Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Failed to detect the obfs in https://hector.baidu.com/a.js #140

Open
Crystal-RainSlide opened this issue Feb 21, 2024 · 0 comments
Open

Comments

@Crystal-RainSlide
Copy link

Crystal-RainSlide commented Feb 21, 2024

URL: https://hector.baidu.com/a.js

a.js is a short one, so sad I'm not good enough to find out why the deobfuscator don't work.

Also there is a longer https://hectorstatic.baidu.com/1371300bc53d20f8.js, it can only be half de-obfs-ed in v2.4.5.

A snapshot of a.js
var _0x2495=['cEdPUUk=','WUVTRVA=','eUt6YnI=','c3BsaXQ=','NXwxMXw=','TGlOcm4=','d2NhWmM=','TGV2RHE=','cVFPeHQ=','UHpkTmE=','WEpZTUg=','fDJ8MTM=','MXwwfDE=','NHw2fDc=','fDR8OXw=','VHFCRFk=','fDEwfDM=','TkRkbVE=','VHJOTG0=','MTJ8OA==','cWppYUw='];(function(_0x4fcb42,_0x249590){var _0x2cff01=function(_0x175e8e){while(--_0x175e8e){_0x4fcb42['push'](_0x4fcb42['shift']());}};_0x2cff01(++_0x249590);}(_0x2495,0x1b3));var _0x2cff=function(_0x4fcb42,_0x249590){_0x4fcb42=_0x4fcb42-0x0;var _0x2cff01=_0x2495[_0x4fcb42];if(_0x2cff['fEIjCz']===undefined){(function(){var _0xf95bf2;try{var _0x3eee6d=Function('return\x20(function()\x20'+'{}.constructor(\x22return\x20this\x22)(\x20)'+');');_0xf95bf2=_0x3eee6d();}catch(_0x402702){_0xf95bf2=window;}var _0x38ab06='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';_0xf95bf2['atob']||(_0xf95bf2['atob']=function(_0x3071c7){var _0x3524dc=String(_0x3071c7)['replace'](/=+$/,'');var _0x15cb8d='';for(var _0x3af137=0x0,_0x2a3f28,_0x21d190,_0x35ef8d=0x0;_0x21d190=_0x3524dc['charAt'](_0x35ef8d++);~_0x21d190&&(_0x2a3f28=_0x3af137%0x4?_0x2a3f28*0x40+_0x21d190:_0x21d190,_0x3af137++%0x4)?_0x15cb8d+=String['fromCharCode'](0xff&_0x2a3f28>>(-0x2*_0x3af137&0x6)):0x0){_0x21d190=_0x38ab06['indexOf'](_0x21d190);}return _0x15cb8d;});}());_0x2cff['ZsjoFF']=function(_0x593685){var _0x54bfaf=atob(_0x593685);var _0x1e9d70=[];for(var _0xae8cc=0x0,_0x33ae87=_0x54bfaf['length'];_0xae8cc<_0x33ae87;_0xae8cc++){_0x1e9d70+='%'+('00'+_0x54bfaf['charCodeAt'](_0xae8cc)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x1e9d70);};_0x2cff['uytahu']={};_0x2cff['fEIjCz']=!![];}var _0x175e8e=_0x2cff['uytahu'][_0x4fcb42];if(_0x175e8e===undefined){_0x2cff01=_0x2cff['ZsjoFF'](_0x2cff01);_0x2cff['uytahu'][_0x4fcb42]=_0x2cff01;}else{_0x2cff01=_0x175e8e;}return _0x2cff01;};(function(){var _0x3fc986={};_0x3fc986[_0x2cff('0x8')]=_0x2cff('0x12')+_0x2cff('0x13')+_0x2cff('0x1')+_0x2cff('0x11')+_0x2cff('0x14')+_0x2cff('0xa')+_0x2cff('0x4');_0x3fc986[_0x2cff('0x7')]=function(_0x551a97,_0x5d60a3){return _0x551a97>>>_0x5d60a3;};_0x3fc986[_0x2cff('0x0')]=function(_0x1c765b,_0x329d15){return _0x1c765b&_0x329d15;};_0x3fc986[_0x2cff('0xf')]=function(_0x57bb10,_0x30dcf5){return _0x57bb10>>>_0x30dcf5;};_0x3fc986[_0x2cff('0x5')]=function(_0x3ec38d,_0x10a891){return _0x3ec38d&_0x10a891;};_0x3fc986[_0x2cff('0x10')]=function(_0x3d53a3,_0x352d91){return _0x3d53a3+_0x352d91;};_0x3fc986[_0x2cff('0xe')]=function(_0xc0713e,_0x19b803){return _0xc0713e+_0x19b803;};_0x3fc986[_0x2cff('0xc')]=function(_0x1a72b8,_0x4bd927){return _0x1a72b8+_0x4bd927;};_0x3fc986[_0x2cff('0x2')]=function(_0x327b8c,_0x346171){return _0x327b8c>>>_0x346171;};_0x3fc986[_0x2cff('0x6')]=function(_0x34e03a,_0x371081){return _0x34e03a|_0x371081;};_0x3fc986[_0x2cff('0x3')]=function(_0x2d639c,_0x4fbebe){return _0x2d639c<<_0x4fbebe;};_0x3fc986[_0x2cff('0xb')]=function(_0x39017d,_0xe1601e){return _0x39017d>>>_0xe1601e;};_0x3fc986[_0x2cff('0xd')]=function(_0x40928c,_0xae3a34){return _0x40928c+_0xae3a34;};var _0x5ec6dc=_0x3fc986;var _0x3f3d80=function(_0x44f2a1,_0x275148){var _0x17670e=_0x5ec6dc[_0x2cff('0x8')][_0x2cff('0x9')]('|');var _0x55362d=0x0;while(!![]){switch(_0x17670e[_0x55362d++]){case'0':_0x275148=[_0x5ec6dc[_0x2cff('0x7')](_0x275148[0x0],0x10),_0x5ec6dc[_0x2cff('0x0')](_0x275148[0x0],0xffff),_0x5ec6dc[_0x2cff('0x7')](_0x275148[0x1],0x10),_0x5ec6dc[_0x2cff('0x0')](_0x275148[0x1],0xffff)];continue;case'1':_0x44f2a1=[_0x5ec6dc[_0x2cff('0xf')](_0x44f2a1[0x0],0x10),_0x5ec6dc[_0x2cff('0x5')](_0x44f2a1[0x0],0xffff),_0x5ec6dc[_0x2cff('0xf')](_0x44f2a1[0x1],0x10),_0x5ec6dc[_0x2cff('0x5')](_0x44f2a1[0x1],0xffff)];continue;case'2':_0x3bd1dd[0x1]+=_0x5ec6dc[_0x2cff('0xf')](_0x3bd1dd[0x2],0x10);continue;case'3':_0x3bd1dd[0x2]+=_0x5ec6dc[_0x2cff('0x10')](_0x44f2a1[0x2],_0x275148[0x2]);continue;case'4':_0x3bd1dd[0x1]+=_0x5ec6dc[_0x2cff('0xe')](_0x44f2a1[0x1],_0x275148[0x1]);continue;case'5':_0x3bd1dd[0x1]&=0xffff;continue;case'6':_0x3bd1dd[0x3]+=_0x5ec6dc[_0x2cff('0xc')](_0x44f2a1[0x3],_0x275148[0x3]);continue;case'7':_0x3bd1dd[0x2]+=_0x5ec6dc[_0x2cff('0x2')](_0x3bd1dd[0x3],0x10);continue;case'8':return[_0x5ec6dc[_0x2cff('0x6')](_0x5ec6dc[_0x2cff('0x3')](_0x3bd1dd[0x0],0x10),_0x3bd1dd[0x1]),_0x5ec6dc[_0x2cff('0x6')](_0x5ec6dc[_0x2cff('0x3')](_0x3bd1dd[0x2],0x10),_0x3bd1dd[0x3])];case'9':_0x3bd1dd[0x0]+=_0x5ec6dc[_0x2cff('0xb')](_0x3bd1dd[0x1],0x10);continue;case'10':_0x3bd1dd[0x3]&=0xffff;continue;case'11':_0x3bd1dd[0x0]+=_0x5ec6dc[_0x2cff('0xd')](_0x44f2a1[0x0],_0x275148[0x0]);continue;case'12':_0x3bd1dd[0x0]&=0xffff;continue;case'13':_0x3bd1dd[0x2]&=0xffff;continue;case'14':var _0x3bd1dd=[0x0,0x0,0x0,0x0];continue;}break;}};}());

