Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Limiter #18

Closed
Sharppp3 opened this issue Dec 16, 2022 · 16 comments
Closed

Limiter #18

Sharppp3 opened this issue Dec 16, 2022 · 16 comments

Comments

@Sharppp3
Copy link

error: [deobfuscator.js] Error when transforming the input source code to AST. This is an 'esprima' parser limitation and the code needs to be transpiled to an esprima compatible version before passing it to the deobfuscator. error = Error: Line 124: Unexpected token .. Stack = Error: Line 124: Unexpected token .```

how do i get rid of the limiter?
@0x1Avram
Copy link
Owner

From the projects readme in the “notes” section:
There are some scenarios where the deobfuscator might crash because an AST cannot be generated from the input. This is a limitation from the esprima parser used by the deobfuscator which does not support all new JavaScript features. If this error is encountered, a message suggesting that the code needs to be transpiled before deobfuscation will be displayed. The transpilation to an older JavaScript version for which esprima correctly parses the script can be done using [Babel](https://babeljs.io/) and the parsing of the script can be checked with tools such as [astexplorer](https://astexplorer.net/).
If you can’t figure out how to transpile the code, share the obfuscated code either here or privately and I’ll help you out.

@Sharppp3
Copy link
Author

From the projects readme in the “notes” section:
There are some scenarios where the deobfuscator might crash because an AST cannot be generated from the input. This is a limitation from the esprima parser used by the deobfuscator which does not support all new JavaScript features. If this error is encountered, a message suggesting that the code needs to be transpiled before deobfuscation will be displayed. The transpilation to an older JavaScript version for which esprima correctly parses the script can be done using [Babel](https://babeljs.io/) and the parsing of the script can be checked with tools such as [astexplorer](https://astexplorer.net/).
If you can’t figure out how to transpile the code, share the obfuscated code either here or privately and I’ll help you out.

Hey bro don’t rlly understand in programming is there a chance that you could give me ready files?

@0x1Avram
Copy link
Owner

Upload the sample to pastebin, post the link here and I will create a more detailed guide on deobfuscation in this scenario for the documentation.

@Sharppp3
Copy link
Author

Ok I’ll do it later is there a chance I can get your discord? For easier contact

@Sharppp3
Copy link
Author

coun

Upload the sample to pastebin, post the link here and I will create a more detailed guide on deobfuscation in this scenario for the documentation.

couldnt upload it to paste bin has a limit here is a mediafire link https://www.mediafire.com/file/sq4ux1ylfdr1hzg/a.txt/file

@0x1Avram
Copy link
Owner

0x1Avram commented Dec 29, 2022

I don't use discord. You can find my e-mail in the comments from here - Not finish stage #8
This seems to have been obfuscated with an older version of the obfuscator. I'm working on some tweaks for it and need to do some more testing. If it all works out, I will be updating the project in the next few days.

@Sharppp3
Copy link
Author

I don't use discord. You can find my e-mail in the comments from here - Not finish stage #8
This seems to have been obfuscated with an older version of the obfuscator. I'm working on some tweaks for it and need to do some more testing. If it all works out, I will be updating the project in the next few days.

Okay, also my friend said you can try using acorn

@0x1Avram
Copy link
Owner

That train has left the station a long time ago. Rewriting it with acorn parser would take a significant amount of time and is not something I'm interested in.

@Sharppp3
Copy link
Author

That train has left the station a long time ago. Rewriting it with acorn parser would take a significant amount of time and is not something I'm interested in.

Oh I see, ok I’ll just wait for a new version thanks !

@0x1Avram
Copy link
Owner

Created a new release with compiled binaries - 1.0.7 .
I also added notes on how to easily transpile incompatible code to a version supported by the esprima parser. You will find them in the readme section at 'Easy transpilation with babel:'.
One thing to keep in mind is that this deobfuscator was not created with efficiency in mind. This means that for deobfuscating huge files such as this one it will take a really long time. It took me ~2 hours on a not so fast machine. Also, the generated deobfuscated code was not 100% perfect, as it still had some weird parts that are not syntactically correct, but it should give a pretty good picture of the original code.
I don't have time to investigate the weird parts at the moment, but might do so in the future.

@0x1Avram
Copy link
Owner

0x1Avram commented Jan 8, 2023

Did this solve your issue?

@Sharppp3
Copy link
Author

Did this solve your issue?

I’ll check later

@JakeAsunto
Copy link

https://pastebin.com/raw/rf3S2PTz
can you deobfuscate this bro?

@JakeAsunto
Copy link

Obfuscated Code
here try this bro

@0x1Avram
Copy link
Owner

0x1Avram commented Feb 27, 2023

@JakeAsunto your code is incomplete, so it can't be deobfuscated in this form.
function _0x2ee19f(_0x1ed415, _0x4ad085) { return _0xcd20(_0x1ed415 - -_0x2be7e5._0x25cc41, _0x4ad085); }
The function/array/whatever '_0xcd20' is missing.

@0x1Avram
Copy link
Owner

I will close this issue since the issue creator hasn't bothered testing after the fix.

@0x1Avram 0x1Avram mentioned this issue Apr 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants