Skip to content

Failed to detect the obfs in https://hector.baidu.com/a.js #140

@Crystal-RainSlide

Description

@Crystal-RainSlide

URL: https://hector.baidu.com/a.js

a.js is a short one, so sad I'm not good enough to find out why the deobfuscator don't work.

Also there is a longer https://hectorstatic.baidu.com/1371300bc53d20f8.js, it can only be half de-obfs-ed in v2.4.5.

A snapshot of a.js
var _0x2495=['cEdPUUk=','WUVTRVA=','eUt6YnI=','c3BsaXQ=','NXwxMXw=','TGlOcm4=','d2NhWmM=','TGV2RHE=','cVFPeHQ=','UHpkTmE=','WEpZTUg=','fDJ8MTM=','MXwwfDE=','NHw2fDc=','fDR8OXw=','VHFCRFk=','fDEwfDM=','TkRkbVE=','VHJOTG0=','MTJ8OA==','cWppYUw='];(function(_0x4fcb42,_0x249590){var _0x2cff01=function(_0x175e8e){while(--_0x175e8e){_0x4fcb42['push'](_0x4fcb42['shift']());}};_0x2cff01(++_0x249590);}(_0x2495,0x1b3));var _0x2cff=function(_0x4fcb42,_0x249590){_0x4fcb42=_0x4fcb42-0x0;var _0x2cff01=_0x2495[_0x4fcb42];if(_0x2cff['fEIjCz']===undefined){(function(){var _0xf95bf2;try{var _0x3eee6d=Function('return\x20(function()\x20'+'{}.constructor(\x22return\x20this\x22)(\x20)'+');');_0xf95bf2=_0x3eee6d();}catch(_0x402702){_0xf95bf2=window;}var _0x38ab06='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';_0xf95bf2['atob']||(_0xf95bf2['atob']=function(_0x3071c7){var _0x3524dc=String(_0x3071c7)['replace'](/=+$/,'');var _0x15cb8d='';for(var _0x3af137=0x0,_0x2a3f28,_0x21d190,_0x35ef8d=0x0;_0x21d190=_0x3524dc['charAt'](_0x35ef8d++);~_0x21d190&&(_0x2a3f28=_0x3af137%0x4?_0x2a3f28*0x40+_0x21d190:_0x21d190,_0x3af137++%0x4)?_0x15cb8d+=String['fromCharCode'](0xff&_0x2a3f28>>(-0x2*_0x3af137&0x6)):0x0){_0x21d190=_0x38ab06['indexOf'](_0x21d190);}return _0x15cb8d;});}());_0x2cff['ZsjoFF']=function(_0x593685){var _0x54bfaf=atob(_0x593685);var _0x1e9d70=[];for(var _0xae8cc=0x0,_0x33ae87=_0x54bfaf['length'];_0xae8cc<_0x33ae87;_0xae8cc++){_0x1e9d70+='%'+('00'+_0x54bfaf['charCodeAt'](_0xae8cc)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x1e9d70);};_0x2cff['uytahu']={};_0x2cff['fEIjCz']=!![];}var _0x175e8e=_0x2cff['uytahu'][_0x4fcb42];if(_0x175e8e===undefined){_0x2cff01=_0x2cff['ZsjoFF'](_0x2cff01);_0x2cff['uytahu'][_0x4fcb42]=_0x2cff01;}else{_0x2cff01=_0x175e8e;}return _0x2cff01;};(function(){var _0x3fc986={};_0x3fc986[_0x2cff('0x8')]=_0x2cff('0x12')+_0x2cff('0x13')+_0x2cff('0x1')+_0x2cff('0x11')+_0x2cff('0x14')+_0x2cff('0xa')+_0x2cff('0x4');_0x3fc986[_0x2cff('0x7')]=function(_0x551a97,_0x5d60a3){return _0x551a97>>>_0x5d60a3;};_0x3fc986[_0x2cff('0x0')]=function(_0x1c765b,_0x329d15){return _0x1c765b&_0x329d15;};_0x3fc986[_0x2cff('0xf')]=function(_0x57bb10,_0x30dcf5){return _0x57bb10>>>_0x30dcf5;};_0x3fc986[_0x2cff('0x5')]=function(_0x3ec38d,_0x10a891){return _0x3ec38d&_0x10a891;};_0x3fc986[_0x2cff('0x10')]=function(_0x3d53a3,_0x352d91){return _0x3d53a3+_0x352d91;};_0x3fc986[_0x2cff('0xe')]=function(_0xc0713e,_0x19b803){return _0xc0713e+_0x19b803;};_0x3fc986[_0x2cff('0xc')]=function(_0x1a72b8,_0x4bd927){return _0x1a72b8+_0x4bd927;};_0x3fc986[_0x2cff('0x2')]=function(_0x327b8c,_0x346171){return _0x327b8c>>>_0x346171;};_0x3fc986[_0x2cff('0x6')]=function(_0x34e03a,_0x371081){return _0x34e03a|_0x371081;};_0x3fc986[_0x2cff('0x3')]=function(_0x2d639c,_0x4fbebe){return _0x2d639c<<_0x4fbebe;};_0x3fc986[_0x2cff('0xb')]=function(_0x39017d,_0xe1601e){return _0x39017d>>>_0xe1601e;};_0x3fc986[_0x2cff('0xd')]=function(_0x40928c,_0xae3a34){return _0x40928c+_0xae3a34;};var _0x5ec6dc=_0x3fc986;var _0x3f3d80=function(_0x44f2a1,_0x275148){var _0x17670e=_0x5ec6dc[_0x2cff('0x8')][_0x2cff('0x9')]('|');var _0x55362d=0x0;while(!![]){switch(_0x17670e[_0x55362d++]){case'0':_0x275148=[_0x5ec6dc[_0x2cff('0x7')](_0x275148[0x0],0x10),_0x5ec6dc[_0x2cff('0x0')](_0x275148[0x0],0xffff),_0x5ec6dc[_0x2cff('0x7')](_0x275148[0x1],0x10),_0x5ec6dc[_0x2cff('0x0')](_0x275148[0x1],0xffff)];continue;case'1':_0x44f2a1=[_0x5ec6dc[_0x2cff('0xf')](_0x44f2a1[0x0],0x10),_0x5ec6dc[_0x2cff('0x5')](_0x44f2a1[0x0],0xffff),_0x5ec6dc[_0x2cff('0xf')](_0x44f2a1[0x1],0x10),_0x5ec6dc[_0x2cff('0x5')](_0x44f2a1[0x1],0xffff)];continue;case'2':_0x3bd1dd[0x1]+=_0x5ec6dc[_0x2cff('0xf')](_0x3bd1dd[0x2],0x10);continue;case'3':_0x3bd1dd[0x2]+=_0x5ec6dc[_0x2cff('0x10')](_0x44f2a1[0x2],_0x275148[0x2]);continue;case'4':_0x3bd1dd[0x1]+=_0x5ec6dc[_0x2cff('0xe')](_0x44f2a1[0x1],_0x275148[0x1]);continue;case'5':_0x3bd1dd[0x1]&=0xffff;continue;case'6':_0x3bd1dd[0x3]+=_0x5ec6dc[_0x2cff('0xc')](_0x44f2a1[0x3],_0x275148[0x3]);continue;case'7':_0x3bd1dd[0x2]+=_0x5ec6dc[_0x2cff('0x2')](_0x3bd1dd[0x3],0x10);continue;case'8':return[_0x5ec6dc[_0x2cff('0x6')](_0x5ec6dc[_0x2cff('0x3')](_0x3bd1dd[0x0],0x10),_0x3bd1dd[0x1]),_0x5ec6dc[_0x2cff('0x6')](_0x5ec6dc[_0x2cff('0x3')](_0x3bd1dd[0x2],0x10),_0x3bd1dd[0x3])];case'9':_0x3bd1dd[0x0]+=_0x5ec6dc[_0x2cff('0xb')](_0x3bd1dd[0x1],0x10);continue;case'10':_0x3bd1dd[0x3]&=0xffff;continue;case'11':_0x3bd1dd[0x0]+=_0x5ec6dc[_0x2cff('0xd')](_0x44f2a1[0x0],_0x275148[0x0]);continue;case'12':_0x3bd1dd[0x0]&=0xffff;continue;case'13':_0x3bd1dd[0x2]&=0xffff;continue;case'14':var _0x3bd1dd=[0x0,0x0,0x0,0x0];continue;}break;}};}());

To decode it:

var sourceCode = `...`;
[
	["_0x2cff('0x0')", "'TqBDY'"],
	["_0x2cff('0x1')", "'|10|3'"],
	["_0x2cff('0x2')", "'NDdmQ'"],
	["_0x2cff('0x3')", "'TrNLm'"],
	["_0x2cff('0x4')", "'12|8'"],
	["_0x2cff('0x5')", "'qjiaL'"],
	["_0x2cff('0x6')", "'pGOQI'"],
	["_0x2cff('0x7')", "'YESEP'"],
	["_0x2cff('0x8')", "'yKzbr'"],
	["_0x2cff('0x9')", "'split'"],
	["_0x2cff('0xa')", "'5|11|'"],
	["_0x2cff('0xb')", "'LiNrn'"],
	["_0x2cff('0xc')", "'wcaZc'"],
	["_0x2cff('0xd')", "'LevDq'"],
	["_0x2cff('0xe')", "'qQOxt'"],
	["_0x2cff('0xf')", "'PzdNa'"],
	["_0x2cff('0x10')", "'XJYMH'"],
	["_0x2cff('0x11')", "'|2|13'"],
	["_0x2cff('0x12')", "'1|0|1'"],
	["_0x2cff('0x13')", "'4|6|7'"],
	["_0x2cff('0x14')", "'|4|9|'"]
].forEach(([before, after]) => sourceCode = sourceCode.replaceAll(before, after));
console.log(sourceCode);

Note that, after this manual decode step, deobfuscator works fine on the FunctionExpressions.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions