PerimeterX/restringer

Request - module to clean up maths expressions

Closed this issue · 7 comments

            _0x64be2f = _0x3b3d74[-429 + -737 * 1 + 1167];
            _0x1f0a2f = _0x3b3d74[-2123 + 3745 + -270 * 6];
            _0x72bb57 = _0x3b3d74[-1 * 275 + 4833 + 1 * -4555];
            _0x3e1a62 = _0x3b3d74[-2684 + -5927 + -1 * -8615];
            _0x3b3d74 = _0x3b3d74[-3175 + 8206 + -5031];

that already exists
image

Hm, I ran it on this file but it didn't work

seems to be because of this error

[-] Unable to apply changes to AST: Error: Script is broken.

I got a lot of those, any idea why? Script itself isn't broken

but it is being broken by one of the deobfuscations... edge case that has to be fixed

[+] replaceEvalCallsWithLiteralContent committed 2 new changes!
src/modules/utils/logger.js:17
		[+] Replacing	eval("require('crypto');")                                  	--with--	require('crypto');
src/modules/utils/logger.js:17
		[+] Replacing	eval("require('buffer')['Buffer'];")                        	--with--	require('buffer')['Buffer'];

before:

var _0x45294f = eval("require('crypto');"), _0x85d24 = eval("require('buffer')['Buffer'];"), _0x1de599 = function (_0x564aa0) {

after:

var _0x45294f = require('crypto');, _0x85d24 = require('buffer')['Buffer'];, _0x1de599 = function (_0x564aa0) {

Ahh I see. Thanks for the info

Thanks a lot for the quick fix.

If I now run it's not failing on the same thing, but I get a lot of [-] Error in _evalInVm: ReferenceError: _0x5cbf7e is not defined, any clue what that might be related to?

Edit:
Also noticed this now: [-] Error in _evalInVm: TypeError: Date is not a constructor

Edit2:
Oh I now even got a core dump:

[-] Error in _evalInVm: AssertionError [ERR_ASSERTION]: Expected values to be loosely deep-equal:

[Function (anonymous)] {
  array: [Function (anonymous)],
  arrayBuffer: [Function (anonymous)],
  base64: [Function (anonymous)],
  buffer: [Function (anonymous)],
  create: [Function (anonymous)],
  digest: [Function (anonymous)],
  hex: [Function (anonymous)],
  update: [Function (anonymous)]
}

should loosely deep-equal

[Function (anonymous)] {
  array: [Function (anonymous)],
  arrayBuffer: [Function (anonymous)],
  base64: [Function (anonymous)],
  buffer: [Function (anonymous)],
  create: [Function (anonymous)],
  digest: [Function (anonymous)],
  hex: [Function (anonymous)],
  update: [Function (anonymous)]
}
[-] Error in _evalInVm: ReferenceError: _0x192cb0 is not defined
[-] Error in _evalInVm: SyntaxError: Function statements require a function name
[-] Error in _evalInVm: SyntaxError: Function statements require a function name
[-] Error in _evalInVm: ReferenceError: _0x4315fa is not defined
[-] Error in _evalInVm: SyntaxError: Unexpected token '('
[-] Error in _evalInVm: ReferenceError: _0xd4dde3 is not defined
[-] Error in _evalInVm: ReferenceError: _0xca9c3c is not defined
[-] Error in _evalInVm: ReferenceError: _0x4668ba is not defined
[-] Error in _evalInVm: Error: Script execution timed out after 5000ms
[-] Error in _evalInVm: TypeError: Cannot set properties of undefined (setting 'undefined')
[-] Error in _evalInVm: Error: Script execution timed out after 5000ms
[-] Error in _evalInVm: TypeError: Cannot read properties of null (reading 'p')


#
# Fatal error in , line 0
# Fatal JavaScript invalid size error 169220804
#
#
#
#FailureMessage Object: 0x7ffca2e36b80
 1: 0x7f02070d524b  [/usr/bin/../lib/libnode.so.111]
 2: 0x7f0207d69cf4 V8_Fatal(char const*, ...) [/usr/bin/../lib/libnode.so.111]
 3: 0x7f02075afa2b  [/usr/bin/../lib/libnode.so.111]
 4: 0x7f0207765e60  [/usr/bin/../lib/libnode.so.111]
 5: 0x7f0207766ec8  [/usr/bin/../lib/libnode.so.111]
 6: 0x7f020798964a v8::internal::Runtime_GrowArrayElements(int, unsigned long*, v8::internal::Isolate*) [/usr/bin/../lib/libnode.so.111]
 7: 0x7f02072e83f9  [/usr/bin/../lib/libnode.so.111]
zsh: trace trap (core dumped)  npx . webmssdk.js --clean -v -o