mspublic

Deobfuscating / Unminifying Obfuscated Web App / JavaScript Code

Table of Contents

• tl;dr: AKA: devalias's shortlist
• PoC
• Tools
  • Unsorted
• wakaru

mspublic

rule Instruction_Bypass: PromptInjection
{
    meta:
        category = "Instruction Bypass"
        description = "Detects phrases used to ignore, disregard, or bypass instructions."

    strings:
        $bypass_phrase = /(Ignore|Disregard|Skip|Forget|Neglect|Overlook|Omit|Bypass|Pay no attention to|Do not follow|Do not obey)\\s*(prior|previous|preceding|above|foregoing|earlier|initial)?\\s*(content|text|instructions|instruction|directives|directive|commands|command|context|conversation|input|inputs|data|message|messages|communication|response|responses|request|requests)\\s*(and start over|and start anew|and begin afresh|and start from scratch)?/

    condition:

mspublic

The MIT License (MIT)

Copyright (c) 2015 David Weinstein

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

mspublic

#!/usr/bin/env python
"""
Reconstitue an ELF file based on the ELF header in the *.b00
file and the data in each of the other files.
"""

import sys, struct, glob, os

def readfmt(f, fmt) :
    d = f.read(struct.calcsize(fmt))

mspublic

/*
 * asdfghjkl;'
 */

#include <mach/machine/vm_types.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>