Skip to content

Very rare invalid decode of node template #538

Closed

Description

@pawelzwronek

Very rarely StringArrayRc4DecodeNodeTemplate return wrong string when decoding object's key. It ends up in undefined is not a function of similar. When I obfuscate with new seed it's on 99% fixed.
I'm trying to lower the risk of failure by altering rc4KeyLength from 4 to 6 and rc4KeysCount from 50 to 500.
Is it possible that occasional collision in generation of rc4key break this?

Expected Behavior

StringArrayRc4DecodeNodeTemplate should properly decode string

Steps to Reproduce

I can't give you an example code.

Your Environment

index.cli.js "version": "0.24.3"
{
"compact": true,
"controlFlowFlattening": false,
"controlFlowFlatteningThreshold": 0.75,
"deadCodeInjection": true,
"deadCodeInjectionThreshold": 0.4,
"debugProtection": true,
"debugProtectionInterval": false,
"disableConsoleOutput": false,
"identifierNamesGenerator": "hexadecimal",
"log": true,
"renameGlobals": true,
"rotateStringArray": true,
"selfDefending": true,
"shuffleStringArray": true,
"splitStrings": false,
"splitStringsChunkLength": 10,
"stringArray": true,
"stringArrayEncoding": "rc4",
"stringArrayThreshold": 0.75,
"transformObjectKeys": false,
"unicodeEscapeSequence": false
}

  • Node version used: v12.14.0

Activity

  1. sanex3339 commented on Jan 30, 2020

    @sanex3339
    Member

    Can you show code line with the error above?

  2. pawelzwronek commented on Jan 30, 2020

    @pawelzwronek
    Author

    It's runtime error for example Ee._12(256,Te.a,false) is obfuscated to _0x55bc2f[_0x4db2('0x1727','bdx4WD')](0x100,_0xd104ae['a'],!0x1) and _0x4db2('0x1727','bdx4WD') return incorrectly decoded string when _12 should.

  3. pawelzwronek commented on Jan 30, 2020

    @pawelzwronek
    Author

    I was trying to force collision but no luck
    node <script below>
    obfuscate out.js
    node out.js

    const fs = require('fs');
    
    function main() {
        let o = '';
        
        function add(s) {
            o += s + '\n';
        }
    	
        add('let Ee = {');
    
        let ids = [];
        for (let i = 0; i < 10000; i++) {1
            let id = '' + Math.round(Math.random() * 10000);
            if (!ids.includes(id)) {
                ids.push(id);
                add('_' + id + ': (a,b,c=1) => a + b * c,');
            }
        }
        add('};')
        add(`let sum = 0;`)
    
        for (let i = 0; i < 100000; i++) {
            let id = ids[Math.round(Math.random() * 1000) % ids.length];
            add('sum += Ee._' + id + '(' + i + ',' + i * 2 + ',' + i + ');');
        }
        add('console.log(sum);');
    
        fs.writeFileSync('out.js', o);
    }
    
    main();
  4. pawelzwronek commented on Jan 30, 2020

    @pawelzwronek
    Author

    Here is snipped where most time an error occurs. In Ee._12 for example, _12 is broken.

  5. sanex3339 commented on Jan 30, 2020

    @sanex3339
    Member

    Will check it on the weekend

  6. pawelzwronek commented on Jan 31, 2020

    @pawelzwronek
    Author

    Checkout mail at yandex.ru :)

  7. sanex3339 commented on Feb 1, 2020

    @sanex3339
    Member

    Did you send me something in the mail?

  8. sanex3339 commented on Feb 1, 2020

    @sanex3339
    Member

    Should be fixed now

  9. sanex3339 commented on Feb 2, 2020

    @sanex3339
    Member

    Did you try it?

  10. pawelzwronek commented on Feb 2, 2020

    @pawelzwronek
    Author

    Yup, it's working very well.

  11. sanex3339 commented on Feb 2, 2020

    @sanex3339
    Member

    Nice!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions