3 ms·

There are a couple DevTools features that make this kind of reverse-engineering much easier. Oftentimes, the obfuscation relies on turning strings into functio

There are a couple DevTools features that make this kind of reverse-engineering much easier. Oftentimes, the obfuscation relies on turning strings into functions. You can watch all this happen with: `monitor(eval); monitor(Function)` That'll log out the arguments passed to eval and the Function constructor. https://imgur.com/hMbKQZA https://imgur.com/hMbKQZA You can also use `debug()` to breakpoint on invocation. (Yes, this works with native fns as well as user-land fns) Then, comparing memory snapshots can help illuminate the work that happened. Take a snapshot of about:blank, then another after evaluating the ips.js payload. Select comparison. Then look through the results, especially (string). This appears to be the same "VM's strings" called out in the post: https://imgur.com/2v58VM5 https://imgur.com/2v58VM5 Can also see heavy use of WebGL and wasm based on allocations.

nullpt_rs 4y ago
Love these suggestions. Definitely makes dynamic analysis heaps easier. A lot of our blog posts tend to focus on static analysis but it may be worth mentioning these techniques going forward.
umasi 4y ago
Hey! My friend linked me this comment. This is super dope, I used to RE more dynamically and knowing about monitor() and debug() would have helped me a lot haha. Also the memory snapshots, I've used that to try to debug memory leaks in the past but never thought about using it to RE. Super cool that you can also get the string that way. You can definitely get the same results a lot faster via dynamic RE for most obfuscation methods, but what attracted me to Kasada was the challenge of writing a disassembler from a static RE perspective. I also don't think dynamic RE methods are super easy to apply here once you get into the VM logic though, as I've discovered while working on part 2. If you want to chat with me about this more my socials are linked in the post, or you can message me on discord (umasi#3301) :)
- paulirish 4y ago
  Most advanced javascript developers don't know about these features, so no worries at all. :) (We're chatting now)
dwohnitmok 4y ago
Out of curiosity are monitor and debug (or equivalents) available on non-Chromium browsers?
- paulirish 4y ago
  As far as I know, nope. This set of methods used to be called the "command line api" but now its got a few names: https://developer.chrome.com/docs/devtools/console/utilities/ https://developer.chrome.com/docs/devtools/console/utilities... https://firefox-source-docs.mozilla.org/devtools-user/web_console/helpers/index.html https://firefox-source-docs.mozilla.org/devtools-user/web_co... https://developer.apple.com/library/archive/documentation/AppleApplications/Conceptual/Safari_Developer_Guide/Console/Console.html https://developer.apple.com/library/archive/documentation/Ap... The most commonly used are copy(), $(), and $0.

nullpt_rs 4y ago

Love these suggestions. Definitely makes dynamic analysis heaps easier. A lot of our blog posts tend to focus on static analysis but it may be worth mentioning these techniques going forward.

umasi 4y ago

Hey! My friend linked me this comment. This is super dope, I used to RE more dynamically and knowing about monitor() and debug() would have helped me a lot haha. Also the memory snapshots, I've used that to try to debug memory leaks in the past but never thought about using it to RE. Super cool that you can also get the string that way. You can definitely get the same results a lot faster via dynamic RE for most obfuscation methods, but what attracted me to Kasada was the challenge of writing a disassembler from a static RE perspective. I also don't think dynamic RE methods are super easy to apply here once you get into the VM logic though, as I've discovered while working on part 2. If you want to chat with me about this more my socials are linked in the post, or you can message me on discord (umasi#3301) :)

paulirish 4y ago
Most advanced javascript developers don't know about these features, so no worries at all. :) (We're chatting now)

dwohnitmok 4y ago

Out of curiosity are monitor and debug (or equivalents) available on non-Chromium browsers?

paulirish 4y ago
As far as I know, nope. This set of methods used to be called the "command line api" but now its got a few names: https://developer.chrome.com/docs/devtools/console/utilities/ https://developer.chrome.com/docs/devtools/console/utilities... https://firefox-source-docs.mozilla.org/devtools-user/web_console/helpers/index.html https://firefox-source-docs.mozilla.org/devtools-user/web_co... https://developer.apple.com/library/archive/documentation/AppleApplications/Conceptual/Safari_Developer_Guide/Console/Console.html https://developer.apple.com/library/archive/documentation/Ap... The most commonly used are copy(), $(), and $0.