Closed softwebtuts closed 2 years ago
beshoo
commented
2 years ago Dear @relative, What is your advice to decode the same type of this obfuscateion https://www.nike.com/149e9513-01fa-4fb0-aad4-566afd725d1b/2d206a39-8ed7-437e-a3be-862e0f06eea3/p.js
relative
commented
2 years ago Dear @relative, What is your advice to decode the same type of this obfuscateion https://www.nike.com/149e9513-01fa-4fb0-aad4-566afd725d1b/2d206a39-8ed7-437e-a3be-862e0f06eea3/p.js
fixed in https://github.com/relative/synchrony/releases/tag/2.1.4, update synchrony with npm install --global deobfuscator@2.1.4 and try again
beshoo
commented
2 years ago Dear @relative, What is your advice to decode the same type of this obfuscateion https://www.nike.com/149e9513-01fa-4fb0-aad4-566afd725d1b/2d206a39-8ed7-437e-a3be-862e0f06eea3/p.js
fixed in https://github.com/relative/synchrony/releases/tag/2.1.4, update synchrony with
npm install --global deobfuscator@2.1.4and try again
Thank you for your kind reply I have this log
D:\xampp\htdocs\move\test\akamai-deobfuscator-master>synchrony deobfuscate ./script.txt
Running Simplify transformer
Running MemberExpressionCleaner transformer
Running LiteralMap transformer
Running StringDecoder transformer
Found decoder function _0x49cf offset = -175 type = 1
Found string array at _0x24f6 # 115
Found func ref id = _0x39a740 offset = -988 index = 1 key = 3 parent = _0x49cf
Found func ref id = _0x4c35a8 offset = -220 index = 1 key = 2 parent = _0x49cf
Found func ref id = _0x23bc57 offset = -995 index = 2 key = 1 parent = _0x49cf
Found func ref id = _0x5b2982 offset = -540 index = 3 key = 0 parent = _0x49cf
Found func ref id = _0xe4c1d3 offset = 636 index = 3 key = 0 parent = _0x23bc57
Found func ref id = _0x197cb8 offset = 410 index = 1 key = 0 parent = _0x49cf
Found func ref id = _0x276428 offset = -897 index = 2 key = 1 parent = _0x49cf
Found func ref id = _0x23ce32 offset = 1175 index = 1 key = 2 parent = _0xe4c1d3
Found func ref id = _0x21a6ca offset = -462 index = 3 key = 1 parent = _0x49cf
Found func ref id = _0x57a1e8 offset = 891 index = 3 key = 0 parent = _0xe4c1d3
Found func ref id = _0xc65240 offset = 1403 index = 3 key = 2 parent = _0x23bc57
Found func ref id = _0xd26c95 offset = 903 index = 2 key = 0 parent = _0x49cf
Found func ref id = _0x191f2f offset = -631 index = 0 key = 3 parent = _0x49cf
Found func ref id = _0x5602d3 offset = -1366 index = 2 key = 1 parent = _0xd26c95
Found func ref id = _0x2f3041 offset = -1348 index = 1 key = 2 parent = _0xd26c95
Found func ref id = _0x2ca01e offset = 337 index = 1 key = 3 parent = _0x49cf
Found func ref id = _0x139ea3 offset = -238 index = 0 key = 3 parent = _0x49cf
Found func ref id = _0x999e92 offset = 478 index = 1 key = 2 parent = _0x49cf
Found func ref id = _0x3e0cd1 offset = -124 index = 1 key = 3 parent = _0x999e92
Found func ref id = _0x5945c6 offset = -586 index = 0 key = 3 parent = _0x139ea3
Found func ref id = _0x24b8e8 offset = -165 index = 3 key = 1 parent = _0x3e0cd1
Found func ref id = _0xeb4a2e offset = 924 index = 2 key = 0 parent = _0x5945c6
Found func ref id = _0x18021a offset = -1047 index = 1 key = 0 parent = _0x24b8e8
Found func ref id = _0x1a636f offset = 53 index = 2 key = 0 parent = _0xeb4a2e
Found func ref id = _0x11ea23 offset = -727 index = 2 key = 1 parent = _0x49cf
Found func ref id = _0x1b61c1 offset = 126 index = 2 key = 3 parent = _0x11ea23
