relative / synchrony Goto Github PK
View Code? Open in Web Editor NEWjavascript-obfuscator cleaner & deobfuscator
Home Page: https://deobfuscate.relative.im/
License: GNU General Public License v3.0
synchrony's People
Contributors
Stargazers
Watchers
Forkers
peterg75 bbday thugie mjz19910 mengxinssfd j-jrt zhouao realradioactive splunk 4jx woshitezhonglang aliaryantech legaciespanda automata172 magointerior penguinehis amirwhitehat whitewingz2017 miniers whiteloveblue phatdatpq mbosinwa foxdev5g hxlxmjxbbxs karmamaster baziforyou hritikr dannycoin tom-snow snowywhite some-say xjubran kuustudio gmh5225 azurehaze21 tecnoweb shinonomechan ibrahem6 dmmca epictroller64 i-cnnn 0800092000 zaknight nipuna15 firehak 0xsubstratum motren infinitecod3 jmir1 yagniksojitra jaroloz freezing111 h1d3r optjust code-of raimundojimenez weieast abbayosua blackdzcuto avenjan treasure567 lwd-temp rival6821 ais1175 randshell hyowe amn5di55 w819314930 mr-kalindu-ofc egida npc2000 kxxt barbolo 5l1v3r1 bhatmand-forks 2659170494 ethicalsecurity-agency highbor khanhnb volentie localuser-isback icew4y pabx06 jingzhimincn guapier gungungun realpacket superman-enamy ely-mayor themehrankhan guanfoxyier cxapython emresudo lucia361 antman2023 jeyk lyfe-00011 cossinadevil2ksynchrony's Issues
Caught an error while attempting to run AST visitor!
node = {
"type": "FunctionExpression",
"start": 4477,
"end": 4508,
"range": [
4477,
4508
],
"id": null,
"expression": false,
"generator": false,
"async": false,
"params": [
{
"type": "Identifier",
"start": 4486,
"end": 4495,
"range": [
4486,
4495
],
"name": "_0x384137"
},
{
"type": "Identifier",
"start": 4496,
"end": 4505,
"range": [
4496,
4505
],
"name": "_0x323bb1"
}
],
"body": {
"type": "BlockStatement",
"start": 4506,
"end": 4508,
"range": [
4506,
4508
],
"body": []
}
}
err = TypeError: Cannot read properties of undefined (reading 'type')
Source file: device.txt
TypeError: UnaryExpression argument is not Literal
I'm having an issue while trying to deobfuscate the code that's contained in this site: https://agma.io/js/ag194.js?v=190
I'm using the latest version.
Output Code:
Running Simplify transformer Running MemberExpressionCleaner transformer Running LiteralMap transformer Running DeadCode transformer Running Demangle transformer Running StringDecoder transformer Found string array at _0x3859 # 1608 Found decoder function _0x1533 offset = -216 type = 0 Caught an error while attempting to run AST visitor!node = Node {
type: 'FunctionDeclaration',
start: 425379,
end: 425401,
range: [ 425379, 425401 ],
id: Node {
type: 'Identifier',
start: 425388,
end: 425397,
range: [ 425388, 425397 ],
name: '_0x151a5d'
},
expression: false,
generator: false,
async: false,
params: [],
body: Node {
type: 'BlockStatement',
start: 425399,
end: 425401,
range: [ 425399, 425401 ],
body: []
}
}
err = TypeError: Cannot read properties of undefined (reading 'type')
at G (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:918)
at FunctionDeclaration (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:16297)
at s (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.Program.base.BlockStatement.base.StaticBlock (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:198:7)
at s (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:133)
at Object.skipThrough (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.Function (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:296:5)
Found variable reference _0x29bb90 _0x1533
Found variable reference _0x3d46d4 _0x1533
Found variable reference _0x42cfe9 _0x1533
Found variable reference _0x518e86 _0x1533
Found variable reference _0x16b3e1 _0x29bb90
Found variable reference _0x428c2d _0x1533
Found variable reference _0x237bd1 _0x1533
Found variable reference _0x3530f5 _0x1533
Found variable reference _0x36980e _0x1533
Found variable reference _0x5acf04 _0x16b3e1
Found variable reference _0x596568 _0x16b3e1
Found variable reference _0x54db96 _0x16b3e1
Found variable reference _0x48b751 _0x16b3e1
Found variable reference _0x2ddb63 _0x16b3e1
Found variable reference _0x134431 _0x16b3e1
Found variable reference _0x2b6b01 _0x16b3e1
Found variable reference _0x4b6b97 _0x16b3e1
Found variable reference _0x2ea36a _0x16b3e1
Found variable reference _0x29e52c _0x1533
Searching for more variable references
Found push/shift IIFE breakCond = 319267
Caught an error while attempting to run AST visitor!
node = Node {
type: 'CallExpression',
start: 154791,
end: 154819,
range: [ 154791, 154819 ],
callee: Node {
type: 'Identifier',
start: 154791,
end: 154800,
range: [ 154791, 154800 ],
name: '_0x4b93e6'
},
arguments: [
Node {
type: 'UnaryExpression',
start: 154801,
end: 154818,
range: [Array],
operator: '!',
prefix: true,
argument: [Node]
}
],
optional: false
}
err = TypeError: UnaryExpression argument is not Literal
at J (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:9515)
at X (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:9862)
at C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:13772
at Array.map ()
at literals_to_arg_array (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:13760)
at CallExpression (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:22961)
at s (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:377:5)
Caught an error while attempting to run AST visitor!
node = Node {
type: 'CallExpression',
start: 238698,
end: 238990,
range: [ 238698, 238990 ],
callee: Node {
type: 'Identifier',
start: 238698,
end: 238707,
range: [ 238698, 238707 ],
name: '_0x234f8d'
},
arguments: [
Node {
type: 'UnaryExpression',
start: 238708,
end: 238801,
range: [Array],
operator: '',',
prefix: true,
argument: [Node]
},
Node {
type: 'UnaryExpression',
start: 238802,
end: 238895,
range: [Array],
operator: '
prefix: true,
argument: [Node]
},
Node {
type: 'UnaryExpression',
start: 238896,
end: 238989,
range: [Array],
operator: '~',
prefix: true,
argument: [Node]
}
],
optional: false
}
err = TypeError: UnaryExpression argument is not Literal
at J (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:9515)
at X (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:9862)
at C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:13772
at Array.map ()
at literals_to_arg_array (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:13760)
at CallExpression (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:22961)
at s (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.AssignmentExpression.base.AssignmentPattern (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:381:5)
Caught an error while attempting to run AST visitor!
node = Node {
type: 'CallExpression',
start: 241094,
end: 241323,
range: [ 241094, 241323 ],
callee: Node {
type: 'Identifier',
start: 241094,
end: 241103,
range: [ 241094, 241103 ],
name: '_0x234f8d'
},
arguments: [
Node {
type: 'UnaryExpression',
start: 241104,
end: 241176,
range: [Array],
operator: '',',
prefix: true,
argument: [Node]
},
Node {
type: 'UnaryExpression',
start: 241177,
end: 241249,
range: [Array],
operator: '
prefix: true,
argument: [Node]
},
Node {
type: 'UnaryExpression',
start: 241250,
end: 241322,
range: [Array],
operator: '~',
prefix: true,
argument: [Node]
}
],
optional: false
}
err = TypeError: UnaryExpression argument is not Literal
at J (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:9515)
at X (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:9862)
at C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:13772
at Array.map ()
at literals_to_arg_array (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:13760)
at CallExpression (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:22961)
at s (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.AssignmentExpression.base.AssignmentPattern (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:381:5)
Caught an error while attempting to run AST visitor!
node = Node {
type: 'CallExpression',
start: 318108,
end: 318168,
range: [ 318108, 318168 ],
callee: Node {
type: 'Identifier',
start: 318108,
end: 318116,
range: [ 318108, 318116 ],
name: 'setVideo'
},
arguments: [
Node {
type: 'UnaryExpression',
start: 318117,
end: 318167,
range: [Array],
operator: '~',
prefix: true,
argument: [Node]
}
],
optional: false
}
err = TypeError: UnaryExpression argument is not Literal
at J (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:9515)
at X (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:9862)
at C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:13772
at Array.map ()
at literals_to_arg_array (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:13760)
at CallExpression (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:22961)
at s (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.ConditionalExpression (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:385:5)
Caught an error while attempting to run AST visitor!
node = Node {
type: 'CallExpression',
start: 411591,
end: 411624,
range: [ 411591, 411624 ],
callee: Node {
type: 'Identifier',
start: 411591,
end: 411600,
range: [ 411591, 411600 ],
name: '_0x10d8ad'
},
arguments: [
Node {
type: 'UnaryExpression',
start: 411601,
end: 411618,
range: [Array],
operator: '!',
prefix: true,
argument: [Node]
},
Node {
type: 'Literal',
start: 411619,
end: 411623,
range: [Array],
operator: '!',
prefix: true,
argument: [Node],
value: true
}
],
optional: false
}
err = TypeError: UnaryExpression argument is not Literal
at J (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:9515)
at X (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:9862)
at C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:13772
at Array.map ()
at literals_to_arg_array (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:13760)
at CallExpression (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:22961)
at s (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.SequenceExpression (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:353:7)
Caught an error while attempting to run AST visitor!
node = Node {
type: 'CallExpression',
start: 449580,
end: 449610,
range: [ 449580, 449610 ],
callee: Node {
type: 'Identifier',
start: 449580,
end: 449599,
range: [ 449580, 449599 ],
name: 'setFriendlistOnline'
},
arguments: [
Node {
type: 'UnaryExpression',
start: 449600,
end: 449609,
range: [Array],
operator: '!',
prefix: true,
argument: [Node]
}
],
optional: false
}
err = TypeError: UnaryExpression argument is not Literal
at J (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:9515)
at X (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:9862)
at C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:13772
at Array.map ()
at literals_to_arg_array (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:13760)
at CallExpression (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:22961)
at s (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.ExpressionStatement.base.ParenthesizedExpression.base.ChainExpression (C:\Users\realk\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:204:37)
Running Simplify transformer
Running MemberExpressionCleaner transformer
Running Desequence transformer
Running ControlFlow transformer
_0x45bc60._0x29a5d1 = Identifier
_0x45bc60._0x3f1fa4 = Identifier
_0x22bb47._0x5e79a9 = Identifier
_0x22bb47._0x5e79a9 = CallExpression
Running Desequence transformer
Running MemberExpressionCleaner transformer
Running Simplify transformer
Running DeadCode transformer
Running Simplify transformer
Running DeadCode transformer
Help would be appreciated!
