Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Not finish stage #8

Closed
tecnoweb opened this issue Sep 3, 2022 · 6 comments
Closed

Not finish stage #8

tecnoweb opened this issue Sep 3, 2022 · 6 comments

Comments

@tecnoweb
Copy link

tecnoweb commented Sep 3, 2022

Version 1.0

info: [index.js] Starting deobfuscation process. {"timestamp":"16:58:43"}
info: [deobfuscator.js] Generating AST from obfuscated source code. {"timestamp":"16:58:43"}
info: [deobfuscator.js] Deobfuscating AST. {"timestamp":"16:58:44"}
info: [deobfuscator.js] 1/12) Deobfuscating stage 'StringArray'. {"timestamp":"16:58:44"}
info: [stage_deobfuscator.js] 1/1) Transform 'StringArraySyntheticTransformer'. {"timestamp":"16:58:45"}
info: [stage_03_stringarray.js] stringArrayTemplateFunctionName = e. {"timestamp":"16:58:45"}
info: [stage_03_stringarray.js] stringArrayCallsWrapperTemplateFunctionName = f. {"timestamp":"16:58:46"}
info: [stage_03_stringarray.js] Found nodeWithStringArrayRotateFunction. {"timestamp":"16:58:46"}

Version 1.2
info: [index.js] Starting deobfuscation process. {"timestamp":"17:01:18"}
info: [deobfuscator.js] Generating AST from obfuscated source code. {"timestamp":"17:01:18"}
info: [deobfuscator.js] Deobfuscating AST. {"timestamp":"17:01:18"}
info: [deobfuscator.js] 1/12) Deobfuscating stage 'StringArray'. {"timestamp":"17:01:18"}
info: [stage_deobfuscator.js] 1/1) Transform 'StringArraySyntheticTransformer'. {"timestamp":"17:01:18"}
info: [stage_03_stringarray.js] stringArrayTemplateFunctionName = M. {"timestamp":"17:01:18"}
info: [stage_03_stringarray.js] stringArrayCallsWrapperTemplateFunctionName = K. {"timestamp":"17:01:18"}
info: [stage_03_stringarray.js] Found nodeWithStringArrayRotateFunction. {"timestamp":"17:01:19"}
info: Addding found stringarray template to execution context. {"timestamp":"17:01:19"}
info: Addding found stringarray calls wrappers templates to execution context. {"timestamp":"17:01:19"}
info: Addding found stringarray rotate template to execution context. {"timestamp":"17:01:19"}
info: Finished adding stringarray specific nodes. {"timestamp":"17:01:19"}

Is blocked here ...
But nice job :)

@0x1Avram
Copy link
Owner

0x1Avram commented Sep 3, 2022

Hello,
If you can share the sample, I can look into it and try to fix it.

@tecnoweb
Copy link
Author

tecnoweb commented Sep 3, 2022

Hello,
If you can share the sample, I can look into it and try to fix it.

can you provide mail I will send file no problem

@0x1Avram
Copy link
Owner

0x1Avram commented Sep 3, 2022

Writing it as a string concatenation so I hopefully don't get overwhelmed with spam:
'0x1avram' + '@gmail.com'

@tecnoweb
Copy link
Author

tecnoweb commented Sep 3, 2022

done send

@0x1Avram
Copy link
Owner

0x1Avram commented Sep 4, 2022

Fixed issue.
The nice part is that the code actually worked. It's just that it was incredibly slow due to the size of the obfuscated file. It took a few hours to deobfuscate it. :D
I found some way to do the deobfuscation faster, updated the project and created a new release.
Even with this update, for files that are quite large (a few megabytes) and heavily obfuscated, the deobfuscation might take a few minutes. Because of this, I also added more log messages showing that the deobfuscator is running and what progress is being made.
If you encounter other issues, please let me know.

@0x1Avram 0x1Avram closed this as completed Sep 4, 2022
@tecnoweb
Copy link
Author

tecnoweb commented Sep 4, 2022

thanks sir :)

@0x1Avram 0x1Avram mentioned this issue Dec 29, 2022
@0x1Avram 0x1Avram mentioned this issue Apr 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants