Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Base64 Obfuscation that doesn't seem to be deobfuscable #127

Closed
GunGunGun opened this issue Nov 27, 2024 · 3 comments
Closed

Base64 Obfuscation that doesn't seem to be deobfuscable #127

GunGunGun opened this issue Nov 27, 2024 · 3 comments
Labels
bug Something isn't working deobfuscate

Comments

@GunGunGun
Copy link

I tried to recover it with all the current deobfuscators and it doesn't seem to be possible,

Link: https://pastebin.com/DwyrBtrg

Webcrack is outputting something pretty unreadable too, even worse than just beatify it only.

@GunGunGun GunGunGun added the enhancement New feature or request label Nov 27, 2024
@j4k0xb j4k0xb added bug Something isn't working deobfuscate and removed enhancement New feature or request labels Nov 27, 2024
@j4k0xb
Copy link
Owner

j4k0xb commented Nov 27, 2024

should be a pretty simple fix, it also needs to detect arrow functions instead of only normal ones
that's the function that rotates the string array:

(n => {
  var W = _0x382f;
  var r = _0x37c9;
  var c = _0x57ce();
  for (; true;) {
    try {
      if (parseInt(r(725, "]O8Y")) / 1 * (-parseInt(W(776)) / 2) + -parseInt(W(797)) / 3 + -parseInt(W(693)) / 4 + -parseInt(W(761)) / 5 * (parseInt(W(502)) / 6) + -parseInt(W(790)) / 7 + parseInt(W(727)) / 8 + parseInt(W(611)) / 9 * (parseInt(W(682)) / 10) == n) {
        break;
      }
      c.push(c.shift());
    } catch (n) {
      c.push(c.shift());
    }
  }
})(356672);

but I think this may be a forked obfuscator version, this also messes up some other parts of the deobfuscation

@GunGunGun
Copy link
Author

I think by far this is the most headache obfuscation I've dealt with. I also don't know the origins of it, but I've seen this type of obfuscator more and more often, it's getting adapted by manga/anime/adult websites.

If it's opensource then we can do a lot to measure the potential of this type of code obfuscation.

@GunGunGun
Copy link
Author

Thank you very much, it works flawlessly now!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working deobfuscate
Projects
None yet
Development

No branches or pull requests

2 participants