Skip to content

Instantly share code, notes, and snippets.

@marcoramilli
Created February 20, 2018 13:56
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save marcoramilli/6a17e3ee2ce33cc25d9a97bd50481253 to your computer and use it in GitHub Desktop.
Save marcoramilli/6a17e3ee2ce33cc25d9a97bd50481253 to your computer and use it in GitHub Desktop.
AntiDeobfuscationJavascriptPreparationScrypt
"use strict";
var _ = require("underscore");
function keyCharAt(key, i) {
return key.charCodeAt( Math.floor(i % key.length) );
}
function xor_encrypt(key, data) {
return _.map(data, function(c, i) {
return c.charCodeAt(0) ^ keyCharAt(key, i);
});
}
function xor_decrypt(key, data) {
return _.map(data, function(c, i) {
return String.fromCharCode( c ^ keyCharAt(key, i) );
}).join("");
}
var final_payload = "console.log('Malicious Content Triggers Here !')";
var k_final = "cow001";
var encrypted_final = xor_encrypt(k_final,final_payload);
var decrypted_final = xor_decrypt(k_final, encrypted_final);
console.log(encrypted_final.toString());
console.log(decrypted_final);
var _1_payload = "cow001();";
var k_1 = "pyth001";
var encrypted_1 = xor_encrypt(k_1,_1_payload);
var decrypted_1 = xor_decrypt(k_1, encrypted_1);
console.log(encrypted_1.toString());
console.log(decrypted_1);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment