Open Crystal-RainSlide opened 5 months ago
URL: https://hector.baidu.com/a.js
https://hector.baidu.com/a.js
a.js is a short one, so sad I'm not good enough to find out why the deobfuscator don't work.
a.js
Also there is a longer https://hectorstatic.baidu.com/1371300bc53d20f8.js, it can only be half de-obfs-ed in v2.4.5.
https://hectorstatic.baidu.com/1371300bc53d20f8.js
To decode it:
var sourceCode = `...`; [ ["_0x2cff('0x0')", "'TqBDY'"], ["_0x2cff('0x1')", "'|10|3'"], ["_0x2cff('0x2')", "'NDdmQ'"], ["_0x2cff('0x3')", "'TrNLm'"], ["_0x2cff('0x4')", "'12|8'"], ["_0x2cff('0x5')", "'qjiaL'"], ["_0x2cff('0x6')", "'pGOQI'"], ["_0x2cff('0x7')", "'YESEP'"], ["_0x2cff('0x8')", "'yKzbr'"], ["_0x2cff('0x9')", "'split'"], ["_0x2cff('0xa')", "'5|11|'"], ["_0x2cff('0xb')", "'LiNrn'"], ["_0x2cff('0xc')", "'wcaZc'"], ["_0x2cff('0xd')", "'LevDq'"], ["_0x2cff('0xe')", "'qQOxt'"], ["_0x2cff('0xf')", "'PzdNa'"], ["_0x2cff('0x10')", "'XJYMH'"], ["_0x2cff('0x11')", "'|2|13'"], ["_0x2cff('0x12')", "'1|0|1'"], ["_0x2cff('0x13')", "'4|6|7'"], ["_0x2cff('0x14')", "'|4|9|'"] ].forEach(([before, after]) => sourceCode = sourceCode.replaceAll(before, after)); console.log(sourceCode);
Note that, after this manual decode step, deobfuscator works fine on the FunctionExpressions.
FunctionExpression
URL:
https://hector.baidu.com/a.js
a.js
is a short one, so sad I'm not good enough to find out why the deobfuscator don't work.Also there is a longer
https://hectorstatic.baidu.com/1371300bc53d20f8.js
, it can only be half de-obfs-ed in v2.4.5.A snapshot of
``` js var _0x2495=['cEdPUUk=','WUVTRVA=','eUt6YnI=','c3BsaXQ=','NXwxMXw=','TGlOcm4=','d2NhWmM=','TGV2RHE=','cVFPeHQ=','UHpkTmE=','WEpZTUg=','fDJ8MTM=','MXwwfDE=','NHw2fDc=','fDR8OXw=','VHFCRFk=','fDEwfDM=','TkRkbVE=','VHJOTG0=','MTJ8OA==','cWppYUw='];(function(_0x4fcb42,_0x249590){var _0x2cff01=function(_0x175e8e){while(--_0x175e8e){_0x4fcb42['push'](_0x4fcb42['shift']());}};_0x2cff01(++_0x249590);}(_0x2495,0x1b3));var _0x2cff=function(_0x4fcb42,_0x249590){_0x4fcb42=_0x4fcb42-0x0;var _0x2cff01=_0x2495[_0x4fcb42];if(_0x2cff['fEIjCz']===undefined){(function(){var _0xf95bf2;try{var _0x3eee6d=Function('return\x20(function()\x20'+'{}.constructor(\x22return\x20this\x22)(\x20)'+');');_0xf95bf2=_0x3eee6d();}catch(_0x402702){_0xf95bf2=window;}var _0x38ab06='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';_0xf95bf2['atob']||(_0xf95bf2['atob']=function(_0x3071c7){var _0x3524dc=String(_0x3071c7)['replace'](/=+$/,'');var _0x15cb8d='';for(var _0x3af137=0x0,_0x2a3f28,_0x21d190,_0x35ef8d=0x0;_0x21d190=_0x3524dc['charAt'](_0x35ef8d++);~_0x21d190&&(_0x2a3f28=_0x3af137%0x4?_0x2a3f28*0x40+_0x21d190:_0x21d190,_0x3af137++%0x4)?_0x15cb8d+=String['fromCharCode'](0xff&_0x2a3f28>>(-0x2*_0x3af137&0x6)):0x0){_0x21d190=_0x38ab06['indexOf'](_0x21d190);}return _0x15cb8d;});}());_0x2cff['ZsjoFF']=function(_0x593685){var _0x54bfaf=atob(_0x593685);var _0x1e9d70=[];for(var _0xae8cc=0x0,_0x33ae87=_0x54bfaf['length'];_0xae8cc<_0x33ae87;_0xae8cc++){_0x1e9d70+='%'+('00'+_0x54bfaf['charCodeAt'](_0xae8cc)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x1e9d70);};_0x2cff['uytahu']={};_0x2cff['fEIjCz']=!![];}var _0x175e8e=_0x2cff['uytahu'][_0x4fcb42];if(_0x175e8e===undefined){_0x2cff01=_0x2cff['ZsjoFF'](_0x2cff01);_0x2cff['uytahu'][_0x4fcb42]=_0x2cff01;}else{_0x2cff01=_0x175e8e;}return _0x2cff01;};(function(){var _0x3fc986={};_0x3fc986[_0x2cff('0x8')]=_0x2cff('0x12')+_0x2cff('0x13')+_0x2cff('0x1')+_0x2cff('0x11')+_0x2cff('0x14')+_0x2cff('0xa')+_0x2cff('0x4');_0x3fc986[_0x2cff('0x7')]=function(_0x551a97,_0x5d60a3){return _0x551a97>>>_0x5d60a3;};_0x3fc986[_0x2cff('0x0')]=function(_0x1c765b,_0x329d15){return _0x1c765b&_0x329d15;};_0x3fc986[_0x2cff('0xf')]=function(_0x57bb10,_0x30dcf5){return _0x57bb10>>>_0x30dcf5;};_0x3fc986[_0x2cff('0x5')]=function(_0x3ec38d,_0x10a891){return _0x3ec38d&_0x10a891;};_0x3fc986[_0x2cff('0x10')]=function(_0x3d53a3,_0x352d91){return _0x3d53a3+_0x352d91;};_0x3fc986[_0x2cff('0xe')]=function(_0xc0713e,_0x19b803){return _0xc0713e+_0x19b803;};_0x3fc986[_0x2cff('0xc')]=function(_0x1a72b8,_0x4bd927){return _0x1a72b8+_0x4bd927;};_0x3fc986[_0x2cff('0x2')]=function(_0x327b8c,_0x346171){return _0x327b8c>>>_0x346171;};_0x3fc986[_0x2cff('0x6')]=function(_0x34e03a,_0x371081){return _0x34e03a|_0x371081;};_0x3fc986[_0x2cff('0x3')]=function(_0x2d639c,_0x4fbebe){return _0x2d639c<<_0x4fbebe;};_0x3fc986[_0x2cff('0xb')]=function(_0x39017d,_0xe1601e){return _0x39017d>>>_0xe1601e;};_0x3fc986[_0x2cff('0xd')]=function(_0x40928c,_0xae3a34){return _0x40928c+_0xae3a34;};var _0x5ec6dc=_0x3fc986;var _0x3f3d80=function(_0x44f2a1,_0x275148){var _0x17670e=_0x5ec6dc[_0x2cff('0x8')][_0x2cff('0x9')]('|');var _0x55362d=0x0;while(!![]){switch(_0x17670e[_0x55362d++]){case'0':_0x275148=[_0x5ec6dc[_0x2cff('0x7')](_0x275148[0x0],0x10),_0x5ec6dc[_0x2cff('0x0')](_0x275148[0x0],0xffff),_0x5ec6dc[_0x2cff('0x7')](_0x275148[0x1],0x10),_0x5ec6dc[_0x2cff('0x0')](_0x275148[0x1],0xffff)];continue;case'1':_0x44f2a1=[_0x5ec6dc[_0x2cff('0xf')](_0x44f2a1[0x0],0x10),_0x5ec6dc[_0x2cff('0x5')](_0x44f2a1[0x0],0xffff),_0x5ec6dc[_0x2cff('0xf')](_0x44f2a1[0x1],0x10),_0x5ec6dc[_0x2cff('0x5')](_0x44f2a1[0x1],0xffff)];continue;case'2':_0x3bd1dd[0x1]+=_0x5ec6dc[_0x2cff('0xf')](_0x3bd1dd[0x2],0x10);continue;case'3':_0x3bd1dd[0x2]+=_0x5ec6dc[_0x2cff('0x10')](_0x44f2a1[0x2],_0x275148[0x2]);continue;case'4':_0x3bd1dd[0x1]+=_0x5ec6dc[_0x2cff('0xe')](_0x44f2a1[0x1],_0x275148[0x1]);continue;case'5':_0x3bd1dd[0x1]&=0xffff;continue;case'6':_0x3bd1dd[0x3]+=_0x5ec6dc[_0x2cff('0xc')](_0x44f2a1[0x3],_0x275148[0x3]);continue;case'7':_0x3bd1dd[0x2]+=_0x5ec6dc[_0x2cff('0x2')](_0x3bd1dd[0x3],0x10);continue;case'8':return[_0x5ec6dc[_0x2cff('0x6')](_0x5ec6dc[_0x2cff('0x3')](_0x3bd1dd[0x0],0x10),_0x3bd1dd[0x1]),_0x5ec6dc[_0x2cff('0x6')](_0x5ec6dc[_0x2cff('0x3')](_0x3bd1dd[0x2],0x10),_0x3bd1dd[0x3])];case'9':_0x3bd1dd[0x0]+=_0x5ec6dc[_0x2cff('0xb')](_0x3bd1dd[0x1],0x10);continue;case'10':_0x3bd1dd[0x3]&=0xffff;continue;case'11':_0x3bd1dd[0x0]+=_0x5ec6dc[_0x2cff('0xd')](_0x44f2a1[0x0],_0x275148[0x0]);continue;case'12':_0x3bd1dd[0x0]&=0xffff;continue;case'13':_0x3bd1dd[0x2]&=0xffff;continue;case'14':var _0x3bd1dd=[0x0,0x0,0x0,0x0];continue;}break;}};}()); ```a.js
To decode it:
Note that, after this manual decode step, deobfuscator works fine on the
FunctionExpression
s.