4 ms·
If I were to be making a JavaScript obfuscator, I would simply start by rewriting the AST so that Exceptions would become the driver behind the code. That way,
by heavenlyblue 7y ago
If I were to be making a JavaScript obfuscator, I would simply start by rewriting the AST so that Exceptions would become the driver behind the code. That way, it would make it really hard to reverse the code without executing it.
Also sprinkle some parts of the code that check how much time it takes to execute it and then takes a different code path if it was interrupted.
What is done here is child's play, the author is clearly not familiar with old-school assembly obfuscation - this code is one script away from being de-obfuscated.
- cced 7y agoDo you have any references for the old-school assembly obfuscation?
- heavenlyblue 7y agoI had once worked on an executable packed by Themida. It used: - 8 layers of decrypting the initial executable - one of them decrypted the import table from the executable - each of those layers employed several methods of detecting that you're running under debugger - each of those layers employed methods of causing exceptions in popular debugging software - every single memory page was also encrypted while running, and a breakpoint was set up whenever a jump was made to it. The protection mechanism would first decrypt the next page and then encrypt the previous page. Even back then (15 years ago), the more complex option of Themida would generate a unique virtual machine with a unique bytecode for itself for a given executable, which would then execute itself. [1] https://reverseengineering.stackexchange.com/questions/16966/unpacking-a-themida-packed-x64-executable https://reverseengineering.stackexchange.com/questions/16966...
- SiempreViernes 7y agoSo does Themida represent the state of the art on obfuscation, or is that found in state sponsored malware, do you have any idea?
- Quarrel 7y agoThe current version of themida is good, and widely used, but not much of an obstacle to experienced people (although it depends on what you're trying to do). Denuvo is widely used on AAA titles and seems like a pain in the ass to deal with (ie games seem to take a while to pirate when protected with it and it adds a stupid CPU burden at times), but it doesn't have the edge it once had in the battle. https://en.wikipedia.org/wiki/Denuvo https://en.wikipedia.org/wiki/Denuvo
- hutzlibu 7y agoOuch, that does not sound right. May I asume, quite some bluescreen error's etc. were the result of madness like this? "sprinkle some parts of the code that check how much time it takes to execute it and then takes a different code path if it was interrupted" I mean, I respect it technically, if someone can do this and not disrupt behaviour or performance, but I doubt it is a smart thing to do, if stability and performance is the goal. An I believe that should be the goal of any software ...
- thrax 7y agoTimers in .js are fuzzed. Good luck getting accurate timings.