Sulkta-OSS/rustypipe
Archived
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: don't use a specific letter for the nsig function name regex

Browse source
This commit is contained in:
ThetaDev 2022-10-10 22:25:20 +02:00
parent 1f6a9a5aaa
commit 4dfdb47cae
1 changed files with 7 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/deobfuscate.rs
View file

@ -68,7 +68,7 @@ impl From<DeobfData> for Deobfuscator {
const DEOBFUSCATION_FUNC_NAME: &str = "deobfuscate"; const DEOBFUSCATION_FUNC_NAME: &str = "deobfuscate";
fn get_sig_fn_name(player_js: &str) -> Result<String> { fn get_sig_fn_name(player_js: &str) -> Result<String> {
static FUNCTION_PATTERNS: Lazy<[Regex; 6]> = Lazy::new(|| { static FUNCTION_REGEXES: Lazy<[Regex; 6]> = Lazy::new(|| {
[ [
Regex::new("(?:\\b|[^a-zA-Z0-9$])([a-zA-Z0-9$]{2,})\\s*=\\s*function\\(\\s*a\\s*\\)\\s*\\{\\s*a\\s*=\\s*a\\.split\\(\\s*\"\"\\s*\\)").unwrap(), Regex::new("(?:\\b|[^a-zA-Z0-9$])([a-zA-Z0-9$]{2,})\\s*=\\s*function\\(\\s*a\\s*\\)\\s*\\{\\s*a\\s*=\\s*a\\.split\\(\\s*\"\"\\s*\\)").unwrap(),
Regex::new("\\bm=([a-zA-Z0-9$]{2,})\\(decodeURIComponent\\(h\\.s\\)\\)").unwrap(), Regex::new("\\bm=([a-zA-Z0-9$]{2,})\\(decodeURIComponent\\(h\\.s\\)\\)").unwrap(),
@ -79,7 +79,7 @@ fn get_sig_fn_name(player_js: &str) -> Result<String> {
] ]
}); });
util::get_cg_from_regexes(FUNCTION_PATTERNS.iter(), player_js, 1) util::get_cg_from_regexes(FUNCTION_REGEXES.iter(), player_js, 1)
.ok_or(DeobfError::Extraction("deobf function name")) .ok_or(DeobfError::Extraction("deobf function name"))
} }
@ -107,10 +107,10 @@ fn get_sig_fn(player_js: &str) -> Result<String> {
.as_str() .as_str()
+ ";"; + ";";
static HELPER_OBJECT_NAME_PATTERN: Lazy<Regex> = static HELPER_OBJECT_NAME_REGEX: Lazy<Regex> =
Lazy::new(|| Regex::new(";([A-Za-z0-9_\\$]{2})\\...\\(").unwrap()); Lazy::new(|| Regex::new(";([A-Za-z0-9_\\$]{2})\\...\\(").unwrap());
let helper_object_name = some_or_bail!( let helper_object_name = some_or_bail!(
HELPER_OBJECT_NAME_PATTERN HELPER_OBJECT_NAME_REGEX
.captures(&deobfuscate_function) .captures(&deobfuscate_function)
.ok() .ok()
.flatten(), .flatten(),
@ -151,13 +151,13 @@ fn deobfuscate_sig(sig: &str, sig_fn: &str) -> Result<String> {
} }
fn get_nsig_fn_name(player_js: &str) -> Result<String> { fn get_nsig_fn_name(player_js: &str) -> Result<String> {
static FUNCTION_NAME_PATTERN: Lazy<Regex> = Lazy::new(|| { static FUNCTION_NAME_REGEX: Lazy<Regex> = Lazy::new(|| {
Regex::new("\\.get\\(\"n\"\\)\\)&&\\(b=([a-zA-Z0-9$]+)(?:\\[(\\d+)])?\\([a-zA-Z0-9]\\)") Regex::new("\\.get\\(\"n\"\\)\\)&&\\([a-zA-Z0-9$_]=([a-zA-Z0-9$_]+)(?:\\[(\\d+)])?\\([a-zA-Z0-9$_]\\)")
.unwrap() .unwrap()
}); });
let fname_match = some_or_bail!( let fname_match = some_or_bail!(
FUNCTION_NAME_PATTERN.captures(player_js).ok().flatten(), FUNCTION_NAME_REGEX.captures(player_js).ok().flatten(),
Err(DeobfError::Extraction("n_deobf function")) Err(DeobfError::Extraction("n_deobf function"))
); );