Sulkta-Coop/rustypipe
Archived
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: deobfuscator: handle 1-char long global variables, find nsig fn (player 6450230e)

Browse source
This commit is contained in:
ThetaDev 2025-04-23 17:22:22 +02:00
parent c6abd89087
commit d675987654
No known key found for this signature in database
GPG key ID: E319D3C5148D65B6
2 changed files with 6 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/deobfuscate.rs
View file

@ -147,8 +147,8 @@ fn get_sig_fn(player_js: &str) -> Result<String, DeobfError> {
fn get_nsig_fn_names(player_js: &str) -> impl Iterator<Item = String> + '_ { fn get_nsig_fn_names(player_js: &str) -> impl Iterator<Item = String> + '_ {
static FUNCTION_NAME_REGEX: Lazy<Regex> = Lazy::new(|| { static FUNCTION_NAME_REGEX: Lazy<Regex> = Lazy::new(|| {
// x.get( OR index.m3u8 OR delete x.y.file .. y=functionName[array_num](z) .. x.set( // ( ==="index.m3u8" OR "index.m3u8"=== ) .. delete .. y=functionName[array_num](z)
Regex::new(r#"(?:[\w$]\.get\(|index\.m3u8|delete [\w$]+\.[\w$]+\.file).+[a-zA-Z]=([\w$]{2,})(?:\[(\d+)\])?\([a-zA-Z0-9]\).+[a-zA-Z0-9]\.set\("#) Regex::new(r#"(?:(?:===(?:[\w$]+\[\d+\]|"index\.m3u8"))|(?:(?:[\w$]+\[\d+\]|"index\.m3u8")===)).+\bdelete\b.+\b[a-zA-Z]=([\w$]{2,})(?:\[(\d+)\])?\([a-zA-Z0-9]\)"#)
.unwrap() .unwrap()
}); });
@ -331,11 +331,8 @@ fn extract_js_fn(js: &str, name: &str) -> Result<String, DeobfError> {
_ => {} _ => {}
}, },
Token::Ident(id) => { Token::Ident(id) => {
// Ignore object attributes and 1char long local vars // Ignore object attributes
if !period_before if !period_before && !global_objects.contains(&id.as_ref()) {
&& id.as_ref().len() > 1
&& !global_objects.contains(&id.as_ref())
{
// If we are on the left hand side of a variable definition statement // If we are on the left hand side of a variable definition statement
// or after "function", mark the variable name as defined // or after "function", mark the variable name as defined
if var_def_stmt if var_def_stmt
@ -780,6 +777,7 @@ c[36](c[8],c[32]),c[20](c[25],c[10]),c[2](c[22],c[8]),c[32](c[20],c[16]),c[32](c
("643afba4", "N5uAlLqm0eg1GyHO", "dCBQOejdq5s-ww"), ("643afba4", "N5uAlLqm0eg1GyHO", "dCBQOejdq5s-ww"),
("69f581a5", "-qIP447rVlTTwaZjY", "KNcGOksBAvwqQg"), ("69f581a5", "-qIP447rVlTTwaZjY", "KNcGOksBAvwqQg"),
("363db69b", "eWYu5d5YeY_4LyEDc", "XJQqf-N7Xra3gg"), ("363db69b", "eWYu5d5YeY_4LyEDc", "XJQqf-N7Xra3gg"),
("6450230e", "eWYu5d5YeY_4LyEDc", "VfULHmlBUoDPVMN"),
]; ];
for (js_hash, nsig_in, exp_nsig) in cases { for (js_hash, nsig_in, exp_nsig) in cases {

2
testfiles/deobf/dummy_player.js
View file

@ -152,7 +152,7 @@ function f(){ return 0; }
with(0); with(0);
// n_deobf function // n_deobf function
{p.X&&(b=a.get("n"))&&(b=aF[0](c),a.set("n",b),vZ.length||Vo(""))}; Ab=function(){ODa(b.D.toString());Object.assign(a.j,d);a.j.file==="index.m3u8"&&(delete a.j.file,a.path+="/file/index.m3u8");a.B="";a.url="";a.D&&(b="nn"[+a.D],JL(a),c=a.j[b]||null)&&(c=aF[0](c),a.set(b,c),aF.length||Pma(""))};
switch(0){} switch(0){case 0:} switch(0){case 0:case 0:} switch(0){} switch(0){case 0:} switch(0){case 0:case 0:}
switch(0){default:} switch(0){case 0:default:case 0:} switch(0){default:} switch(0){case 0:default:case 0:}