relative / synchrony

javascript-obfuscator cleaner & deobfuscator
https://deobfuscate.relative.im/
GNU General Public License v3.0
849 stars 109 forks source link

Indices for arguments to fn refs aren't resolved properly #1

Closed relative closed 2 years ago

relative commented 3 years ago

For example:

var _0x51a8fc = function (
    _0x171899,
    _0x663a91,
    _0x523403,
    _0xfca0ae,
    _0x57a48c
  ) {
    return _0x4b3629(
      _0x171899 - 0x35,
      _0xfca0ae - -0x2ba,
      _0x523403 - 0xef,
      _0xfca0ae - 0x121,
      _0x523403
    );
  };
  var _0x343937 = function (
    _0x4a0407,
    _0x5d8ad0,
    _0x5879ca,
    _0x2ee7dc,
    _0x261c1b
  ) {
    return _0x24f9aa(
      _0x4a0407 - 0x170,
      _0x2ee7dc - -0x2ba,
      _0x5879ca - 0xe0,
      _0x2ee7dc - 0xea,
      _0x5879ca
    );
  };
  var _0x148a26 = function (
    _0x3e61e7,
    _0x4f6791,
    _0x2ce192,
    _0xbb2e8,
    _0x45df3b
  ) {
    return _0x45af66(
      _0x3e61e7 - 0x143,
      _0xbb2e8 - -0x2ba,
      _0x2ce192 - 0x86,
      _0xbb2e8 - 0x181,
      _0x2ce192
    );
  };
  var _0x41e190 = function (
    _0x479c13,
    _0x26f46b,
    _0x14a30d,
    _0x1e1288,
    _0x4fd26b
  ) {
    return _0x2e7636(
      _0x479c13 - 0xa6,
      _0x1e1288 - -0x2ba,
      _0x14a30d - 0x66,
      _0x1e1288 - 0x6f,
      _0x14a30d
    );
  };

All of these functions resolve an offset array of [0, -1]. This must be solved before the StringDecoder will work on scripts like this

This should be fixed by checking the parent decNode in idents array and comparing the arguments in the new function to the parent decoder