3 ms·
Just as a general thought, not specific to this product: This is decrypted and eval'd at runtime Most(all?) string-based obfuscators can be bypassed by simply
by dsp1234 10y ago
Just as a general thought, not specific to this product:
This is decrypted and eval'd at runtime
Most(all?) string-based obfuscators can be bypassed by simply replacing eval with a logging eval implementation.
var oldEval = eval; eval = function(str){console.log(str);oldEval(str)};
A similar patch to the Function constructor can bypass the other easy dynamic code generation code path.
If at some point, a string needs to be evaluated as code, then it's possible to intercept that code and output it.
- visarga 10y agoSo, all you need is to break a longer eval into multiple smaller ones, shuffle them and thus make it a chore to connect the evals back.
- r0ckcg 10y agotried it, does not work I'm afraid...
- slig 10y agoThat didn't work on JScrambler. The function that does the decryption checks to see if the `eval` has been tampered. (IIRC it checks for a `prototype` property). And you can't modify the body of this function otherwise the decryption fails.