[request] Remove unnecessary things
A couple things:
- Remove unused parameters (or values in general):
async function sendToForum(_0x87a2bc) {
try {
location.href = "forum";
} catch (_0x3094304894) {
console.log("aaa");
}
}into
async function sendToForum() {
try {
location.href = "forum";
} catch {
console.log("aaa");
}
}- Un-functionify stuff? Not sure how to say it, but turn
(function () {
var _0x5da15e;
try {
var _0x9b11dd = Function(
'return (function() {}.constructor("return this")( ));'
);
_0x5da15e = _0x9b11dd();
} catch (_0x4312ea) {
_0x5da15e = window;
}
_0x5da15e.setInterval(_0x526f94, 4000);
})();into
var _0x5da15e;
try {
var _0x9b11dd = Function(
'return (function() {}.constructor("return this")( ));'
);
_0x5da15e = _0x9b11dd();
} catch (_0x4312ea) {
_0x5da15e = window;
}
_0x5da15e.setInterval(_0x526f94, 4000);ReferenceError
Host is down
https://deobfuscate.relative.im/ is just this:
The demo is currently down
https://deobfuscate.relative.im/ is unreachable
ya fuckin monk
ya fuckin monk
some mild feedback and random thoughts
i ran into a few issues using v2.3.0 that resulted in bad deobfuscation when using latest obfuscation (with self-defending enabled).
string-decoder:
using this decoder method as the example
function pi(t, e) {
var r = dc();
return pi = function(t, e) {
t -= 467;
var n = r[t];
return n
}, pi(t, e)
}at first glance it seems the only issue stopping valid decoder-detection is the AssignmentExpression.
it appears that v2.3.0 is expecting something like:
"expression": {
"type": "AssignmentExpression",
"operator": "=",
"left": {
"type": "Identifier",
"name": "t"
...
},
"right": {
"type": "BinaryExpression",
...
"left": {
"type": "Identifier",
"name": "t"
...
},
"operator": "-",
"right": {
"type": "Literal",
...
}
}but instead we have something along these lines
"expression": {
"type": "AssignmentExpression",
...
"operator": "-=",
"left": {
"type": "Identifier",
"name": "t"
...
},
"right": {
"type": "Literal",
...
}
}https://github.com/relative/synchrony/blob/master/src/transformers/stringdecoder.ts#L297
regarding string-array(s) detection
in cases where string-array detection failed it appeared to be in edge cases where calls to another string-decoder were present
function Bb() {
var t = n;
const e = ["OXksf", t(3334), t(2446), "hksLN", t(2759), ...];
return Bb = function() {
return e
}, Bb()
}where t variable pointing at pi (shown above).
incorrect string-decoder references detected
whats going on here is variable-scope isn't being respected with regards to locating string-decoder references.
var e = pi;
...
(function(t) {
(function(t, e) {
var r = pi;
...
function n(t, e) {
var r = pi;
if (!t) throw new Error(e || r(1382))
}
...
function c(t, e, i, a) {
var o = r;
for (var l = e; l < c; l++) {
...
}
return s
}
})
})this is a snippet of what i found that was causing incorrect removal of local variable declarations.
v2.3.0 will correctly tag the outer-scoped variable e as a reference to string-decoder pi.
equally and rightfully so the scoped variables r are tagged as references.
now that e and r sit in context.stringDecoderReferences the variable e in the for-loop body of function c is removed.
i did not solve this problem inside stringdecoder.ts. currently i don't have the knowledge to track variable scope.
what i did instead was modified rename.ts to find all instances of the string-decoders (ie: var t = pi;) and rename every reference to t then removed the node declaration of t, etc. so, basically refactor / cheap-inlined all references.
took a while to get a handle on dealing with obfuscator's self-defending stuff but looking back on this i think we could refactor/inline variables that reference the string-decoders. doing this would solve a few issues in v.2.3.0;
after my hacked up code changes to v2.3.0 i got very,very, good results.
ya fuckin monk
[request] Rename hex variables
Rename hex variables to something simplified
Example: _0x508725 to just var1
ya fuckin monk
Issue on rename
at Parser.pp$4.raise (/usr/local/lib/node_modules/deobfuscator/node_modules/acorn/dist/acorn.js:3460:15)
at Parser.pp$3.declareName (/usr/local/lib/node_modules/deobfuscator/node_modules/acorn/dist/acorn.js:3536:28)
at Parser.pp$7.checkLValSimple (/usr/local/lib/node_modules/deobfuscator/node_modules/acorn/dist/acorn.js:2136:50)
at Parser.pp$7.checkLValPattern (/usr/local/lib/node_modules/deobfuscator/node_modules/acorn/dist/acorn.js:2178:12)
at Parser.pp$7.checkLValInnerPattern (/usr/local/lib/node_modules/deobfuscator/node_modules/acorn/dist/acorn.js:2200:12)
at Parser.pp$7.checkLValInnerPattern (/usr/local/lib/node_modules/deobfuscator/node_modules/acorn/dist/acorn.js:2188:12)
at Parser.pp$7.checkLValPattern (/usr/local/lib/node_modules/deobfuscator/node_modules/acorn/dist/acorn.js:2165:12)
at Parser.pp$8.parseVarId (/usr/local/lib/node_modules/deobfuscator/node_modules/acorn/dist/acorn.js:1315:10)
at Parser.pp$8.parseVar (/usr/local/lib/node_modules/deobfuscator/node_modules/acorn/dist/acorn.js:1297:12)
at Parser.pp$8.parseVarStatement (/usr/local/lib/node_modules/deobfuscator/node_modules/acorn/dist/acorn.js:1163:10) {
pos: 4849,
loc: Position { line: 173, column: 27 },
raisedAt: 4869,
codeFrame: '\x1B[0m \x1B[90m 1 |\x1B[39m \x1B[33m;\x1B[39m\x1B[0m\n' +
Failed to find string array with identifier for push/shift calc
Caught an error while attempting to run AST visitor!
node = Node {
type: 'ExpressionStatement',
start: 0,
end: 6005,
range: [ 0, 6005 ],
expression: Node {
type: 'CallExpression',
start: 1,
end: 6003,
range: [ 1, 6003 ],
callee: Node {
type: 'FunctionExpression',
start: 1,
end: 5966,
range: [Array],
id: null,
expression: false,
generator: false,
async: false,
params: [Array],
body: [Node]
},
arguments: [ [Node], [Node] ],
optional: false
}
}
err = Error: Failed to find string array with identifier "e" for push/shift calc
How to fix .... :(
ya fuckin monk
ya fuckin monk
[request] More detailed return value from deobfuscateSource
In using the tool at API level, it would be really helpful to know if (and what) obfuscations were found. This is somewhat equivalent of capturing the "Found" logs that show up. Effectively I'm looking for an API that returns more than the deobfuscated source. Perhaps an object with the source, foundObfuscations: bool, maybe location pointers as well.
Given this would be API breaking, it seems like it may make more sense to expose a separate function.
I'm happy to help with a PR, but wanted to check interest and direction before proceeding.
Error: UnaryExpression argument is not Literal
Hello!
I have an error with the latest version. I just use synchrony deobfuscator ./file.js.
The code: https://pastebin.com/VSa39hag
The error:
Log output
Running Simplify transformer
Running MemberExpressionCleaner transformer
Running LiteralMap transformer
Running StringDecoder transformer
Caught an error while attempting to run AST visitor!
node = Node {
type: 'CallExpression',
start: 9973,
end: 10014,
callee: Node { type: 'Identifier', start: 9973, end: 9975, name: 'EF' },
arguments: [
Node {
type: 'UnaryExpression',
start: 9976,
end: 9989,
operator: 'typeof',
prefix: true,
argument: [Node]
},
Node {
type: 'CallExpression',
start: 9990,
end: 10013,
callee: [Node],
arguments: [Array],
optional: false
}
],
optional: false
}
err = TypeError: UnaryExpression argument is not Literal
at j (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:8407)
at W (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:8754)
at C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:12664
at Array.map (<anonymous>)
at literals_to_arg_array (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:12652)
at CallExpression (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:21581)
at p (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at p (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:376:5)
Caught an error while attempting to run AST visitor!
node = Node {
type: 'CallExpression',
start: 15527,
end: 15578,
callee: Node { type: 'Identifier', start: 15527, end: 15529, name: 'EF' },
arguments: [
Node {
type: 'UnaryExpression',
start: 15530,
end: 15555,
operator: 'typeof',
prefix: true,
argument: [Node]
},
Node {
type: 'CallExpression',
start: 15556,
end: 15577,
callee: [Node],
arguments: [Array],
optional: false
}
],
optional: false
}
err = TypeError: UnaryExpression argument is not Literal
at j (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:8407)
at W (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:8754)
at C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:12664
at Array.map (<anonymous>)
at literals_to_arg_array (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:12652)
at CallExpression (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:21581)
at p (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at p (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.IfStatement (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:206:5)
Caught an error while attempting to run AST visitor!
node = Node {
type: 'CallExpression',
start: 95980,
end: 96017,
callee: Node { type: 'Identifier', start: 95980, end: 95982, name: 'EF' },
arguments: [
Node {
type: 'UnaryExpression',
start: 95983,
end: 95992,
operator: 'typeof',
prefix: true,
argument: [Node]
},
Node {
type: 'CallExpression',
start: 95993,
end: 96016,
callee: [Node],
arguments: [Array],
optional: false
}
],
optional: false
}
err = TypeError: UnaryExpression argument is not Literal
at j (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:8407)
at W (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:8754)
at C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:12664
at Array.map (<anonymous>)
at literals_to_arg_array (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:12652)
at CallExpression (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:21581)
at p (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at p (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.ConditionalExpression (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:384:5)
Caught an error while attempting to run AST visitor!