Found func ref id = _0x19825d offset = 230 index = 2 key = 0 parent = _0x49cf
Found func ref id = _0xffbff6 offset = 324 index = 1 key = 0 parent = _0x49cf
Searching for more function references
Found push/shift IIFE breakCond = 629338
Running Simplify transformer
Running MemberExpressionCleaner transformer
Running Desequence transformer
Running ControlFlow transformer
_0x439ecf.ZPTVC = Literal
_0x439ecf.bIUny = Literal
_0x466212.PzBpY = Literal
_0x466212.EeTKp = Literal
_0x3624ed.gQQbx = FunctionExpression
_0x3624ed.tUDop = Literal
_0x3624ed.lLrWg = Literal
_0x3624ed.mpoQn = MemberExpression
_0x3624ed.DpinR = Literal
_0x583b0e.hziWB = Literal
_0x583b0e.eojGI = Literal
_0x583b0e.LieXQ = Literal
_0x4facf1.COIis = Literal
_0x4facf1.rWvxm = FunctionExpression
_0x4facf1.SwPgg = Literal
_0x4facf1.MTmQh = Literal
_0x4facf1.fDMUu = Literal
_0x4facf1.kIqua = Literal
_0x4facf1.xEmig = Literal
_0x4facf1.JnhNb = Literal
_0x4facf1.apTLL = Literal
_0x4facf1.VULbZ = Literal
_0x4facf1.dqAUP = FunctionExpression
_0x4facf1.gHxtA = Literal
Found control flow node id = _0x5f192b #fn = 3 #lit = 2
Found control flow node id = _0x5f0c78 #fn = 5 #lit = 9
Found control flow node id = _0x2061a5 #fn = 3 #lit = 9
Found control flow node id = _0x439ecf #fn = 0 #lit = 2
Found control flow node id = _0x466212 #fn = 0 #lit = 2
Found control flow node id = _0x583b0e #fn = 0 #lit = 3
Found control flow node id = _0x3624ed #fn = 1 #lit = 4
Found control flow node id = _0x4facf1 #fn = 2 #lit = 10
Found flattened control flow arr = [ '2', '0', '4', '3', '5', '1' ] idx = 0
Found flattened control flow arr = [ '3', '0', '1', '2', '5', '4' ] idx = 0
Running Desequence transformer
Running MemberExpressionCleaner transformer
Running Simplify transformer
Running DeadCode transformer
C:\Users\beshoo\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\escodegen\escodegen.js:2509
result = this[stmt.type](stmt, flags);
^
TypeError: Cannot read properties of undefined (reading 'type')
at CodeGenerator.generateStatement (C:\Users\beshoo\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\escodegen\escodegen.js:2509:28)
at block (C:\Users\beshoo\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\escodegen\escodegen.js:1466:38)
at CodeGenerator.VariableDeclaration (C:\Users\beshoo\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\escodegen\escodegen.js:1484:17)
at CodeGenerator.generateStatement (C:\Users\beshoo\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\escodegen\escodegen.js:2509:33)
at C:\Users\beshoo\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\escodegen\escodegen.js:1076:51
at withIndent (C:\Users\beshoo\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\escodegen\escodegen.js:577:9)
at CodeGenerator.BlockStatement (C:\Users\beshoo\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\escodegen\escodegen.js:1026:13)
at CodeGenerator.generateStatement (C:\Users\beshoo\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\escodegen\escodegen.js:2509:33)
at CodeGenerator.maybeBlock (C:\Users\beshoo\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\escodegen\escodegen.js:832:33)
at CodeGenerator.ForStatement (C:\Users\beshoo\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\escodegen\escodegen.js:1672:30)
the code:
I am having a js code obfuscated in a different type which isn't supported in this tool. Look at this code here