Open luluxiuxiu opened 2 weeks ago
I will go through the script later. Performing a quick scan through the js, looks like it's pretty much the same? Mabye, we need a test to compare the expected obfuscated js and what is actually downloaded from bet365.
Looks like bet365 has renamed the variables in the obfuscated code. It should be pretty easy to fix. I will make the changes when I have time. Please don't download files from unknown origins.
Ok,Thanks
how to work on windows? and i cant run on macos, new script code start with:
(function(){ var _0x3bf7=['push','pow','repeat','pop','0x0','apply','charCodeAt','indexOf','jQOejQSeZAUAAGQGAABkCgAEbElcTaAICQpfBwgAZAsAAAgMBynsDgAAA+hkFAAORlt3X01KREFKd11cQUSgEwkUZBUADX9NSltBXE1rR0ZOQU+gEhMVZBYAC3tten5tend8YWVtoBASFmQbAAdPTVx8QUVNoBoHG1sZGgcA7BwAAAPo6BgZHHUXGJ4MDxAXCA0OD
full file: full_encode.zip