Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

You passed path.replaceWith() a falsy node, use path.remove() instead #139

Open
kaorlol opened this issue Feb 19, 2025 · 2 comments
Open
Labels
bug Something isn't working deobfuscate

Comments

@kaorlol
Copy link

kaorlol commented Feb 19, 2025

Describe the bug

I webcrack the code and it errors.

Expected Behaviour

For it to deobf

Code

https://cdn.discordapp.com/attachments/1250548162561572955/1341918737464557599/omg.js?ex=67b7beb6&is=67b66d36&hm=27b8375cb03595fbc6bd4ccc6b13269e26a09544016a94b5aa09740d16773bc7&

Logs

webcrack:transforms prepare: started +0ms
  webcrack:transforms prepare: finished with 4845 changes +1s
  webcrack:transforms deobfuscate: started +0ms
  webcrack:deobfuscate String Array: r, length 5196 +0ms
  webcrack:deobfuscate String Array Rotate: yes +5ms
  webcrack:deobfuscate String Array Decoders: e +2ms
  webcrack:transforms inline-object-props: started +852ms
  webcrack:transforms inline-object-props: finished with 163 changes +286ms
  webcrack:transforms inline-decoder-wrappers: started +1ms
C:\nvm\v22.13.1\node_modules\webcrack\node_modules\@babel\traverse\lib\path\replacement.js:96
    throw new Error("You passed `path.replaceWith()` a falsy node, use `path.remove()` instead");
          ^

Error: You passed `path.replaceWith()` a falsy node, use `path.remove()` instead
    at NodePath.replaceWith (C:\nvm\v22.13.1\node_modules\webcrack\node_modules\@babel\traverse\lib\path\replacement.js:96:11)
    at Identifier (file:///C:/nvm/v22.13.1/node_modules/webcrack/dist/index.js:277:14)
    at NodePath._call (C:\nvm\v22.13.1\node_modules\webcrack\node_modules\@babel\traverse\lib\path\context.js:49:20)
    at NodePath.call (C:\nvm\v22.13.1\node_modules\webcrack\node_modules\@babel\traverse\lib\path\context.js:39:18)
    at NodePath.visit (C:\nvm\v22.13.1\node_modules\webcrack\node_modules\@babel\traverse\lib\path\context.js:88:31)
    at TraversalContext.visitQueue (C:\nvm\v22.13.1\node_modules\webcrack\node_modules\@babel\traverse\lib\context.js:90:16)
    at TraversalContext.visitSingle (C:\nvm\v22.13.1\node_modules\webcrack\node_modules\@babel\traverse\lib\context.js:66:19)
    at TraversalContext.visit (C:\nvm\v22.13.1\node_modules\webcrack\node_modules\@babel\traverse\lib\context.js:113:19)
    at traverseNode (C:\nvm\v22.13.1\node_modules\webcrack\node_modules\@babel\traverse\lib\traverse-node.js:22:17)
    at NodePath.visit (C:\nvm\v22.13.1\node_modules\webcrack\node_modules\@babel\traverse\lib\path\context.js:94:52)

Node.js v22.13.1
@kaorlol kaorlol added the bug Something isn't working label Feb 19, 2025
@j4k0xb
Copy link
Owner

j4k0xb commented Feb 20, 2025

The error happened because it tried to access the 3rd and 4th arg but they don't exist, that should be easy to fix

function s(n,t,r,e){return __DECODE_0__(n- -u- -r- -Bi-w,t);} // 4 args
s(547,805) // 2 args

But it also contains code like this and can't handle the =, same issue as #94

function b(n, t, r, e) {
  return mo(t, t - zr, n - -Dr, e - Br);
}
// ...
b(c - n, f = r._0x34ae27, 0, f - t)

And even after adding workarounds for these issues it still couldn't deobfuscate it... Kinda hard to track down the root cause with such a big file

@kaorlol
Copy link
Author

kaorlol commented Feb 20, 2025

Okay got it

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working deobfuscate
Projects
None yet
Development

No branches or pull requests

2 participants