Skip to content

Commit

Permalink
Revert "feat: repeated deobfuscation"
Browse files Browse the repository at this point in the history
This reverts commit 404a331.

Only works in a few cases, but get's stuck too often and slows down deobfuscation for everyone.
  • Loading branch information
j4k0xb committed Sep 30, 2024
1 parent 404a331 commit 10651d3
Show file tree
Hide file tree
Showing 3 changed files with 33 additions and 45 deletions.
73 changes: 33 additions & 40 deletions packages/webcrack/src/deobfuscate/index.ts
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
import type * as t from '@babel/types';
import debug from 'debug';
import type { AsyncTransform } from '../ast-utils';
import {
Expand Down Expand Up @@ -31,52 +30,46 @@ export default {
if (!sandbox) return;

const logger = debug('webcrack:deobfuscate');
const visitedStringArrays = new Set<t.Node>();
const stringArray = findStringArray(ast);
logger(
stringArray
? `String Array: ${stringArray.length} strings`
: 'String Array: no',
);
if (!stringArray) return;

while (true) {
const stringArray = findStringArray(ast);
logger(
stringArray
? `String Array: ${stringArray.length} strings`
: 'String Array: no',
);
if (!stringArray) break;
if (visitedStringArrays.has(stringArray.path.node)) break;
visitedStringArrays.add(stringArray.path.node);
const rotator = findArrayRotator(stringArray);
logger(`String Array Rotate: ${rotator ? 'yes' : 'no'}`);

const rotator = findArrayRotator(stringArray);
logger(`String Array Rotate: ${rotator ? 'yes' : 'no'}`);
const decoders = findDecoders(stringArray);
logger(`String Array Encodings: ${decoders.length}`);

const decoders = findDecoders(stringArray);
logger(`String Array Encodings: ${decoders.length}`);
state.changes += applyTransform(ast, inlineObjectProps).changes;

state.changes += applyTransform(ast, inlineObjectProps).changes;

for (const decoder of decoders) {
state.changes += applyTransform(
ast,
inlineDecoderWrappers,
decoder.path,
).changes;
}

const vm = new VMDecoder(sandbox, stringArray, decoders, rotator);
state.changes += (
await applyTransformAsync(ast, inlineDecodedStrings, { vm })
for (const decoder of decoders) {
state.changes += applyTransform(
ast,
inlineDecoderWrappers,
decoder.path,
).changes;
}

if (decoders.length > 0) {
stringArray.path.remove();
rotator?.remove();
decoders.forEach((decoder) => decoder.path.remove());
state.changes += 2 + decoders.length;
}
const vm = new VMDecoder(sandbox, stringArray, decoders, rotator);
state.changes += (
await applyTransformAsync(ast, inlineDecodedStrings, { vm })
).changes;

state.changes += applyTransforms(
ast,
[mergeStrings, deadCode, controlFlowObject, controlFlowSwitch],
{ noScope: true },
).changes;
if (decoders.length > 0) {
stringArray.path.remove();
rotator?.remove();
decoders.forEach((decoder) => decoder.path.remove());
state.changes += 2 + decoders.length;
}

state.changes += applyTransforms(
ast,
[mergeStrings, deadCode, controlFlowObject, controlFlowSwitch],
{ noScope: true },
).changes;
},
} satisfies AsyncTransform<Sandbox>;

This file was deleted.

This file was deleted.

0 comments on commit 10651d3

Please sign in to comment.