Skip to content

Instantly share code, notes, and snippets.

@zoracon
Last active October 11, 2022 23:27
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save zoracon/5269a31a868962ca37c3ab0d3d9e08d5 to your computer and use it in GitHub Desktop.
Save zoracon/5269a31a868962ca37c3ab0d3d9e08d5 to your computer and use it in GitHub Desktop.
Deobfubscation JS for Post on Frida
setImmediate(function() {
console.log("[*] Start");
Java.perform(function() {
var str = "773032205849207A3831326F1351202E3B306B7D1E5A3B33252B382454173735266C3D3B53163735222D393B475C7A37222D7F38421B6A66643032205849206477303220584920643D2223725C503A3F39636C725F5C237A082C383C7950223F65023F3D5F4039353E3079755F5F666E1134141F5C4C64377A1B671F565A1B2C7F7B101F42700D1F39331717161574213F2B2337505D27606B712C7B0A543D342E317F214558262E636A6A6E1E4A37282233256C"
console.log("[*] Loading z1")
var clazz_z1 = Java.use('com.supercell.titan.z1');
// var bytes = clazz_z1.a(str); For some reason the byte array had spaces so had to hardcode it below...
console.log("[*] UTF-8 String from Byte array created from clazz_z1.a(str)")
var str2 = String.fromCharCode(119,48,50,32,88,73,32,122,56,49,50,111,19,81,32,46,59,48,107,125,30,90,59,51,37,43,56,36,84,23,55,53,38,108,61,59,83,22,55,53,34,45,57,59,71,92,122,55,34,45,127,56,66,27,106,102,100,48,50,32,88,73,32,100,119,48,50,32,88,73,32,100,61,34,35,114,92,80,58,63,57,99,108,114,95,92,35,122,8,44,56,60,121,80,34,63,101,2,63,61,95,64,57,53,62,48,121,117,95,95,102,110,17,52,20,31,92,76,100,55,122,27,103,31,86,90,27,44,127,123,16,31,66,112,13,31,57,51,23,23,22,21,116,33,63,43,35,55,80,93,39,96,107,113,44,123,10,84,61,52,46,49,127,33,69,88,38,46,99,106,106,110,30,74,55,40,34,51,37,108)
console.log("[*] Using method b from class z1")
var result = clazz_z1.b(str2);
console.log()
console.log("****** DEOBFUSCATED STRING ******")
console.log(result)
console.log("****** DEOBFUSCATED STRING ******")
console.log()
})
console.log("[*] End");
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment