Sulkta-OSS/rustypipe
Archived
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: make nsig_fn regex more generic

Browse source
This commit is contained in:
ThetaDev 2024-07-27 03:23:09 +02:00
parent 535ae3041c
commit d11a850fdc
1 changed files with 32 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

73
src/deobfuscate.rs
View file

@ -181,53 +181,44 @@ fn get_sig_fn(player_js: &str) -> Result<String, DeobfError> {
} }
fn get_nsig_fn_name(player_js: &str) -> Result<String, DeobfError> { fn get_nsig_fn_name(player_js: &str) -> Result<String, DeobfError> {
static FUNCTION_REGEXES: Lazy<[FancyRegex; 2]> = Lazy::new(|| { static FUNCTION_NAME_REGEX: Lazy<Regex> = Lazy::new(|| {
[ // x.get( .. y=functionName[array_num](z) .. x.set(
FancyRegex::new( Regex::new(r#"\w\.get\(.+\w=(\w{2,})\[(\d+)\]\(\w\).+\w\.set\("#).unwrap()
r#"\((?<char>[a-zA-Z0-9$_])=String\.fromCharCode\(110\),[a-zA-Z0-9$_]=[a-zA-Z0-9$_]\.get\(\k<char>\)\)&&\([a-zA-Z0-9$_]=(?<fname>[a-zA-Z0-9$_]+)(?:\[(?<idx>\d+)])?\([a-zA-Z0-9$_]\)"#,
)
.unwrap(),
FancyRegex::new(
r#"\.get\("n"\)\)&&\([a-zA-Z0-9$_]=(?<fname>[a-zA-Z0-9$_]+)(?:\[(?<idx>\d+)])?\([a-zA-Z0-9$_]\)"#,
)
.unwrap(),
]
}); });
let fname_match = FUNCTION_REGEXES let fname_match = FUNCTION_NAME_REGEX
.iter() .captures(player_js)
.find_map(|pattern| pattern.captures(player_js).ok().flatten())
.ok_or(DeobfError::Extraction("n_deobf function"))?; .ok_or(DeobfError::Extraction("n_deobf function"))?;
let function_name = fname_match.name("fname").unwrap().as_str(); let function_name = fname_match.get(1).unwrap().as_str();
match fname_match.name("idx") { if fname_match.len() == 1 {
Some(idx) => { return Ok(function_name.to_owned());
let array_num = idx
.as_str()
.parse::<usize>()
.or(Err(DeobfError::Other("could not parse array_num")))?;
let array_pattern_str =
format!(r#"var {}\s*=\s*\[(.+?)]"#, regex::escape(function_name));
let array_pattern = Regex::new(&array_pattern_str).or(Err(DeobfError::Other(
"could not parse helper pattern regex",
)))?;
let array_str = array_pattern
.captures(player_js)
.ok_or(DeobfError::Extraction("n_deobf array_str"))?
.get(1)
.unwrap()
.as_str();
let mut names = array_str.split(',');
let name = names
.nth(array_num)
.ok_or(DeobfError::Extraction("n_deobf function name"))?;
Ok(name.to_owned())
}
None => Ok(function_name.to_owned()),
} }
let array_num = fname_match
.get(2)
.unwrap()
.as_str()
.parse::<usize>()
.or(Err(DeobfError::Other("could not parse array_num")))?;
let array_pattern_str = format!(r#"var {}\s*=\s*\[(.+?)]"#, regex::escape(function_name));
let array_pattern = Regex::new(&array_pattern_str).or(Err(DeobfError::Other(
"could not parse helper pattern regex",
)))?;
let array_str = array_pattern
.captures(player_js)
.ok_or(DeobfError::Extraction("n_deobf array_str"))?
.get(1)
.unwrap()
.as_str();
let mut names = array_str.split(',');
let name = names
.nth(array_num)
.ok_or(DeobfError::Extraction("n_deobf function name"))?;
Ok(name.to_owned())
} }
fn extract_js_fn(js: &str, name: &str) -> Result<String, DeobfError> { fn extract_js_fn(js: &str, name: &str) -> Result<String, DeobfError> {