Message-ID:

"Plan to throw one away. You will anyway." -- Fred Brooks, "The Mythical Man Month"

devel / comp.lang.javascript / Deobfuscating script

Deobfuscating script

<2a1ae722-c8fb-44d4-9fdf-ec1760b95da5n@googlegroups.com>

https://www.rocksolidbbs.com/devel/article-flat.php?id=17181&group=comp.lang.javascript#17181

copy link Newsgroups: comp.lang.javascript

X-Received: by 2002:ac8:4741:: with SMTP id k1mr4286474qtp.374.1626359410291;
Thu, 15 Jul 2021 07:30:10 -0700 (PDT)
X-Received: by 2002:a9d:7ad7:: with SMTP id m23mr4139322otn.138.1626359410001;
Thu, 15 Jul 2021 07:30:10 -0700 (PDT)
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!proxad.net!feeder1-2.proxad.net!209.85.160.216.MISMATCH!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: comp.lang.javascript
Date: Thu, 15 Jul 2021 07:30:09 -0700 (PDT)
Injection-Info: google-groups.googlegroups.com; posting-host=80.243.104.101; posting-account=fqiM0AoAAACu3aIqzAK2xf9RRpymvKVH
NNTP-Posting-Host: 80.243.104.101
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <2a1ae722-c8fb-44d4-9fdf-ec1760b95da5n@googlegroups.com>
Subject: Deobfuscating script
From: cezary.tomczyk@gmail.com (Cezary Tomczyk)
Injection-Date: Thu, 15 Jul 2021 14:30:10 +0000
Content-Type: text/plain; charset="UTF-8"

by: Cezary Tomczyk - Thu, 15 Jul 2021 14:30 UTC

Hello.

I'm trying to deobfuscate following code https://acsbapp.com/apps/app/dist/js/app.js.

So far tried https://lelinhtinh.github.io/de4js/, but it didn't help.

Any tip where to look yet would be much appreciated.

--
Cezary Tomczyk
https://www.ctomczyk.pl/

Re: Deobfuscating script

<ad3f411d-3213-48e6-b91d-ddda8699029an@googlegroups.com>

copy mid

https://www.rocksolidbbs.com/devel/article-flat.php?id=17182&group=comp.lang.javascript#17182

copy link Newsgroups: comp.lang.javascript

X-Received: by 2002:ac8:66d1:: with SMTP id m17mr6911790qtp.146.1626398705463;
Thu, 15 Jul 2021 18:25:05 -0700 (PDT)
X-Received: by 2002:a05:6830:3499:: with SMTP id c25mr6070517otu.32.1626398705099;
Thu, 15 Jul 2021 18:25:05 -0700 (PDT)
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!proxad.net!feeder1-2.proxad.net!209.85.160.216.MISMATCH!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: comp.lang.javascript
Date: Thu, 15 Jul 2021 18:25:04 -0700 (PDT)
In-Reply-To: <2a1ae722-c8fb-44d4-9fdf-ec1760b95da5n@googlegroups.com>
Injection-Info: google-groups.googlegroups.com; posting-host=2600:1700:63e1:1820:688c:2afe:ad0d:70ac;
posting-account=hYRygAoAAABkmvJVmPilz9Q1TOjgPQAq
NNTP-Posting-Host: 2600:1700:63e1:1820:688c:2afe:ad0d:70ac
References: <2a1ae722-c8fb-44d4-9fdf-ec1760b95da5n@googlegroups.com>
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <ad3f411d-3213-48e6-b91d-ddda8699029an@googlegroups.com>
Subject: Re: Deobfuscating script
From: tno@thenewobjective.com (Michael Haufe (TNO))
Injection-Date: Fri, 16 Jul 2021 01:25:05 +0000
Content-Type: text/plain; charset="UTF-8"

by: Michael Haufe (TNO) - Fri, 16 Jul 2021 01:25 UTC

On Thursday, July 15, 2021 at 9:30:15 AM UTC-5, cezary....@gmail.com wrote:
> Hello.
>
> I'm trying to deobfuscate following code https://acsbapp.com/apps/app/dist/js/app.js.
>
> So far tried https://lelinhtinh.github.io/de4js/, but it didn't help.
>
> Any tip where to look yet would be much appreciated.

searching github for tokens sometimes helps. It may be this at least partially:

https://github.com/SamuelHauptmannvanDam/nearvear/blob/9131f8e5e30cb4e70b85781b6b4e6320ff5cf617/public/talk.js

Re: Deobfuscating script

<15f67279-1d04-4026-90a4-1124913d1ecfn@googlegroups.com>

copy mid

https://www.rocksolidbbs.com/devel/article-flat.php?id=17188&group=comp.lang.javascript#17188

copy link Newsgroups: comp.lang.javascript

X-Received: by 2002:a0c:bf4b:: with SMTP id b11mr17493901qvj.11.1626554997704;
Sat, 17 Jul 2021 13:49:57 -0700 (PDT)
X-Received: by 2002:aca:dac5:: with SMTP id r188mr16924694oig.100.1626554997475;
Sat, 17 Jul 2021 13:49:57 -0700 (PDT)
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!proxad.net!feeder1-2.proxad.net!209.85.160.216.MISMATCH!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: comp.lang.javascript
Date: Sat, 17 Jul 2021 13:49:57 -0700 (PDT)
In-Reply-To: <ad3f411d-3213-48e6-b91d-ddda8699029an@googlegroups.com>
Injection-Info: google-groups.googlegroups.com; posting-host=80.243.104.101; posting-account=fqiM0AoAAACu3aIqzAK2xf9RRpymvKVH
NNTP-Posting-Host: 80.243.104.101
References: <2a1ae722-c8fb-44d4-9fdf-ec1760b95da5n@googlegroups.com> <ad3f411d-3213-48e6-b91d-ddda8699029an@googlegroups.com>
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <15f67279-1d04-4026-90a4-1124913d1ecfn@googlegroups.com>
Subject: Re: Deobfuscating script
From: cezary.tomczyk@gmail.com (Cezary Tomczyk)
Injection-Date: Sat, 17 Jul 2021 20:49:57 +0000
Content-Type: text/plain; charset="UTF-8"

by: Cezary Tomczyk - Sat, 17 Jul 2021 20:49 UTC

On Friday, 16 July 2021 at 03:25:10 UTC+2, Michael Haufe (TNO) wrote:
> On Thursday, July 15, 2021 at 9:30:15 AM UTC-5, cezary....@gmail.com wrote:
> > Hello.
> >
> > I'm trying to deobfuscate following code https://acsbapp.com/apps/app/dist/js/app.js.
> >
> > So far tried https://lelinhtinh.github.io/de4js/, but it didn't help.
> >
> > Any tip where to look yet would be much appreciated.
> searching github for tokens sometimes helps. It may be this at least partially:
>
> https://github.com/SamuelHauptmannvanDam/nearvear/blob/9131f8e5e30cb4e70b85781b6b4e6320ff5cf617/public/talk.js

Interesting. Will look in to it more closely. Thanks.

Cezary Tomczyk
https://www.ctomczyk.pl

Subject	Author
Deobfuscating script	Cezary Tomczyk
Re: Deobfuscating script	Michael Haufe (TNO)
Re: Deobfuscating script	Cezary Tomczyk