To decode it:

var sourceCode = `...`;
[
	["_0x2cff('0x0')", "'TqBDY'"],
	["_0x2cff('0x1')", "'|10|3'"],
	["_0x2cff('0x2')", "'NDdmQ'"],
	["_0x2cff('0x3')", "'TrNLm'"],
	["_0x2cff('0x4')", "'12|8'"],
	["_0x2cff('0x5')", "'qjiaL'"],
	["_0x2cff('0x6')", "'pGOQI'"],
	["_0x2cff('0x7')", "'YESEP'"],
	["_0x2cff('0x8')", "'yKzbr'"],
	["_0x2cff('0x9')", "'split'"],
	["_0x2cff('0xa')", "'5|11|'"],
	["_0x2cff('0xb')", "'LiNrn'"],
	["_0x2cff('0xc')", "'wcaZc'"],
	["_0x2cff('0xd')", "'LevDq'"],
	["_0x2cff('0xe')", "'qQOxt'"],
	["_0x2cff('0xf')", "'PzdNa'"],
	["_0x2cff('0x10')", "'XJYMH'"],
	["_0x2cff('0x11')", "'|2|13'"],
	["_0x2cff('0x12')", "'1|0|1'"],
	["_0x2cff('0x13')", "'4|6|7'"],
	["_0x2cff('0x14')", "'|4|9|'"]
].forEach(([before, after]) => sourceCode = sourceCode.replaceAll(before, after));
console.log(sourceCode);

Note that, after this manual decode step, deobfuscator works fine on the FunctionExpressions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant