Created
February 16, 2018 17:08
-
-
Save dheffx/62ee892a9b4e8ec74cb51252fa547a59 to your computer and use it in GitHub Desktop.
example to unobfuscate a variant of obfuscated javascript
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
const atob = require('atob'); | |
const fs = require('fs'); | |
const unminify = require('unminify'); | |
const obfuscated = require('./obfuscated').data; | |
const outputFile = "output.js"; | |
let decoded = atob(obfuscated); | |
let escaped = escape(decoded); | |
let ready = decodeURIComponent(escaped); | |
let unobfuscated = unobfuscate(ready); | |
let unminified = unminify(unobfuscated) | |
fs.writeFile(outputFile, unminified, function(e) { | |
console.log("saved") | |
}); | |
function unobfuscate(_string) { | |
let _dict = {}, | |
_array = (_string + "").split(""), | |
_currentChar = _array[0], | |
_offset = _currentChar, | |
_result = [_currentChar], | |
_count = 256, | |
_predicate; | |
for (let i=1; i < _array.length; i++) { | |
let _nextCharCode = _array[i].charCodeAt(0); | |
if (_nextCharCode < 256) { | |
_predicate = _array[i]; | |
} else{ | |
_predicate = _dict[_nextCharCode] ? _dict[_nextCharCode] : (_offset + _currentChar); | |
} | |
_result.push(_predicate); | |
_currentChar = _predicate.charAt(0); | |
_dict[_count] = _offset + _currentChar; | |
_count++; | |
_offset = _predicate; | |
} | |
return _result.join(""); | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment