webcrack icon indicating copy to clipboard operation
webcrack copied to clipboard

Failed to deobfuscate some files

Open ptraced opened this issue 11 months ago • 4 comments

Describe the bug

Error when deobfuscating some files

Expected Behaviour

Deobfus

Code

http://dmca.sh/u/Can't%20Unpack.zip

Logs

none

ptraced avatar Dec 30 '24 23:12 ptraced

Running contentScript.js.txt on https://wakaru.vercel.app/

SyntaxError: Invalid left-hand side in assignment expression. (1:793753)
    at a (unpacker.worker-DMr9faCP.js:174:11446)
    at gq.raise (unpacker.worker-DMr9faCP.js:176:19566)
    at gq.checkLVal (unpacker.worker-DMr9faCP.js:178:14074)
    at gq.parseMaybeAssign (unpacker.worker-DMr9faCP.js:178:83066)
    at gq.parseExpressionBase (unpacker.worker-DMr9faCP.js:178:81708)
    at unpacker.worker-DMr9faCP.js:178:81626
    at gq.allowInAnd (unpacker.worker-DMr9faCP.js:179:11729)
    at gq.parseExpression (unpacker.worker-DMr9faCP.js:178:81606)
    at gq.parseStatementContent (unpacker.worker-DMr9faCP.js:179:19368)
    at gq.parseStatementLike (unpacker.worker-DMr9faCP.js:179:16568)
hook.js:608 Error: Invalid left-hand side in assignment expression. (1:793753)
    at Worker.taskResultDispatch (main-2ZEBvJd8.js:778:34925)

Image

0xdevalias avatar Feb 18 '25 05:02 0xdevalias

"Error" in the title might be a bit misleading. There's no thrown error because webcrack/babel can recover from "technically invalid syntax" like qZXTWe() = EpAebA. But it still fails to deobfuscate because support for this different obfuscator was never implemented.

Seems like a rare use case and has a simple enough structure that it could be done interactively like https://github.com/j4k0xb/webcrack/issues/76#issuecomment-2115058516

j4k0xb avatar Feb 18 '25 05:02 j4k0xb

@j4k0xb any news on this? can provide more samples (Added 2 samples)

ptraced avatar Apr 13 '25 00:04 ptraced

any news on this?

@ptraced I believe @j4k0xb already answered this:

it still fails to deobfuscate because support for this different obfuscator was never implemented

Seems like a rare use case and has a simple enough structure that it could be done interactively like #76 (comment)

0xdevalias avatar Apr 14 '25 06:04 0xdevalias