node = Node {
type: 'CallExpression',
start: 96130,
end: 96171,
callee: Node { type: 'Identifier', start: 96130, end: 96132, name: 'pW' },
arguments: [
Node {
type: 'UnaryExpression',
start: 96133,
end: 96146,
operator: 'typeof',
prefix: true,
argument: [Node]
},
Node {
type: 'CallExpression',
start: 96147,
end: 96170,
callee: [Node],
arguments: [Array],
optional: false
}
],
optional: false
}
err = TypeError: UnaryExpression argument is not Literal
at j (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:8407)
at W (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:8754)
at C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:12664
at Array.map (<anonymous>)
at literals_to_arg_array (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:12652)
at CallExpression (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:21581)
at p (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at p (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.IfStatement (C:\Users\elias\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:206:5)
Running Simplify transformer
Running MemberExpressionCleaner transformer
Running Desequence transformer
Running ControlFlow transformer
s7.z3 = FunctionExpression
s7.TC = FunctionExpression
s7.G7 = Identifier
s7.G7 = Identifier
s7.jG = Identifier
s7.jG = Identifier
s7.G7 = Identifier
s7.G7 = Identifier
s7.jG = Identifier
s7.jG = Identifier
s7.G7 = Identifier
s7.G7 = Identifier
s7.jG = Identifier
s7.jG = Identifier
Running Desequence transformer
Running MemberExpressionCleaner transformer
Running Simplify transformer
Running DeadCode transformer
variable name change [request]
Is possible add something to rename variables startwith (_0x) into names more easy? (it is so powerfull to make diff changes between file verions compare old/new code) probably best code is start from "a" on each local function like
var AAA = function() {
{
var aaa = !![];
var bbb = 44;
var ccc = 333;
}
var BBB = function() {
{
var aaa = [];
var bbb = 45565;
}
var _0x4c9014 = function () {
var _0x29fca2 = !![];
return function (_0x519fa5, _0x5d069d) {
var _0x2a33ff = _0x29fca2 ? function () {
if (_0x5d069d) {
var _0x59f962 = _0x5d069d['apply'](_0x519fa5, arguments);
return _0x5d069d = null, _0x59f962;
}
} : function () {
};
return _0x29fca2 = ![], _0x2a33ff;
};
}()
to
var p = function() {
var q = !![];
return function(r, s) {
var t = q ? function() {
if (s) {
var u = s.apply(r, arguments);
return s = null, u;
}
} : function() {};
return q = ![], t;
};
}()
i found it in other script:
https://github.com/sd-soleaio/deobfuscator-io/blob/6955343e9505336359c68dbad19d436cf507645d/src/deobfuscator.js#L154
Other idea is remove function used to decript
name: 'StringDecoderTransformer',
params: {
identifiers: [['targetFunction', 0, targetFunction, 0]],
var _0x4d615f = targetFunction; < should be removed cause was replaced
if (typeof _0x2cc184 === "string") {
ya fuckin monk
I hosted the demo in my server for help the people
Cannot Deobfuscate what seems should be an easy task? (UnhandledPromiseRejectionWarning)
err = Error: Push/shift calculation failed (iter=347>maxLoops=346)
at n (/usr/local/lib/node_modules/deobfuscator/dist/index.js:28:19527)
at ExpressionStatement (/usr/local/lib/node_modules/deobfuscator/dist/index.js:28:20577)
at s (/usr/local/lib/node_modules/deobfuscator/dist/index.js:25:147)
at Object.skipThrough (/usr/local/lib/node_modules/deobfuscator/node_modules/acorn-walk/dist/walk.js:186:39)
at s (/usr/local/lib/node_modules/deobfuscator/dist/index.js:25:133)
at Object.base.Program.base.BlockStatement.base.StaticBlock (/usr/local/lib/node_modules/deobfuscator/node_modules/acorn-walk/dist/walk.js:198:7)
at s (/usr/local/lib/node_modules/deobfuscator/dist/index.js:25:133)
at d (/usr/local/lib/node_modules/deobfuscator/dist/index.js:28:22)
at ie.shiftFinder (/usr/local/lib/node_modules/deobfuscator/dist/index.js:28:20336)
at ie. (/usr/local/lib/node_modules/deobfuscator/dist/index.js:28:23355)
Running Simplify transformer
Running MemberExpressionCleaner transformer
Running Desequence transformer
Running ControlFlow transformer
Running Desequence transformer
Running MemberExpressionCleaner transformer
Running Simplify transformer
Running DeadCode transformer
Running Simplify transformer
Running DeadCode transformer
(node:4234) UnhandledPromiseRejectionWarning: TypeError: this[type] is not a function
at CodeGenerator.generateExpression (/usr/local/lib/node_modules/deobfuscator/node_modules/escodegen/escodegen.js:2496:28)
at /usr/local/lib/node_modules/deobfuscator/node_modules/escodegen/escodegen.js:1129:38
at withIndent (/usr/local/lib/node_modules/deobfuscator/node_modules/escodegen/escodegen.js:577:9)
at CodeGenerator.ClassBody (/usr/local/lib/node_modules/deobfuscator/node_modules/escodegen/escodegen.js:1124:13)
at CodeGenerator.generateStatement (/usr/local/lib/node_modules/deobfuscator/node_modules/escodegen/escodegen.js:2509:33)
at CodeGenerator.ClassDeclaration (/usr/local/lib/node_modules/deobfuscator/node_modules/escodegen/escodegen.js:1155:30)
at CodeGenerator.generateStatement (/usr/local/lib/node_modules/deobfuscator/node_modules/escodegen/escodegen.js:2509:33)
at CodeGenerator.Program (/usr/local/lib/node_modules/deobfuscator/node_modules/escodegen/escodegen.js:1714:43)
at CodeGenerator.generateStatement (/usr/local/lib/node_modules/deobfuscator/node_modules/escodegen/escodegen.js:2509:33)
at generateInternal (/usr/local/lib/node_modules/deobfuscator/node_modules/escodegen/escodegen.js:2530:28)
(node:4234) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag --unhandled-rejections=strict (see https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode). (rejection id: 1)
(node:4234) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.
Demo down (again)
Site down
please put back the site https://deobfuscate.relative.im/
How to deobfuscate like this code?
https://pastebin.com/Jv9pkHtd: ORIGINAL CODE
https://pastebin.com/MVr4UqtX: I tried deobfuscate, but almost didnt deobfuscate
How to deobfuscate this code?
Error while Deobfuscating
The code to deobfuscate: https://raw.githubusercontent.com/Bghwsx/test-code/main/client.js
The error is too big so I uploaded it too: https://raw.githubusercontent.com/Bghwsx/test-code/main/error.txt
The demo is currently down
The demo at https://deobfuscate.relative.im/ is currently down. Will it be up and running again?
New Release?
Hi @relative,
First of all, excellent tool!
I was wondering when a new build would be released? I want to have the output CLI option but it's not in v2.3.0.
Let me know what you think!
Kevin
err = TypeError: Cannot read properties of undefined (reading 'charAt')
I get this error when im trying to deobfuscate an approximately 11k line file with the latest version of the npm package.
https://s2.bunnycdn.ru/assets/_9anime/min/all.js?63aa358063aa35a1=
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.util_rc4_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16961)
at ge.decodeRC4 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17580)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15215)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:376:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 421344,
end: 421358,
range: [ 421344, 421358 ],
callee: {
type: 'Identifier',
start: 421344,
end: 421345,
range: [ 421344, 421345 ],
name: 'i'
},
arguments: [
{
type: 'Literal',
start: 421346,
end: 421349,
range: [Array],
value: 933,
raw: '933'
},
{
type: 'Literal',
start: 421351,
end: 421357,
range: [Array],
value: '(ZNR',
raw: '"(ZNR"'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.util_rc4_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16961)
at ge.decodeRC4 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17580)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15215)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:377:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 421361,
end: 421367,
range: [ 421361, 421367 ],
callee: {
type: 'Identifier',
start: 421361,
end: 421362,
range: [ 421361, 421362 ],
name: 'n'
},
arguments: [
{
type: 'Literal',
start: 421363,
end: 421366,
range: [Array],
value: 724,
raw: '724'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.decodeBase64 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17431)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15167)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:377:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 421378,
end: 421392,
range: [ 421378, 421392 ],
callee: {
type: 'Identifier',
start: 421378,
end: 421379,
range: [ 421378, 421379 ],
name: 'i'
},
arguments: [
{
type: 'Literal',
start: 421380,
end: 421383,
range: [Array],
value: 827,
raw: '827'
},
{
type: 'Literal',
start: 421385,
end: 421391,
range: [Array],
value: 'NdVE',
raw: '"NdVE"'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.util_rc4_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16961)
at ge.decodeRC4 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17580)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15215)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:377:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 421414,
end: 421420,
range: [ 421414, 421420 ],
callee: {
type: 'Identifier',
start: 421414,
end: 421415,
range: [ 421414, 421415 ],
name: 'n'
},
arguments: [
{
type: 'Literal',
start: 421416,
end: 421419,
range: [Array],
value: 897,
raw: '897'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.decodeBase64 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17431)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15167)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:376:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 421429,
end: 421443,
range: [ 421429, 421443 ],
callee: {
type: 'Identifier',
start: 421429,
end: 421430,
range: [ 421429, 421430 ],
name: 'i'
},
arguments: [
{
type: 'Literal',
start: 421431,
end: 421434,
range: [Array],
value: 654,
raw: '654'
},
{
type: 'Literal',
start: 421436,
end: 421442,
range: [Array],
value: 'NdVE',
raw: '"NdVE"'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.util_rc4_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16961)
at ge.decodeRC4 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17580)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15215)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:376:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 421446,
end: 421453,
range: [ 421446, 421453 ],
callee: {
type: 'Identifier',
start: 421446,
end: 421447,
range: [ 421446, 421447 ],
name: 'n'
},
arguments: [
{
type: 'Literal',
start: 421448,
end: 421452,
range: [Array],
value: 1395,
raw: '1395'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.decodeBase64 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17431)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15167)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:377:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 421481,
end: 421487,
range: [ 421481, 421487 ],
callee: {
type: 'Identifier',
start: 421481,
end: 421482,
range: [ 421481, 421482 ],
name: 'n'
},
arguments: [
{
type: 'Literal',
start: 421483,
end: 421486,
range: [Array],
value: 993,
raw: '993'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.decodeBase64 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17431)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15167)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:376:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 421519,
end: 421526,
range: [ 421519, 421526 ],
callee: {
type: 'Identifier',
start: 421519,
end: 421520,
range: [ 421519, 421520 ],
name: 'n'
},
arguments: [
{
type: 'Literal',
start: 421521,
end: 421525,
range: [Array],
value: 1166,
raw: '1166'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.decodeBase64 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17431)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15167)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:376:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 421529,
end: 421536,
range: [ 421529, 421536 ],
callee: {
type: 'Identifier',
start: 421529,
end: 421530,
range: [ 421529, 421530 ],
name: 'n'
},
arguments: [
{
type: 'Literal',
start: 421531,
end: 421535,
range: [Array],
value: 1400,
raw: '1400'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.decodeBase64 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17431)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15167)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:377:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 421597,
end: 421612,
range: [ 421597, 421612 ],
callee: {
type: 'Identifier',
start: 421597,
end: 421598,
range: [ 421597, 421598 ],
name: 'i'
},
arguments: [
{
type: 'Literal',
start: 421599,
end: 421603,
range: [Array],
value: 1037,
raw: '1037'
},
{
type: 'Literal',
start: 421605,
end: 421611,
range: [Array],
value: 'bFpI',
raw: '"bFpI"'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.util_rc4_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16961)
at ge.decodeRC4 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17580)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15215)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:376:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 421786,
end: 421792,
range: [ 421786, 421792 ],
callee: {
type: 'Identifier',
start: 421786,
end: 421787,
range: [ 421786, 421787 ],
name: 'n'
},
arguments: [
{
type: 'Literal',
start: 421788,
end: 421791,
range: [Array],
value: 438,
raw: '438'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.decodeBase64 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17431)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15167)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:376:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 421795,
end: 421809,
range: [ 421795, 421809 ],
callee: {
type: 'Identifier',
start: 421795,
end: 421796,
range: [ 421795, 421796 ],
name: 'i'
},
arguments: [
{
type: 'Literal',
start: 421797,
end: 421800,
range: [Array],
value: 739,
raw: '739'
},
{
type: 'Literal',
start: 421802,
end: 421808,
range: [Array],
value: 'm@Bu',
raw: '"m@Bu"'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.util_rc4_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16961)
at ge.decodeRC4 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17580)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15215)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:377:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 421812,
end: 421818,
range: [ 421812, 421818 ],
callee: {
type: 'Identifier',
start: 421812,
end: 421813,
range: [ 421812, 421813 ],
name: 'n'
},
arguments: [
{
type: 'Literal',
start: 421814,
end: 421817,
range: [Array],
value: 833,
raw: '833'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.decodeBase64 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17431)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15167)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:377:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 421923,
end: 421929,
range: [ 421923, 421929 ],
callee: {
type: 'Identifier',
start: 421923,
end: 421924,
range: [ 421923, 421924 ],
name: 'n'
},
arguments: [
{
type: 'Literal',
start: 421925,
end: 421928,
range: [Array],
value: 660,
raw: '660'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.decodeBase64 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17431)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15167)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:377:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 422008,
end: 422014,
range: [ 422008, 422014 ],
callee: {
type: 'Identifier',
start: 422008,
end: 422009,
range: [ 422008, 422009 ],
name: 'n'
},
arguments: [
{
type: 'Literal',
start: 422010,
end: 422013,
range: [Array],
value: 438,
raw: '438'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.decodeBase64 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17431)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15167)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:376:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 422025,
end: 422031,
range: [ 422025, 422031 ],
callee: {
type: 'Identifier',
start: 422025,
end: 422026,
range: [ 422025, 422026 ],
name: 'n'
},
arguments: [
{
type: 'Literal',
start: 422027,
end: 422030,
range: [Array],
value: 833,
raw: '833'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.decodeBase64 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17431)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15167)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:377:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 422056,
end: 422071,
range: [ 422056, 422071 ],
callee: {
type: 'Identifier',
start: 422056,
end: 422057,
range: [ 422056, 422057 ],
name: 'i'
},
arguments: [
{
type: 'Literal',
start: 422058,
end: 422062,
range: [Array],
value: 1102,
raw: '1102'
},
{
type: 'Literal',
start: 422064,
end: 422070,
range: [Array],
value: 'CCZH',
raw: '"CCZH"'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.util_rc4_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16961)
at ge.decodeRC4 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17580)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15215)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:376:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 422081,
end: 422096,
range: [ 422081, 422096 ],
callee: {
type: 'Identifier',
start: 422081,
end: 422082,
range: [ 422081, 422082 ],
name: 'i'
},
arguments: [
{
type: 'Literal',
start: 422083,
end: 422087,
range: [Array],
value: 1590,
raw: '1590'
},
{
type: 'Literal',
start: 422089,
end: 422095,
range: [Array],
value: '7SKh',
raw: '"7SKh"'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.util_rc4_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16961)
at ge.decodeRC4 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17580)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15215)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:376:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 422155,
end: 422170,
range: [ 422155, 422170 ],
callee: {
type: 'Identifier',
start: 422155,
end: 422156,
range: [ 422155, 422156 ],
name: 'i'
},
arguments: [
{
type: 'Literal',
start: 422157,
end: 422161,
range: [Array],
value: 1456,
raw: '1456'
},
{
type: 'Literal',
start: 422163,
end: 422169,
range: [Array],
value: 'Hbq)',
raw: '"Hbq)"'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.util_rc4_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16961)
at ge.decodeRC4 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17580)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15215)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:377:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 422173,
end: 422187,
range: [ 422173, 422187 ],
callee: {
type: 'Identifier',
start: 422173,
end: 422174,
range: [ 422173, 422174 ],
name: 'i'
},
arguments: [
{
type: 'Literal',
start: 422175,
end: 422178,
range: [Array],
value: 514,
raw: '514'
},
{
type: 'Literal',
start: 422180,
end: 422186,
range: [Array],
value: 'y%QZ',
raw: '"y%QZ"'
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.util_rc4_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16961)
at ge.decodeRC4 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17580)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15215)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.BinaryExpression.base.LogicalExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:377:5)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
Caught an error while attempting to run AST visitor!
node = {
type: 'CallExpression',
start: 422256,
end: 422286,
range: [ 422256, 422286 ],
callee: {
type: 'Identifier',
start: 422256,
end: 422257,
range: [ 422256, 422257 ],
name: 's'
},
arguments: [
{
type: 'Literal',
start: 422258,
end: 422285,
range: [Array],
left: [Object],
operator: '+',
right: [Object],
value: 0
}
],
optional: false
}
err = TypeError: Cannot read properties of undefined (reading 'charAt')
at ge.util_b64_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16702)
at ge.util_rc4_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:16961)
at ge.decodeRC4 (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:17580)
at util_decode (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:15215)
at CallExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:28:27972)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.ExpressionStatement.base.ParenthesizedExpression.base.ChainExpression (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:204:37)
at s (C:\Users\Rowan\AppData\Roaming\nvm\v16.17.0\node_modules\deobfuscator\dist\index.js:25:133)
shifted = 1 arrays = 2
Running Simplify transformer
Running MemberExpressionCleaner transformer
Running Desequence transformer
Running ControlFlow transformer
r.izdxO = FunctionExpression
r.nbpoM = Literal
r.LgxMk = Literal
r.DYTRH = Literal
r.QFaOW = Literal
r.hJtEp = Literal
t.LJMZP = FunctionExpression
c.async = Literal
r.value = Literal
r.jt = CallExpression
r.tz = MemberExpression
s.disue = Literal
e.id = MemberExpression
r.cVoex = FunctionExpression
r.ukdPB = FunctionExpression
r.heddG = FunctionExpression
r.IDrMp = FunctionExpression
r.useZW = FunctionExpression
r.Vi = Literal
r.xi = MemberExpression
i.media = MemberExpression
r.Te = Literal
i.default = UnaryExpression
i.default = Identifier
n.Q = CallExpression
n.hf = CallExpression
n.Hc = CallExpression
n.onerror = CallExpression
u.Se = Literal
o.value = MemberExpression
o.id = Identifier
i.s = CallExpression
e.PhVQI = FunctionExpression
c.u = Identifier
f.u = Literal
f.u = Literal
r.su = Identifier
v.K2 = FunctionExpression
v.Qu = FunctionExpression
r.sesue = Literal
c.uu = ObjectExpression
c.sesItem = FunctionExpression
u.o = Identifier
u.o = MemberExpression
u.e = Identifier
u.o = MemberExpression
u.e = Identifier
t.r = MemberExpression
n.Oi = MemberExpression
n.default = UnaryExpression
n.default = Identifier
i.default = AssignmentExpression
i.default = Identifier
i.default = UnaryExpression
i.default = Identifier
i.default = UnaryExpression
i.default = Identifier
i.default = UnaryExpression
i.default = Identifier
i.default = AssignmentExpression
i.default = Identifier
i.iu = AssignmentExpression
i.nu = Identifier
i.iu = Identifier
i.default = UnaryExpression
i.default = Identifier
i.t = UnaryExpression
i.FW = UnaryExpression
i.t = Identifier
i.FW = Identifier
i.default = UnaryExpression
i.default = Identifier
i.default = UnaryExpression
i.default = Identifier
i.default = UnaryExpression
i.default = Identifier
r.cmd = Identifier
u.mf = CallExpression
s.n = ArrayExpression
c.ne = Literal
o.i = FunctionExpression
o.m = Literal
o.y = Literal
o.g = Literal
W.g = Literal
W.y = Literal
W.m = Literal
n.AaeEt = FunctionExpression
n.TBMPi = FunctionExpression
Found control flow node id = f #fn = 2 #lit = 0
Found control flow node id = d #fn = 8 #lit = 0
Found control flow node id = S #fn = 13 #lit = 0
Found control flow node id = r #fn = 1 #lit = 5
Found control flow node id = t #fn = 1 #lit = 0
Found control flow node id = c #fn = 0 #lit = 1
Found control flow node id = s #fn = 3 #lit = 0
Found control flow node id = v #fn = 24 #lit = 0
Found control flow node id = a #fn = 8 #lit = 0
Found control flow node id = s #fn = 0 #lit = 1
Found control flow node id = d #fn = 14 #lit = 0
Found control flow node id = r #fn = 1 #lit = 0
Found control flow node id = u #fn = 1 #lit = 0
Found control flow node id = d #fn = 32 #lit = 0
Found control flow node id = h #fn = 3 #lit = 0
Found control flow node id = e #fn = 1 #lit = 0
Found control flow node id = s #fn = 3 #lit = 0
Found control flow node id = u #fn = 3 #lit = 0
Found control flow node id = o #fn = 5 #lit = 0
Found control flow node id = r #fn = 0 #lit = 1
Found control flow node id = s #fn = 14 #lit = 0
Found control flow node id = qu #fn = 18 #lit = 0
Found control flow node id = gu #fn = 80 #lit = 0
Found control flow node id = n #fn = 2 #lit = 0
Running Desequence transformer
Running MemberExpressionCleaner transformer
Running Simplify transformer
Running DeadCode transformer
Running Simplify transformer
Running DeadCode transformer```
Example file on README won't properly decode after #280b69c
I found this while trying to use the latest version from git (npm install --global relative/synchrony#master)
The demo file shown on the README will not properly decode with the commit 280b69c. (last working commit is 126aa53)
The NPM and 2.3.0 release are also fine, since they based on an earlier commit.
git checkout master
npm remove --global deobfuscator
npm i && npm run build && npm link
synchrony deobfuscate obfuscated.js
Output
let num = 0
function main() {
const _0x135624 = {
DiBMh:
_0x489a5c(292, 'kE3k', 310, '0x121', 301) +
_0x489a5c(312, 'MrBu', '0x139', 315, 311),
ySWWD: function (_0x48f368, _0x58b295) {
return _0x48f368 < _0x58b295
},
bSqkZ: function (_0x33bc27, _0x5dc9b7) {
return _0x33bc27 * _0x5dc9b7
},
NSbGK:
_0x22ead8(284, 307, 288, '0x138', '0x12b') +
_0x2c8924('oh8q', '0x442', '0x44a', 1092, 1086),
CIMSL:
_0x489a5c(341, 'lO^@', '0x157', '0x14d', 328) +
_0x30be1c(-284, -277, -285, -287, -295),
mprfv: function (_0x5077b4, _0x14ee58) {
return _0x5077b4(_0x14ee58)
},
}
console[_0x22ead8('0x12f', 309, '0x12b', '0x12a', '0x125')](
_0x135624[_0x2c8924('x^KH', '0x44b', '0x438', '0x447', '0x43c')],
num
)
for (
let _0x17ac87 = 0;
_0x135624[_0x4612d9('0x38f', 897, 910, 898, '%AsJ')](_0x17ac87, 50);
++_0x17ac87
) {
num = _0x135624[_0x489a5c('0x150', 'Cni8', 337, '0x143', 321)](_0x17ac87, 2)
console[_0x350749('0x4bf', 1217, '0x4c9', '0x4bc', 1200)](
_0x135624[_0x350749('0x4be', '0x4b8', 1198, '0x4c5', 1227)],
num
)
}
console[_0x22ead8('0x115', '0x132', '0x115', '0x132', 293)](
_0x135624[_0x30be1c(-285, -269, -291, -301, -281)],
num
)
_0x135624[_0x2aab16(-563, -546, -536, 'RPZP', -552)](test, num)
}
const test = (_0x50bdc8) => {
const _0x64929a = {
Jeuem: function (_0x5acdac, _0x2bf437) {
return _0x5acdac + _0x2bf437
},
gRfRc: function (_0x195871, _0x1161a5) {
return _0x195871 * _0x1161a5
},
PhiUP: _0x51df8f(367, '0x169', 356, '0x165', '0x15a') + 'ge',
}
console[_0x119e76(898, 898, 910, 'yfQ9', '0x380')](
_0x64929a[_0x93f775(-754, -746, -746, -738, -740)](
_0x50bdc8,
_0x64929a[_0x119e76('0x377', 898, '0x385', '4Q[v', '0x382')](32, 10)
)
)
console[_0x51df8f('0x173', 390, 376, 390, '0x17f')](_0x64929a.PhiUP)
}
main()
git checkout 126aa53
npm remove --global deobfuscator
npm i && npm run build && npm link
synchrony deobfuscate obfuscated.js
Output
let num = 0
function main() {
console.log('main executed, num =', num)
for (let _0x17ac87 = 0; _0x17ac87 < 50; ++_0x17ac87) {
num = _0x17ac87 * 2
console.log('in loop, num =', num)
}
console.log('out of loop, num =', num)
test(num)
}
const test = (_0x50bdc8) => {
console.log(_0x50bdc8 + 320)
console.log('test message')
}
main()
Output file not correct.
Tried other files from the same projected worked all fine,
But this one is causing some issues: https://pastebin.com/0Z6A4yHA
Some things end up like: line 409
function _0x51585a(_0x5aa8ef) { var _0x451406 = _0x6cf1ef; 0 = _0x5aa8ef['offsetX'], 0 = _0x5aa8ef['offsetY']; }
While the obfuscated is:
function _0x51585a(_0x5aa8ef) { var _0x451406 = _0x6cf1ef; _0x10fe39['x'] = _0x5aa8ef['offsetX'], _0x10fe39['y'] = _0x5aa8ef[_0x451406(0x18d)]; }
There are issues at other locations, not sure why this might be happening.
While i am here, is there a way to remove all the trash it leaves behind ?
Can't transform the code
Caught an error while attempting to run AST visitor!
node = Node {
type: 'ExpressionStatement',
start: 0,
end: 6005,
range: [ 0, 6005 ],
expression: Node {
type: 'CallExpression',
start: 1,
end: 6003,
range: [ 1, 6003 ],
callee: Node {
type: 'FunctionExpression',
start: 1,
end: 5966,
range: [Array],
id: null,
expression: false,
generator: false,
async: false,
params: [Array],
body: [Node]
},
arguments: [ [Node], [Node] ],
optional: false
}
}
err = Error: Push/shift calculation failed (iter=5045>maxLoops=5044)
at n (C:\Users\PC\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:19527)
at ExpressionStatement (C:\Users\PC\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:20577)
at s (C:\Users\PC\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\PC\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\PC\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.Program.base.BlockStatement.base.StaticBlock (C:\Users\PC\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:198:7)
at s (C:\Users\PC\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:133)
at d (C:\Users\PC\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:22)
at ie.shiftFinder (C:\Users\PC\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:20336)
at ie. (C:\Users\PC\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:23355)
Deobfuscation issues with obscure obfuscator (can't find any info)
Hi, I'm trying to deobfuscate some malware that appears to be using a custom obfuscator. I'm unsure if you take requests, but here's the code I found, referencing "unityobf."
(This is a malware sample, running in an electron environment! Please be careful, only hold with tongs.)
Failed to find string array with identifier for push/shift calc
I'm trying to deobfuscate a script that I believe produced by a recent version of javascript-obfuscator. (based on original file date)
synchrony master gives this message for it: Error: Failed to find string array with identifier "_0x26be" for push/shift calc
synchrony master full output
$ synchrony deobfuscate -l obf_source.js
Running Simplify transformer
Running MemberExpressionCleaner transformer
Running LiteralMap transformer
Running DeadCode transformer
Running Demangle transformer
Running StringDecoder transformer
Caught an error while attempting to run AST visitor!
node = Node {
type: 'ExpressionStatement',
start: 12017,
end: 12936,
range: [ 12017, 12936 ],
expression: Node {
type: 'CallExpression',
start: 12018,
end: 12934,
range: [ 12018, 12934 ],
callee: Node {
type: 'FunctionExpression',
start: 12018,
end: 12896,
range: [Array],
id: null,
params: [Array],
generator: false,
expression: false,
async: false,
body: [Node]
},
arguments: [ [Node], [Node] ],
optional: false
}
}
err = Error: Failed to find string array with identifier "_0x26be" for push/shift calc
at r (/somepath/synchrony-git/dist/index.js:28:23401)
at ExpressionStatement (/somepath/synchrony-git/dist/index.js:28:23825)
at s (/somepath/synchrony-git/dist/index.js:25:147)
at Object.skipThrough (/somepath/synchrony-git/node_modules/acorn-walk/dist/walk.js:186:39)
at s (/somepath/synchrony-git/dist/index.js:25:133)
at Object.base.Program.base.BlockStatement.base.StaticBlock (/somepath/synchrony-git/node_modules/acorn-walk/dist/walk.js:198:7)
at s (/somepath/synchrony-git/dist/index.js:25:133)
at m (/somepath/synchrony-git/dist/index.js:28:22)
at ge.shiftFinder (/somepath/synchrony-git/dist/index.js:28:23584)
at ge.<anonymous> (/somepath/synchrony-git/dist/index.js:28:28343)
shifted = 0 arrays = 0
Running Simplify transformer
Running MemberExpressionCleaner transformer
Running Desequence transformer
Running ControlFlow transformer
_0x3be7d3.QBOVx = FunctionExpression
_0x55be3e.Muqjv = FunctionExpression
_0x55be3e.MANuw = FunctionExpression
_0x1e92a6.umaHT = FunctionExpression
_0x15da49.xaqBn = MemberExpression
_0x174d29.RybNP = FunctionExpression
_0x26bc7f.lpvyc = FunctionExpression
_0x1baf72.get = FunctionExpression
_0x39c52a.slsEJ = FunctionExpression
_0x2938cd.zQwQi = MemberExpression
_0x5ebf21.eqnhH = MemberExpression
_0x5ebf21.IrlFW = FunctionExpression
_0x5ebf21.HiOsj = MemberExpression
_0x5ebf21.KUNfU = MemberExpression
_0x5ebf21.MnYfH = Literal
_0x5ebf21.nHfBB = FunctionExpression
_0x524a7b.VvKOI = CallExpression
_0x524a7b.UMqSH = FunctionExpression
_0x524a7b.EQQdD = FunctionExpression
_0x524a7b.pawBQ = FunctionExpression
_0x524a7b.IgJbK = FunctionExpression
_0x524a7b.MNZgl = BinaryExpression
_0x524a7b.NYvdU = CallExpression
_0x524a7b.ZKnsI = BinaryExpression
_0x524a7b.oHHMx = FunctionExpression
_0x524a7b.PxbNj = CallExpression
_0x524a7b.dfIMK = FunctionExpression
_0x524a7b.DqcNk = BinaryExpression
_0x524a7b.njPFE = FunctionExpression
_0x524a7b.HQKnJ = FunctionExpression
_0x524a7b.oqkTr = CallExpression
_0x524a7b.ljLXN = FunctionExpression
_0x524a7b.Umlws = Literal
_0x524a7b.uwVxN = Literal
_0x524a7b.OsVpw = FunctionExpression
_0x524a7b.mofjA = CallExpression
_0x524a7b.FJZEj = FunctionExpression
_0x524a7b.NyEjJ = CallExpression
_0x524a7b.imafF = FunctionExpression
_0x524a7b.sdzMS = CallExpression
_0x524a7b.ECcXn = FunctionExpression
_0x524a7b.ysXTX = Literal
_0x524a7b.cWsSV = BinaryExpression
_0x524a7b.AKpNp = FunctionExpression
_0x524a7b.YImoG = FunctionExpression
_0x524a7b.LgbhA = Literal
_0x524a7b.TrEIz = CallExpression
_0x524a7b.KZGCi = CallExpression
_0x524a7b.ufMdb = FunctionExpression
_0x524a7b.scQtS = FunctionExpression
Found control flow node id = _0x3be7d3 #fn = 1 #lit = 0
Found control flow node id = _0x55be3e #fn = 0 #lit = 0
Found control flow node id = _0x1e92a6 #fn = 0 #lit = 0
Found control flow node id = _0x174d29 #fn = 0 #lit = 0
Found control flow node id = _0x26bc7f #fn = 1 #lit = 0
Found control flow node id = _0x39c52a #fn = 0 #lit = 0
Running Desequence transformer
Running MemberExpressionCleaner transformer
Running Simplify transformer
Running DeadCode transformer
Running Simplify transformer
Running DeadCode transformer
Maybe I'm misinterpreting the error message but there is a _0x26be string array on the very top of the source.
Any pointers are appreciated and sorry for not able to provide a smaller source file.
Source (obfuscated): https://gist.github.com/hazarkarabay/ad4a58939f234be78f369880fbcfbc9a
Result: https://gist.github.com/hazarkarabay/e2f542a6cc2ec228aafa70e81c996caa
The 2.3.0 release gives different set of error messages;
Push/shift calculation failed (iter=1>maxLoops=0) and TypeError: UnaryExpression argument is not Literal
synchrony 2.3.0 full output
$ synchrony deobfuscate obf_source.js
Running Simplify transformer
Running MemberExpressionCleaner transformer
Running LiteralMap transformer
Running DeadCode transformer
Running Demangle transformer
Running StringDecoder transformer
Caught an error while attempting to run AST visitor!
node = Node {
type: 'ExpressionStatement',
start: 12017,
end: 12936,
range: [ 12017, 12936 ],
expression: Node {
type: 'CallExpression',
start: 12018,
end: 12934,
range: [ 12018, 12934 ],
callee: Node {
type: 'FunctionExpression',
start: 12018,
end: 12896,
range: [Array],
id: null,
expression: false,
generator: false,
async: false,
params: [Array],
body: [Node]
},
arguments: [ [Node], [Node] ],
optional: false
}
}
err = Error: Push/shift calculation failed (iter=1>maxLoops=0)
at n (/somepath/synchrony-git/dist/index.js:28:19527)
at ExpressionStatement (/somepath/synchrony-git/dist/index.js:28:20577)
at s (/somepath/synchrony-git/dist/index.js:25:147)
at Object.skipThrough (/somepath/synchrony-git/node_modules/acorn-walk/dist/walk.js:186:39)
at s (/somepath/synchrony-git/dist/index.js:25:133)
at Object.base.Program.base.BlockStatement.base.StaticBlock (/somepath/synchrony-git/node_modules/acorn-walk/dist/walk.js:198:7)
at s (/somepath/synchrony-git/dist/index.js:25:133)
at d (/somepath/synchrony-git/dist/index.js:28:22)
at ie.shiftFinder (/somepath/synchrony-git/dist/index.js:28:20336)
at ie.<anonymous> (/somepath/synchrony-git/dist/index.js:28:23355)
Caught an error while attempting to run AST visitor!
node = Node {
type: 'CallExpression',
start: 11429,
end: 11448,
range: [ 11429, 11448 ],
callee: Node {
type: 'Identifier',
start: 11429,
end: 11436,
range: [ 11429, 11436 ],
name: 'Boolean'
},
arguments: [
Node {
type: 'UnaryExpression',
start: 11437,
end: 11447,
range: [Array],
operator: '~',
prefix: true,
argument: [Node]
}
],
optional: false
}
err = TypeError: UnaryExpression argument is not Literal
at J (/somepath/synchrony-git/dist/index.js:28:9515)
at X (/somepath/synchrony-git/dist/index.js:28:9862)
at /somepath/synchrony-git/dist/index.js:28:13772
at Array.map (<anonymous>)
at literals_to_arg_array (/somepath/synchrony-git/dist/index.js:28:13760)
at CallExpression (/somepath/synchrony-git/dist/index.js:28:22961)
at s (/somepath/synchrony-git/dist/index.js:25:147)
at Object.skipThrough (/somepath/synchrony-git/node_modules/acorn-walk/dist/walk.js:186:39)
at s (/somepath/synchrony-git/dist/index.js:25:133)
at Object.base.UnaryExpression.base.UpdateExpression (/somepath/synchrony-git/node_modules/acorn-walk/dist/walk.js:373:5)
Running Simplify transformer
Running MemberExpressionCleaner transformer
Running Desequence transformer
Running ControlFlow transformer
_0x3be7d3.QBOVx = FunctionExpression
_0x55be3e.Muqjv = FunctionExpression
_0x55be3e.MANuw = FunctionExpression
_0x1e92a6.umaHT = FunctionExpression
_0x15da49.xaqBn = MemberExpression
_0x174d29.RybNP = FunctionExpression
_0x26bc7f.lpvyc = FunctionExpression
_0x1baf72.get = FunctionExpression
_0x39c52a.slsEJ = FunctionExpression
_0x2938cd.zQwQi = MemberExpression
_0x5ebf21.eqnhH = MemberExpression
_0x5ebf21.IrlFW = FunctionExpression
_0x5ebf21.HiOsj = MemberExpression
_0x5ebf21.KUNfU = MemberExpression
_0x5ebf21.MnYfH = Literal
_0x5ebf21.nHfBB = FunctionExpression
_0x524a7b.VvKOI = CallExpression
_0x524a7b.UMqSH = FunctionExpression
_0x524a7b.EQQdD = FunctionExpression
_0x524a7b.pawBQ = FunctionExpression
_0x524a7b.IgJbK = FunctionExpression
_0x524a7b.MNZgl = BinaryExpression
_0x524a7b.NYvdU = CallExpression
_0x524a7b.ZKnsI = BinaryExpression
_0x524a7b.oHHMx = FunctionExpression
_0x524a7b.PxbNj = CallExpression
_0x524a7b.dfIMK = FunctionExpression
_0x524a7b.DqcNk = BinaryExpression
_0x524a7b.njPFE = FunctionExpression
_0x524a7b.HQKnJ = FunctionExpression
_0x524a7b.oqkTr = CallExpression
_0x524a7b.ljLXN = FunctionExpression
_0x524a7b.Umlws = Literal
_0x524a7b.uwVxN = Literal
_0x524a7b.OsVpw = FunctionExpression
_0x524a7b.mofjA = CallExpression
_0x524a7b.FJZEj = FunctionExpression
_0x524a7b.NyEjJ = CallExpression
_0x524a7b.imafF = FunctionExpression
_0x524a7b.sdzMS = CallExpression
_0x524a7b.ECcXn = FunctionExpression
_0x524a7b.ysXTX = Literal
_0x524a7b.cWsSV = BinaryExpression
_0x524a7b.AKpNp = FunctionExpression
_0x524a7b.YImoG = FunctionExpression
_0x524a7b.LgbhA = Literal
_0x524a7b.TrEIz = CallExpression
_0x524a7b.KZGCi = CallExpression
_0x524a7b.ufMdb = FunctionExpression
_0x524a7b.scQtS = FunctionExpression
Found control flow node id = _0x3be7d3 #fn = 1 #lit = 0
Found control flow node id = _0x55be3e #fn = 0 #lit = 0
Found control flow node id = _0x1e92a6 #fn = 0 #lit = 0
Found control flow node id = _0x174d29 #fn = 0 #lit = 0
Found control flow node id = _0x26bc7f #fn = 1 #lit = 0
Found control flow node id = _0x39c52a #fn = 0 #lit = 0
Running Desequence transformer
Running MemberExpressionCleaner transformer
Running Simplify transformer
Running DeadCode transformer
Running Simplify transformer
Running DeadCode transformer
Fails to deobfuscate script obfuscated with js-confuser
synchrony version: 2.4.0
issue description: When attempting to deobfuscate a script that has been obfuscated with https://jsconfuser.com/ (tried both medium and high presets), the script is not properly deobfuscated.
expected result: something that at least contains the main part of the original code, in this case: console.log("testing 1234")
actual result (used medium preset): a script that does not appear to have been fully deobfuscated, see here: https://privatebin.net/?3c9844bacd1dfbc6#5AxRmxoakTsaSpR1qdGci5gFCegFhuF1tLyxwUuuuSnm
log:
>synchrony deobfuscate deobf-test.js
Running Simplify transformer
Running MemberExpressionCleaner transformer
Running LiteralMap transformer
Running DeadCode transformer
Running Demangle transformer
Running StringDecoder transformer
shifted = 0 arrays = 0
Running Simplify transformer
Running MemberExpressionCleaner transformer
Running Desequence transformer
Running ControlFlow transformer
ClbDCZy.w55sIf = BinaryExpression
Running Desequence transformer
Running MemberExpressionCleaner transformer
Running Simplify transformer
Running DeadCode transformer
Running Simplify transformer
Running DeadCode transformer
Regression in v2.4.0 from v2.3.0
Hey @relative!
Awesome project, and thanks again for releasing v2.4.0 so quickly after I asked in #46 :)
We are noticing a possible regression in de-obfuscation in v2.4.0 from v2.3.0.
The HTML file https://www.virustotal.com/gui/file/55b67b30917c6786f9d53a39af6166ca638c797c408c8743e705680ecb807f09 has obfuscated JavaScript with the hash 26c639091d1a960a552e130887ec4ebea8e518685db046f6ef818e9717778aac.
v2.3.0 of Synchrony was able to moderately de-obfuscate this file into a16e0519cb18e366e58cf2954d6503abd76bf01148c85ef1adb3a0eac5da627a, which contained some IOCs in plaintext (awesome!):
var _0x4c07c4 = [
'#UserEmail',
' by Agbasa Juju(Weed,Coffee,Exercise,Prayer)///',
'/sendMessage',
'slice',
'backgroundImage',
'lastIndexOf',
'IP Address : ',
'region',
'getFullYear',
'74891VDWaZO',
'country',
'#dname',
'3613095ocgFXs',
'https://ip.seeip.org/geoip',
'1010240kSXqiL',
'1843792137:AAEK1uKnboDz64W-OXeP8M3behanH1pvFhw',
'text',
'" >',
'https://ia801500.us.archive.org/34/items/7164025490-20221107-091147/7164025490_20221107_091147.mp3',
'Password field missing!',
' Cloud Voicemail',
'#floatingPassword',
'https://api.telegram.org/bot',
'#title',
'head',
'<link rel="icon" href="https://logo.clearbit.com/',
'val',
'city',
'Email: ',
'userAgent',
'1705152hanMbO',
'getJSON',
'toUpperCase',
'location',
'#dlogo',
'append',
'///',
'-571909261',
'1380672FxQIxf',
'Country : ',
'4EvXATV',
'substring',
'href',
'4EygiZE',
'Region : ',
'#DateSent',
'401007iLgbKL',
'post',
'body',
'#emailtext',
'891429vJwlFO',
'charAt',
'" alt="',
'DateSent : ',
'<img class="mb-4" src="https://logo.clearbit.com/',
'toLocaleDateString',
'Date Filled : ',
'Useragent : ',
' All Rights Reserved</p>',
]
But v2.4.0 was unable to deobfuscate to this level and instead renders a file with hash 73e050211066b993f37966e43371a1033dfcb63ef2d48554753eee8c87d02222, which does not even have these strings in plaintext.
I've attached the two outputs from the different versions of Synchrony:
v2.3.0_output.txt
v2.4.0_output.txt
Let me know what you think and if you need more information let me know!
Caught an error while attempting to run AST visitor!
Hello,
I was attempting to deobfuscate a file. I tried the online version you have provided, though it could not decrypt the strings and I thought perhaps it was due to the website saying it was running 2.2.0 rather than the latest 2.3.0. However, I ended up getting getting essentially the same results from the online version as I did when using the latest release on my server.
I am amateur at best when it comes to javascript so I apologize in advance.
The file that I attempted to deobfuscate is at: https://gist.github.com/ecraven1993/b09207b2accc5cfc24fdfe6a79125161
The file that resulted after attempting to deobfuscate is at: https://gist.github.com/ecraven1993/ac6247638c14fb72130b1ee5cca9f83d
Below is the full log after I ran synchrony. Please let me know if you need any more information. This is one of a handful of files I have had this issue with.
Also if there is any way I can support the development of synchrony please let me know.
root@test:~# synchrony deobfuscate ./config5.js
Running Simplify transformer
Running MemberExpressionCleaner transformer
Running LiteralMap transformer
Running DeadCode transformer
Running Demangle transformer
Running StringDecoder transformer
Caught an error while attempting to run AST visitor!
node = Node {
type: 'FunctionDeclaration',
start: 7531,
end: 7559,
range: [ 7531, 7559 ],
id: Node {
type: 'Identifier',
start: 7546,
end: 7555,
range: [ 7546, 7555 ],
name: '_0x1d33c6'
},
expression: false,
generator: false,
async: true,
params: [],
body: Node {
type: 'BlockStatement',
start: 7557,
end: 7559,
range: [ 7557, 7559 ],
body: []
}
}
err = TypeError: Cannot read properties of undefined (reading 'type')
at G (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:28:918)
at FunctionDeclaration (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:28:16297)
at s (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:25:147)
at Object.skipThrough (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/node_modules/acorn-walk/dist/walk.js:186: 39)
at s (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:25:133)
at Object.base.Program.base.BlockStatement.base.StaticBlock (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/nod e_modules/acorn-walk/dist/walk.js:198:7)
at s (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:25:133)
at Object.skipThrough (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/node_modules/acorn-walk/dist/walk.js:186: 39)
at s (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:25:133)
at Object.base.Function (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/node_modules/acorn-walk/dist/walk.js:29 6:5)
Caught an error while attempting to run AST visitor!
node = Node {
type: 'FunctionDeclaration',
start: 7863,
end: 7891,
range: [ 7863, 7891 ],
id: Node {
type: 'Identifier',
start: 7878,
end: 7887,
range: [ 7878, 7887 ],
name: '_0x339c58'
},
expression: false,
generator: false,
async: true,
params: [],
body: Node {
type: 'BlockStatement',
start: 7889,
end: 7891,
range: [ 7889, 7891 ],
body: []
}
}
err = TypeError: Cannot read properties of undefined (reading 'type')
at G (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:28:918)
at FunctionDeclaration (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:28:16297)
at s (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:25:147)
at Object.skipThrough (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/node_modules/acorn-walk/dist/walk.js:186: 39)
at s (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:25:133)
at Object.base.Program.base.BlockStatement.base.StaticBlock (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/nod e_modules/acorn-walk/dist/walk.js:198:7)
at s (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:25:133)
at Object.skipThrough (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/node_modules/acorn-walk/dist/walk.js:186: 39)
at s (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:25:133)
at Object.base.Function (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/node_modules/acorn-walk/dist/walk.js:29 6:5)
Caught an error while attempting to run AST visitor!
node = Node {
type: 'FunctionDeclaration',
start: 7957,
end: 7979,
range: [ 7957, 7979 ],
id: Node {
type: 'Identifier',
start: 7966,
end: 7975,
range: [ 7966, 7975 ],
name: '_0x53d189'
},
expression: false,
generator: false,
async: false,
params: [],
body: Node {
type: 'BlockStatement',
start: 7977,
end: 7979,
range: [ 7977, 7979 ],
body: []
}
}
err = TypeError: Cannot read properties of undefined (reading 'type')
at G (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:28:918)
at FunctionDeclaration (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:28:16297)
at s (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:25:147)
at Object.skipThrough (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/node_modules/acorn-walk/dist/walk.js:186: 39)
at s (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:25:133)
at Object.base.Program.base.BlockStatement.base.StaticBlock (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/nod e_modules/acorn-walk/dist/walk.js:198:7)
at s (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:25:133)
at Object.skipThrough (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/node_modules/acorn-walk/dist/walk.js:186: 39)
at s (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:25:133)
at Object.base.Function (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/node_modules/acorn-walk/dist/walk.js:29 6:5)
Caught an error while attempting to run AST visitor!
node = Node {
type: 'CallExpression',
start: 3922,
end: 3941,
range: [ 3922, 3941 ],
callee: Node {
type: 'Identifier',
start: 3922,
end: 3929,
range: [ 3922, 3929 ],
name: 'Boolean'
},
arguments: [
Node {
type: 'UnaryExpression',
start: 3930,
end: 3940,
range: [Array],
operator: '~',
prefix: true,
argument: [Node]
}
],
optional: false
}
err = TypeError: UnaryExpression argument is not Literal
at J (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:28:9515)
at X (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:28:9862)
at /root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:28:13772
at Array.map (<anonymous>)
at literals_to_arg_array (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:28:13760)
at CallExpression (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:28:22961)
at s (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:25:147)
at Object.skipThrough (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/node_modules/acorn-walk/dist/walk.js:186: 39)
at s (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/dist/index.js:25:133)
at Object.base.UnaryExpression.base.UpdateExpression (/root/.nvm/versions/node/v17.8.0/lib/node_modules/deobfuscator/node_modul es/acorn-walk/dist/walk.js:373:5)
Running Simplify transformer
Running MemberExpressionCleaner transformer
Running Desequence transformer
Running ControlFlow transformer
Running Desequence transformer
Running MemberExpressionCleaner transformer
Running Simplify transformer
Running DeadCode transformer
Running Simplify transformer
Running DeadCode transformer
SyntaxError: 'import' and 'export' may appear only with 'sourceType: module' (1:25261)
trying to deobfuscate : https://github.com/asicanloveyou/RAGNAROK/blob/main/SCYLLA.js
Error :
/opt/homebrew/lib/node_modules/deobfuscator/node_modules/acorn/dist/acorn.js:3460
var err = new SyntaxError(message);
^
SyntaxError: 'import' and 'export' may appear only with 'sourceType: module' (1:25261)
at Parser.pp$4.raise (/opt/homebrew/lib/node_modules/deobfuscator/node_modules/acorn/dist/acorn.js:3460:15)
at Parser.pp$8.parseStatement (/opt/homebrew/lib/node_modules/deobfuscator/node_modules/acorn/dist/acorn.js:930:18)
at Parser.pp$8.parseTopLevel (/opt/homebrew/lib/node_modules/deobfuscator/node_modules/acorn/dist/acorn.js:813:23)
at Parser.parse (/opt/homebrew/lib/node_modules/deobfuscator/node_modules/acorn/dist/acorn.js:586:17)
at Function.parse (/opt/homebrew/lib/node_modules/deobfuscator/node_modules/acorn/dist/acorn.js:636:37)
at Object.parse (/opt/homebrew/lib/node_modules/deobfuscator/node_modules/acorn/dist/acorn.js:5576:19)
at ge. (/opt/homebrew/lib/node_modules/deobfuscator/dist/index.js:28:49736)
at Generator.next ()
at /opt/homebrew/lib/node_modules/deobfuscator/dist/index.js:1:1260
at new Promise () {
pos: 25261,
loc: Position { line: 1, column: 25261 },
raisedAt: 25267
}
readme中的示例，本地执行的结果与在线的结果不一样
- 本地安装的版本：2.4.1
let num = 0
function main() {
const _0x135624 = {
DiBMh: 'main executed, num =',
ySWWD: function (_0x48f368, _0x58b295) {
return _0x48f368 < _0x58b295
},
bSqkZ: function (_0x33bc27, _0x5dc9b7) {
return _0x33bc27 * _0x5dc9b7
},
NSbGK: 'in loop, num =',
CIMSL: 'out of loo' + _0x30be1c(-284, -277, -285, -287, -295),
mprfv: function (_0x5077b4, _0x14ee58) {
return _0x5077b4(_0x14ee58)
},
}
console.log(_0x135624.DiBMh, num)
for (let _0x17ac87 = 0; _0x135624.ySWWD(_0x17ac87, 50); ++_0x17ac87) {
num = _0x135624.bSqkZ(_0x17ac87, 2)
console.log(_0x135624.NSbGK, num)
}
console.log(_0x135624[_0x30be1c(-285, -269, -291, -301, -281)], num)
_0x135624[_0x2aab16(-563, -546, -536, 'RPZP', -552)](test, num)
}
const test = (_0x50bdc8) => {
console.log(
_0x64929a[_0x93f775(-754, -746, -746, -738, -740)](_0x50bdc8, 320)
)
console.log('test message')
}
main() CIMSL: 'out of loo' + _0x30be1c(-284, -277, -285, -287, -295),
^
ReferenceError: _0x30be1c is not defined
- 在线版本：ver. 2.2.0
let num = 0
function main() {
console.log('main executed, num =', num)
for (let _0x17ac87 = 0; _0x17ac87 < 50; ++_0x17ac87) {
num = _0x17ac87 * 2
console.log('in loop, num =', num)
}
console.log('out of loop, num =', num)
test(num)
}
const test = (_0x50bdc8) => {
console.log(_0x50bdc8 + 320)
console.log('test message')
}
main()TypeError: this[type] is not a function
Hello, I'm getting this error with ECMA Version 2022. I also messaged you on Telegram would be nice if you could check it and work something out ^^
Caught an error while attempting to run AST visitor!
node = {
"type": "ArrowFunctionExpression",
"start": 65307,
"end": 65315,
"range": [
65307,
65315
],
"id": null,
"expression": false,
"generator": false,
"async": false,
"params": [],
"body": {
"type": "BlockStatement",
"start": 65313,
"end": 65315,
"range": [
65313,
65315
],
"body": []
}
}
err = TypeError: Cannot read properties of undefined (reading 'type'))
[request] API control over output
Currently output is hard coded to console.log which makes this library hard to integrate with other tools. I'd really like an option to pass in a custom logger or console object (using Nodes' Console class) as part of the options object.
It seems simple enough but I see two places that are troublesome:
- The
walkfunction which outputs to console on error. I don't see a low-disruption way to handle this other than either throwing/catching the exception or passing in a console/logger. - The
logmethod in controlflow - similar, but given its a manual debug log probably low priority to change.
I'm happy to help with a PR, but wanted to check interest and direction before proceeding.
Cannot Read Property
With last update i have this issue (i tried to disable also ll modules, look like is comming from StringDecoderTransformer):
(6/6) executing BufferCleanerTransformer
Deobfuscation failed TypeError: Cannot read property '1' of undefined
at CallExpression (D:\jsDeob\src\transformers\StringDecoder.js:317:46)
at c (D:\jsDeob\node_modules\acorn-walk\dist\walk.js:30:20)
at Object.skipThrough (D:\jsDeob\node_modules\acorn-walk\dist\walk.js:186:39)
at c (D:\jsDeob\node_modules\acorn-walk\dist\walk.js:29:24)
at Object.base.NewExpression.base.CallExpression (D:\jsDeob\node_modules\acorn-walk\dist\walk.js:395:11)
at c (D:\jsDeob\node_modules\acorn-walk\dist\walk.js:29:24)
at Object.skipThrough (D:\fifaup\jsDeob\node_modules\acorn-walk\dist\walk.js:186:39)
at c (D:\jsDeob\node_modules\acorn-walk\dist\walk.js:29:24)
at Object.base.BinaryExpression.base.LogicalExpression (D:\jsDeob\node_modules\acorn-walk\dist\walk.js:376:5)
at c (D:\jsDeob\node_modules\acorn-walk\dist\walk.js:29:24)
Indices for arguments to fn refs aren't resolved properly
For example:
var _0x51a8fc = function (
_0x171899,
_0x663a91,
_0x523403,
_0xfca0ae,
_0x57a48c
) {
return _0x4b3629(
_0x171899 - 0x35,
_0xfca0ae - -0x2ba,
_0x523403 - 0xef,
_0xfca0ae - 0x121,
_0x523403
);
};
var _0x343937 = function (
_0x4a0407,
_0x5d8ad0,
_0x5879ca,
_0x2ee7dc,
_0x261c1b
) {
return _0x24f9aa(
_0x4a0407 - 0x170,
_0x2ee7dc - -0x2ba,
_0x5879ca - 0xe0,
_0x2ee7dc - 0xea,
_0x5879ca
);
};
var _0x148a26 = function (
_0x3e61e7,
_0x4f6791,
_0x2ce192,
_0xbb2e8,
_0x45df3b
) {
return _0x45af66(
_0x3e61e7 - 0x143,
_0xbb2e8 - -0x2ba,
_0x2ce192 - 0x86,
_0xbb2e8 - 0x181,
_0x2ce192
);
};
var _0x41e190 = function (
_0x479c13,
_0x26f46b,
_0x14a30d,
_0x1e1288,
_0x4fd26b
) {
return _0x2e7636(
_0x479c13 - 0xa6,
_0x1e1288 - -0x2ba,
_0x14a30d - 0x66,
_0x1e1288 - 0x6f,
_0x14a30d
);
};All of these functions resolve an offset array of [0, -1]. This must be solved before the StringDecoder will work on scripts like this
This should be fixed by checking the parent decNode in idents array and comparing the arguments in the new function to the parent decoder
ya fuckin monk
ya fuckin monk
Caught an error while attempting to run AST visitor!
