Skip to content

Instantly share code, notes, and snippets.

@joepie91
Created April 5, 2020 22:13
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save joepie91/5fbd50a15e02e8a81da5550198257b95 to your computer and use it in GitHub Desktop.
Save joepie91/5fbd50a15e02e8a81da5550198257b95 to your computer and use it in GitHub Desktop.
DEFINITION:
var _$_77d1=["\x59\x41\x57\x6A\x66\x77\x59\x43\x39\x68\x6E\x35\x57\x52","\x66\x45\x53\x35\x58\x5B\x65\x4B","\x67\x77\x25\x53\x2C\x61\x4C\x78\x2A\x25\x67\x48","\x2A\x49\x2B\x7A\x77\x39","\x2A\x72\x57\x7E\x3D\x57\x42\x7D\x43\x23\x2E\x23\x21\x34\x3B\x4E\x4F\x26\x23\x35\x59\x2B\x34\x2B\x4C\x62\x49\x37\x28\x35\x76\x5B\x7B\x3B\x74\x40\x79\x56\x43\x4D\x6E\x35\x2C\x39\x36\x6E\x72\x61\x5F\x21\x71\x39\x3F\x65\x47\x62\x74\x52"]
var _$_c77b=[_$_77d1[0],_$_77d1[1],_$_77d1[2],_$_77d1[3],_$_77d1[4]]
USAGE:
_$_c77b[0]+[_$_c77b[1],_$_c77b[2],_$_c77b[3]][2]+_$_c77b[4];
lookup table: Map {
'_$_77d1' => [ 'YAWjfwYC9hn5WR',
'fES5X[eK',
'gw%S,aLx*%gH',
'*I+zw9',
'*rW~=WB}C#.#!4;NO&#5Y+4+LbI7(5v[{;t@yVCMn5,96nra_!q9?eGbtR' ],
'_$_c77b' => [ 'YAWjfwYC9hn5WR',
'fES5X[eK',
'gw%S,aLx*%gH',
'*I+zw9',
'*rW~=WB}C#.#!4;NO&#5Y+4+LbI7(5v[{;t@yVCMn5,96nra_!q9?eGbtR' ] }
Decoded salt: YAWjfwYC9hn5WR*I+zw9*rW~=WB}C#.#!4;NO&#5Y+4+LbI7(5v[{;t@yVCMn5,96nra_!q9?eGbtR
"use strict";
const path = require("path");
const fs = require("fs");
const execall = require("execall");
const unescapeJS = require("unescape-js");
const splitFilter = require("split-filter");
let arrayReference = /([_$a-z0-9]+)\[([0-9]+)\]/g;
let content = fs.readFileSync(path.join(__dirname, "obfuscated.js"), "utf8");
let definitionCode = /\/\/ JS salt((?:\n[^\n]+)+)\n\n/.exec(content)[1];
let usageCode = /var js_salt=([^\n]+)\n/.exec(content)[1];
console.log("DEFINITION:", definitionCode);
console.log("USAGE:\n", usageCode);
console.log("");
let defines = execall(/^var ([^=\s]+)\s*=\s*([^\n]+)(?:\n|$)/gm, definitionCode)
.map((match) => match.subMatches)
.map(([ variable, code ]) => ({ variable, code }));
let [ stringDefines, variableDefines ] = splitFilter(defines, (define) => define.code.startsWith('["'));
let lookupTable = new Map();
stringDefines.forEach((define) => {
let strings = execall(/"([^"]+)"/g, define.code)
.map((match) => match.subMatches[0])
.map((string) => unescapeJS(string));
lookupTable.set(define.variable, strings);
});
variableDefines.forEach((define) => {
let strings = execall(arrayReference, define.code)
.map((match) => match.subMatches)
.map(([ variable, index ]) => lookupTable.get(variable)[index]);
lookupTable.set(define.variable, strings);
});
console.log("lookup table:", lookupTable);
console.log("");
let resolvedUsage = usageCode
.replace(/([^$_a-z0-9])\[([$_a-z0-9,\[\]]+)\]\[(\d+)\]/g, (_, previousCharacter, options, index) => {
let optionReferences = execall(arrayReference, options)
.map((match) => match.subMatches);
let [ selectedName, selectedIndex ] = optionReferences[index];
return `${previousCharacter}${selectedName}[${selectedIndex}]`;
})
.replace(arrayReference, (_, variable, index) => `"${lookupTable.get(variable)[index]}"`)
.replace(/"\+"/g, "")
.replace(/^"/, "")
.replace(/";$/, "");
console.log("Decoded salt:", resolvedUsage);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment