Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improperly detected unpack deletes part of input #1350

Open
felleg opened this issue Feb 22, 2018 · 2 comments · May be fixed by #2105
Open

Improperly detected unpack deletes part of input #1350

felleg opened this issue Feb 22, 2018 · 2 comments · May be fixed by #2105

Comments

@felleg
Copy link

felleg commented Feb 22, 2018

Using http://jsbeautifier.org/, you can replicate the issue seen below. I noted a few things:

  • Changing the variable name (e.g., test=["testing"];), the issue is gone
  • Removing the semi-colon, the issue is gone
  • Keeping the variable name, but assigning an int, the issue is gone

This also happens with the version downloaded from pip this morning on my local machine (Ubuntu 16.04 LTS)

Input

The code looked like this before beautification:

var _0x3e5f=['testing'];
// This is just a sample script. Paste your real code (javascript or HTML) here.

if ('this_is'==/an_example/){of_beautifier();}else{var a=b?(c%d):e[f];}

Expected Output

The code should have looked like this after beautification:

var _0x3e5f = ['testing'];     
// This is just a sample script. Paste your real code (javascript or HTML) here.
if ('this_is' == /an_example/) {
    of_beautifier();
} else {
    var a = b ? (c % d) : e[f];
}

Actual Output

The code actually looked like this after beautification:

// This is just a sample script. Paste your real code (javascript or HTML) here.
if ('this_is' == /an_example/) {
    of_beautifier();
} else {
    var a = b ? (c % d) : e[f];
}

Steps to Reproduce

Use jsbeautifier.org, paste the code above and see for yourself

Environment

OS: n/a

@bitwiseman
Copy link
Member

That specific string at the start of the input will cause the deobfuscation to run, which produces an empty output.

This does not reproduce on the website if "Detect packers and obfuscators?" is unchecked.
It does not happen at all from the node.js cli (deobfuscators are not included).

This happens in python because there is no option to not try unpacking (see https://github.com/beautify-web/js-beautify/blob/master/python/jsbeautifier/javascript/beautifier.py#L196). The placement of that call also means it happens on the commandline and when included as library. 😭

@bitwiseman bitwiseman changed the title Global variable (array) not kept? Improperly detected unpack deletes part of input Mar 22, 2018
@bitwiseman
Copy link
Member

See this code for the root of the problem:
https://github.com/beautify-web/js-beautify/blob/4ee8f02ae51576f77027c35cac4a4d0e0e619a30/js/src/unpackers/javascriptobfuscator_unpacker.js#L43-L50

Code generated with the obfuscator usually has ];function. If we add that to the detect check that should address this issue.

@bitwiseman bitwiseman modified the milestones: v1.13.7, v1.13.x Apr 13, 2021
@bitwiseman bitwiseman modified the milestones: v1.14.1, v1.14.x, v1.15.x Mar 28, 2022
@bitwiseman bitwiseman modified the milestones: v1.14.3, 1.14.x Apr 9, 2022
Donovan55 added a commit to Donovan55/js-beautify that referenced this issue Oct 2, 2022
Fixes issue beautifier#1350 by properly identifying obfuscated text
Donovan55 added a commit to Donovan55/js-beautify that referenced this issue Oct 2, 2022
@bitwiseman bitwiseman linked a pull request Oct 21, 2022 that will close this issue
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants