webcrack icon indicating copy to clipboard operation
webcrack copied to clipboard

Error when deobfuscating stringArrayWrapper functions

Open ptraced opened this issue 1 year ago • 2 comments

Describe the bug

Error when deobfuscating some files

It seems to work sometimes.

Expected Behaviour

Deobfuscate

Code

https://paste.dmca.sh/otanidegow.md

Logs

Error: Cannot read properties of undefined (reading 'charAt')

ptraced avatar Jun 13 '24 23:06 ptraced

Bug happens when deobfuscating function wrappers: https://github.com/javascript-obfuscator/javascript-obfuscator#stringarraywrapperstype It inlines the function arguments, but u = u - -772 is ignored and leads to a wrong number

function bF(n, t, r, u, e) {
  return __DECODE_0__(u - -629, r);
}
function e(n, t, r, u, e) {
  return bF(e - 269, (u = u - -772) - 79, e, u - 649, e - 410 - 54);
}

// should be replaced with __DECODE_0__(1046, 501); which returns 'tempBans'
// but is __DECODE_0__(274, 501); and errors
e(0, 0, 0, 294, 501);

Sometimes it even reassigns normal code variables/parameters so I think the script was generated with a custom obfuscator fork:

function hasPermissionOrRole(u, n, t) {
  return n[bG(474, -94, n = -540, 672, n - 401)](n => {

Gonna be hard to fix...

j4k0xb avatar Jun 14 '24 13:06 j4k0xb

Same here, when I try to deobfuscate https://abs.twimg.com/responsive-web/client-web/ondemand.s.453854fa.js, it throws this error:

Error: Cannot read properties of undefined (reading 'charAt')

So i decided to run terser (https://try.terser.org/) then deobfuscate. this works, but it doesnt fully deobfuscate the script.

youdie323323 avatar Jun 29 '24 21:06 youdie323323