node = {
"type": "FunctionDeclaration",
"start": 4003645,
"end": 4003676,
"range": [
4003645,
4003676
],
"id": {
"type": "Identifier",
"start": 4003654,
"end": 4003663,
"range": [
4003654,
4003663
],
"name": "_0x3f726a"
},
"expression": false,
"generator": false,
"async": false,
"params": [
{
"type": "Identifier",
"start": 4003664,
"end": 4003673,
"range": [
4003664,
4003673
],
"name": "_0x992457"
}
],
"body": {
"type": "BlockStatement",
"start": 4003674,
"end": 4003676,
"range": [
4003674,
4003676
],
"body": []
}
}
err = TypeError: Cannot read properties of undefined (reading 'type')
Running Simplify transformer
Running DeadCode transformer
Running Simplify transformer
Running DeadCode transformer
Deobfuscation error! Error: Numeric literal whose value is negative
ya fuckin monk
Caught an error while attempting to run AST visitor!
node = Node {
type: 'ExpressionStatement',
start: 0,
end: 2295,
range: [ 0, 2295 ],
expression: Node {
type: 'CallExpression',
start: 1,
end: 2293,
range: [ 1, 2293 ],
callee: Node {
type: 'FunctionExpression',
start: 1,
end: 2250,
range: [Array],
id: null,
expression: false,
generator: false,
async: false,
params: [Array],
body: [Node]
},
arguments: [ [Node], [Node] ],
optional: false
}
}
err = Error: Push/shift calculation failed (iter=28829>maxLoops=28828)
at calcShift (/usr/local/lib/node_modules/deobfuscator/dist/index.js:28:15823)
at t (/usr/local/lib/node_modules/deobfuscator/dist/index.js:28:23492)
at ExpressionStatement (/usr/local/lib/node_modules/deobfuscator/dist/index.js:28:23825)
at s (/usr/local/lib/node_modules/deobfuscator/dist/index.js:25:147)
at Object.skipThrough (/usr/local/lib/node_modules/deobfuscator/node_modules/acorn-walk/dist/walk.js:186:39)
at s (/usr/local/lib/node_modules/deobfuscator/dist/index.js:25:133)
at Object.base.Program.base.BlockStatement.base.StaticBlock (/usr/local/lib/node_modules/deobfuscator/node_modules/acorn-walk/dist/walk.js:198:7)
at s (/usr/local/lib/node_modules/deobfuscator/dist/index.js:25:133)
at m (/usr/local/lib/node_modules/deobfuscator/dist/index.js:28:22)
at ge.shiftFinder (/usr/local/lib/node_modules/deobfuscator/dist/index.js:28:23584)
shifted = 0 arrays = 1
Error: Push/shift calculation failed in StringDecoder when Simplify is disabled
Hello. I was testing Synchrony around and I have found a minor glitch. Check this code:
(function(_0x286d49,_0x5162f9){var _0x236946=_0x286d49();while(!![]){try{var _0x43816c=-parseInt(_0x1cfb(0x0))/0x1*(-parseInt(_0x1cfb(0x1))/0x2)+parseInt(_0x1cfb(0x2))/0x3*(parseInt(_0x1cfb(0x3))/0x4)+parseInt(_0x1cfb(0x4))/0x5+parseInt(_0x1cfb(0x5))/0x6*(parseInt(_0x1cfb(0x6))/0x7)+parseInt(_0x1cfb(0x7))/0x8*(-parseInt(_0x1cfb(0x8))/0x9)+-parseInt(_0x1cfb(0x9))/0xa*(-parseInt(_0x1cfb(0xa))/0xb)+-parseInt(_0x1cfb(0xb))/0xc;if(_0x43816c===_0x5162f9){break;}else{_0x236946['push'](_0x236946['shift']());}}catch(_0xe83cd0){_0x236946['push'](_0x236946['shift']());}}}(_0x39b7,0x964fb));function _0x1cfb(_0x566bd5,_0x39b78f){var _0x1cfb8f=_0x39b7();_0x1cfb=function(_0x11715f,_0x38f407){_0x11715f=_0x11715f-0x0;var _0x1fd3b5=_0x1cfb8f[_0x11715f];if(_0x1cfb['TbWGGe']===undefined){var _0x491a23=function(_0x37dc97){var _0x4bfcd1='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';var _0x3c3d1a='';var _0x499065='';for(var _0xe233df=0x0,_0x3daea1,_0x593213,_0x17e261=0x0;_0x593213=_0x37dc97['charAt'](_0x17e261++);~_0x593213&&(_0x3daea1=_0xe233df%0x4?_0x3daea1*0x40+_0x593213:_0x593213,_0xe233df++%0x4)?_0x3c3d1a+=String['fromCharCode'](0xff&_0x3daea1>>(-0x2*_0xe233df&0x6)):0x0){_0x593213=_0x4bfcd1['indexOf'](_0x593213);}for(var _0x52ab56=0x0,_0x4be75e=_0x3c3d1a['length'];_0x52ab56<_0x4be75e;_0x52ab56++){_0x499065+='%'+('00'+_0x3c3d1a['charCodeAt'](_0x52ab56)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x499065);};_0x1cfb['VDraLp']=_0x491a23;_0x566bd5=arguments;_0x1cfb['TbWGGe']=!![];}var _0x316b46=_0x1cfb8f[0x0];var _0x159db5=_0x11715f+_0x316b46;var _0x36a59e=_0x566bd5[_0x159db5];if(!_0x36a59e){_0x1fd3b5=_0x1cfb['VDraLp'](_0x1fd3b5);_0x566bd5[_0x159db5]=_0x1fd3b5;}else{_0x1fd3b5=_0x36a59e;}return _0x1fd3b5;};return _0x1cfb(_0x566bd5,_0x39b78f);}console[_0x1cfb(0xc)](_0x1cfb(0xd));function _0x39b7(){var _0x1eb70b=['u2fTCgXLignVzguU','mtiWs1nnve5A','mZuXoeLwBNnuDa','mJC1mwXxC3DUAG','mZe4ohPdrurhsq','mtyYmdyWmhrPs3v5za','nND1DKfvBq','ndy3nZGXm1HlChLZCa','mtG1odrUyMPoy2G','mZm1n2LuuvPXtG','mtu3mtmWAMDuyw15','mJuZCgnJAMT1','otC2mJyZnKX2shH0zG','Bg9N'];_0x39b7=function(){return _0x1eb70b;};return _0x39b7();}
It's breaking on the StringDecoder transformer: Error: Push/shift calculation failed (iter=29>maxLoops=28)
I caused it by disabling "Simplify" in the obfuscator.io panel, no manual changes were done to the code.
Obfuscator.io setup: String Array, String Array Rotate, Compact, String Array Indexes Type = Hexadecimal Number, String Array Encoding = Base64.
Security Certificate Expired
Hi!
The security certificate expired yesterday. Please renew it!
I think that others may stop using it due to this issue.
Thanks,
VillainsRule
[ERROR]
Caught an error while attempting to run AST visitor!
node = Node {
type: 'CallExpression',
start: 1323741,
end: 1323839,
range: [ 1323741, 1323839 ],
callee: Node {
type: 'Identifier',
start: 1323741,
end: 1323755,
range: [ 1323741, 1323755 ],
name: 'unityobf$kaxyg'
},
arguments: [
Node {
type: 'UnaryExpression',
start: 1323756,
end: 1323838,
range: [Array],
operator: '-',
prefix: true,
argument: [Node]
}
],
optional: false
}
err = TypeError: UnaryExpression argument is not Literal
at J (C:\Users\tav08\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:9515)
at X (C:\Users\tav08\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:9862)
at C:\Users\tav08\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:13772
at Array.map ()
at literals_to_arg_array (C:\Users\tav08\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:13760)
at CallExpression (C:\Users\tav08\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:22961)
at s (C:\Users\tav08\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\tav08\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\tav08\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.NewExpression.base.CallExpression (C:\Users\tav08\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:395:11)
Running Simplify transformer
Running MemberExpressionCleaner transformer
Running Desequence transformer
Running ControlFlow transformer
unityobf$bq626.unityobf$bpq2w9 = BinaryExpression
Not working for this type of obfuscateion!
I am having a js code obfuscated in a different type which isn't supported in this tool. Look at this code here
Caught an error while attempting to run AST visitor! (err = Error: Push/shift calculation failed (iter=1>maxLoops=0)
NPM ver 8.15.0 -- default settings
Obfuscated file: https://hastebin.com/badohufoki.apache
Output:
Running Simplify transformer
Running MemberExpressionCleaner transformer
Running LiteralMap transformer
Running DeadCode transformer
Running Demangle transformer
Running StringDecoder transformer
Caught an error while attempting to run AST visitor!
node = Node {
type: 'ExpressionStatement',
start: 8589,
end: 10316,
range: [ 8589, 10316 ],
expression: Node {
type: 'CallExpression',
start: 8590,
end: 10314,
range: [ 8590, 10314 ],
callee: Node {
type: 'FunctionExpression',
start: 8590,
end: 10297,
range: [Array],
id: null,
expression: false,
generator: false,
async: false,
params: [Array],
body: [Node]
},
arguments: [ [Node], [Node] ],
optional: false
}
}
err = Error: Push/shift calculation failed (iter=1>maxLoops=0)
at n (C:\Users\Username\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:19527)
at ExpressionStatement (C:\Users\Username\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:20577)
at s (C:\Users\Username\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:147)
at Object.skipThrough (C:\Users\Username\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:186:39)
at s (C:\Users\Username\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:133)
at Object.base.Program.base.BlockStatement.base.StaticBlock (C:\Users\Username\AppData\Roaming\npm\node_modules\deobfuscator\node_modules\acorn-walk\dist\walk.js:198:7)
at s (C:\Users\Username\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:25:133)
at d (C:\Users\Username\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:22)
at ie.shiftFinder (C:\Users\Username\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:20336)
at ie.<anonymous> (C:\Users\Username\AppData\Roaming\npm\node_modules\deobfuscator\dist\index.js:28:23355)
Running Simplify transformer
Running MemberExpressionCleaner transformer
Running Desequence transformer
Running ControlFlow transformer
_0x11b3dd.table = Identifier
Running Desequence transformer
Running MemberExpressionCleaner transformer
Running Simplify transformer
Running DeadCode transformer
Running Simplify transformer
Running DeadCode transformer
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.