4JX
commented
2 years ago Encountered my own of these in the wild and decided to give it a go, with the addition of a small hack (aside from actual working code) I'm able to get it to deobfuscate my specific case.
I'm however not too sure of where I should manage things it identifies as missing decoders, such as:
var _0x15cb61 = function (_0x231a76, _0x41587e) {
var _0x3ff030 = _0x5e893b
return (
Math[_0x3ff030(0x2ba)](Math['random']() * (_0x41587e + 0x1 - _0x231a76)) +
_0x231a76
)
}Where _0x5e893b is a reassignment of the handled global decode func:
var _0x4283 = function (_0x1cc98f, _0x55ec98) {
_0x1cc98f = _0x1cc98f - 0x1de
var _0x5c48c0 = _0x5c48[_0x1cc98f] // <- Array of strings at the start of the file
return _0x5c48c0
}Or in the case of the gist from this issue:
var _0x499549 = function (_0x5268af, _0x3322eb, _0x5ca66e, _0x51471c) {
return _0x5904(_0x51471c - -0x2c0, _0x3322eb)
}Where _0x5904 is a string array (RC4) decode func.
relative
I'm trying to deobfuscate a script that I believe produced by a recent version of javascript-obfuscator. (based on original file date) synchrony
mastergives this message for it:Error: Failed to find string array with identifier "_0x26be" for push/shift calcsynchrony master full output
``` $ synchrony deobfuscate -l obf_source.js Running Simplify transformer Running MemberExpressionCleaner transformer Running LiteralMap transformer Running DeadCode transformer Running Demangle transformer Running StringDecoder transformer Caught an error while attempting to run AST visitor! node = Node { type: 'ExpressionStatement', start: 12017, end: 12936, range: [ 12017, 12936 ], expression: Node { type: 'CallExpression', start: 12018, end: 12934, range: [ 12018, 12934 ], callee: Node { type: 'FunctionExpression', start: 12018, end: 12896, range: [Array], id: null, params: [Array], generator: false, expression: false, async: false, body: [Node] }, arguments: [ [Node], [Node] ], optional: false } } err = Error: Failed to find string array with identifier "_0x26be" for push/shift calc at r (/somepath/synchrony-git/dist/index.js:28:23401) at ExpressionStatement (/somepath/synchrony-git/dist/index.js:28:23825) at s (/somepath/synchrony-git/dist/index.js:25:147) at Object.skipThrough (/somepath/synchrony-git/node_modules/acorn-walk/dist/walk.js:186:39) at s (/somepath/synchrony-git/dist/index.js:25:133) at Object.base.Program.base.BlockStatement.base.StaticBlock (/somepath/synchrony-git/node_modules/acorn-walk/dist/walk.js:198:7) at s (/somepath/synchrony-git/dist/index.js:25:133) at m (/somepath/synchrony-git/dist/index.js:28:22) at ge.shiftFinder (/somepath/synchrony-git/dist/index.js:28:23584) at ge.Maybe I'm misinterpreting the error message but there is a
_0x26bestring array on the very top of the source. Any pointers are appreciated and sorry for not able to provide a smaller source file.Source (obfuscated): https://gist.github.com/hazarkarabay/ad4a58939f234be78f369880fbcfbc9a Result: https://gist.github.com/hazarkarabay/e2f542a6cc2ec228aafa70e81c996caa
The 2.3.0 release gives different set of error messages;
Push/shift calculation failed (iter=1>maxLoops=0)andTypeError: UnaryExpression argument is not Literalsynchrony 2.3.0 full output
``` $ synchrony deobfuscate obf_source.js Running Simplify transformer Running MemberExpressionCleaner transformer Running LiteralMap transformer Running DeadCode transformer Running Demangle transformer Running StringDecoder transformer Caught an error while attempting to run AST visitor! node = Node { type: 'ExpressionStatement', start: 12017, end: 12936, range: [ 12017, 12936 ], expression: Node { type: 'CallExpression', start: 12018, end: 12934, range: [ 12018, 12934 ], callee: Node { type: 'FunctionExpression', start: 12018, end: 12896, range: [Array], id: null, expression: false, generator: false, async: false, params: [Array], body: [Node] }, arguments: [ [Node], [Node] ], optional: false } } err = Error: Push/shift calculation failed (iter=1>maxLoops=0) at n (/somepath/synchrony-git/dist/index.js:28:19527) at ExpressionStatement (/somepath/synchrony-git/dist/index.js:28:20577) at s (/somepath/synchrony-git/dist/index.js:25:147) at Object.skipThrough (/somepath/synchrony-git/node_modules/acorn-walk/dist/walk.js:186:39) at s (/somepath/synchrony-git/dist/index.js:25:133) at Object.base.Program.base.BlockStatement.base.StaticBlock (/somepath/synchrony-git/node_modules/acorn-walk/dist/walk.js:198:7) at s (/somepath/synchrony-git/dist/index.js:25:133) at d (/somepath/synchrony-git/dist/index.js:28:22) at ie.shiftFinder (/somepath/synchrony-git/dist/index.js:28:20336) at ie.