Last active
October 11, 2022 23:27
-
-
Save zoracon/5269a31a868962ca37c3ab0d3d9e08d5 to your computer and use it in GitHub Desktop.
Deobfubscation JS for Post on Frida
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
setImmediate(function() { | |
console.log("[*] Start"); | |
Java.perform(function() { | |
var str = "773032205849207A3831326F1351202E3B306B7D1E5A3B33252B382454173735266C3D3B53163735222D393B475C7A37222D7F38421B6A66643032205849206477303220584920643D2223725C503A3F39636C725F5C237A082C383C7950223F65023F3D5F4039353E3079755F5F666E1134141F5C4C64377A1B671F565A1B2C7F7B101F42700D1F39331717161574213F2B2337505D27606B712C7B0A543D342E317F214558262E636A6A6E1E4A37282233256C" | |
console.log("[*] Loading z1") | |
var clazz_z1 = Java.use('com.supercell.titan.z1'); | |
// var bytes = clazz_z1.a(str); For some reason the byte array had spaces so had to hardcode it below... | |
console.log("[*] UTF-8 String from Byte array created from clazz_z1.a(str)") | |
var str2 = String.fromCharCode(119,48,50,32,88,73,32,122,56,49,50,111,19,81,32,46,59,48,107,125,30,90,59,51,37,43,56,36,84,23,55,53,38,108,61,59,83,22,55,53,34,45,57,59,71,92,122,55,34,45,127,56,66,27,106,102,100,48,50,32,88,73,32,100,119,48,50,32,88,73,32,100,61,34,35,114,92,80,58,63,57,99,108,114,95,92,35,122,8,44,56,60,121,80,34,63,101,2,63,61,95,64,57,53,62,48,121,117,95,95,102,110,17,52,20,31,92,76,100,55,122,27,103,31,86,90,27,44,127,123,16,31,66,112,13,31,57,51,23,23,22,21,116,33,63,43,35,55,80,93,39,96,107,113,44,123,10,84,61,52,46,49,127,33,69,88,38,46,99,106,106,110,30,74,55,40,34,51,37,108) | |
console.log("[*] Using method b from class z1") | |
var result = clazz_z1.b(str2); | |
console.log() | |
console.log("****** DEOBFUSCATED STRING ******") | |
console.log(result) | |
console.log("****** DEOBFUSCATED STRING ******") | |
console.log() | |
}) | |
console.log("[*] End"); |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment