b['yZthrT'] = !![]; } var w = b['EhRyAC'][c]; if (w === undefined) { e = b['aypUXW'](e); b['EhRyAC'][c] = e; } else { e = w; } return e; }; main(); function main() { alert(b('0x0')); }

greg00000 commented 4 years ago

Tried to replicate this via https://obfuscator.io/ and it passes on that page. But fails in ESTK (the interpreter used for using JS with Adobe products, and the basis of JS for extension panels in Photoshop, InDesign, Ilustrator, etc), which is based on ecmascript 3 I believe. Old, but an important platform for many developers.

This line specifically fails due to the different interpretation of the unescaped equals sign: var l = String(k)'replace';