From 6d7ba58f880be618ade07f8ea080fe8c4bf8a896 Mon Sep 17 00:00:00 2001 From: cyfraeviolae Date: Wed, 3 Apr 2024 03:10:44 -0400 Subject: venv --- .../jsbeautifier/unpackers/__init__.py | 73 ++++++++++ .../unpackers/__pycache__/__init__.cpython-311.pyc | Bin 0 -> 3804 bytes .../__pycache__/evalbased.cpython-311.pyc | Bin 0 -> 1742 bytes .../javascriptobfuscator.cpython-311.pyc | Bin 0 -> 2301 bytes .../__pycache__/myobfuscate.cpython-311.pyc | Bin 0 -> 3081 bytes .../unpackers/__pycache__/packer.cpython-311.pyc | Bin 0 -> 7508 bytes .../__pycache__/urlencode.cpython-311.pyc | Bin 0 -> 1003 bytes .../jsbeautifier/unpackers/evalbased.py | 44 ++++++ .../jsbeautifier/unpackers/javascriptobfuscator.py | 61 ++++++++ .../jsbeautifier/unpackers/myobfuscate.py | 90 ++++++++++++ .../site-packages/jsbeautifier/unpackers/packer.py | 161 +++++++++++++++++++++ .../jsbeautifier/unpackers/tests/__init__.py | 2 + .../tests/__pycache__/__init__.cpython-311.pyc | Bin 0 -> 212 bytes .../testjavascriptobfuscator.cpython-311.pyc | Bin 0 -> 3519 bytes .../__pycache__/testmyobfuscate.cpython-311.pyc | Bin 0 -> 3075 bytes .../tests/__pycache__/testpacker.cpython-311.pyc | Bin 0 -> 5054 bytes .../__pycache__/testurlencode.cpython-311.pyc | Bin 0 -> 2480 bytes .../unpackers/tests/testjavascriptobfuscator.py | 59 ++++++++ .../unpackers/tests/testmyobfuscate.py | 48 ++++++ .../jsbeautifier/unpackers/tests/testpacker.py | 73 ++++++++++ .../jsbeautifier/unpackers/tests/testurlencode.py | 46 ++++++ .../jsbeautifier/unpackers/urlencode.py | 36 +++++ 22 files changed, 693 insertions(+) create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__init__.py create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/__init__.cpython-311.pyc create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/evalbased.cpython-311.pyc create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/javascriptobfuscator.cpython-311.pyc create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/myobfuscate.cpython-311.pyc create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/packer.cpython-311.pyc create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/urlencode.cpython-311.pyc create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/evalbased.py create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/javascriptobfuscator.py create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/myobfuscate.py create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/packer.py create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/tests/__init__.py create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/tests/__pycache__/__init__.cpython-311.pyc create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/tests/__pycache__/testjavascriptobfuscator.cpython-311.pyc create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/tests/__pycache__/testmyobfuscate.cpython-311.pyc create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/tests/__pycache__/testpacker.cpython-311.pyc create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/tests/__pycache__/testurlencode.cpython-311.pyc create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/tests/testjavascriptobfuscator.py create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/tests/testmyobfuscate.py create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/tests/testpacker.py create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/tests/testurlencode.py create mode 100644 venv/lib/python3.11/site-packages/jsbeautifier/unpackers/urlencode.py (limited to 'venv/lib/python3.11/site-packages/jsbeautifier/unpackers') diff --git a/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__init__.py b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__init__.py new file mode 100644 index 0000000..01c254f --- /dev/null +++ b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__init__.py @@ -0,0 +1,73 @@ +# +# General code for JSBeautifier unpackers infrastructure. See README.specs +# written by Stefano Sanfilippo +# + +"""General code for JSBeautifier unpackers infrastructure.""" + +import pkgutil +import re +from jsbeautifier.unpackers import evalbased + +# NOTE: AT THE MOMENT, IT IS DEACTIVATED FOR YOUR SECURITY: it runs js! +BLACKLIST = ["jsbeautifier.unpackers.evalbased"] + + +class UnpackingError(Exception): + """Badly packed source or general error. Argument is a + meaningful description.""" + + pass + + +def getunpackers(): + """Scans the unpackers dir, finds unpackers and add them to UNPACKERS list. + An unpacker will be loaded only if it is a valid python module (name must + adhere to naming conventions) and it is not blacklisted (i.e. inserted + into BLACKLIST.""" + path = __path__ + prefix = __name__ + "." + unpackers = [] + interface = ["unpack", "detect", "PRIORITY"] + for _importer, modname, _ispkg in pkgutil.iter_modules(path, prefix): + if "tests" not in modname and modname not in BLACKLIST: + try: + module = __import__(modname, fromlist=interface) + except ImportError: + raise UnpackingError("Bad unpacker: %s" % modname) + else: + unpackers.append(module) + + return sorted(unpackers, key=lambda mod: mod.PRIORITY) + + +UNPACKERS = getunpackers() + + +def run(source, evalcode=False): + """Runs the applicable unpackers and return unpacked source as a string.""" + for unpacker in [mod for mod in UNPACKERS if mod.detect(source)]: + source = unpacker.unpack(source) + if evalcode and evalbased.detect(source): + source = evalbased.unpack(source) + return source + + +def filtercomments(source): + """NOT USED: strips trailing comments and put them at the top.""" + trailing_comments = [] + comment = True + + while comment: + if re.search(r"^\s*\/\*", source): + comment = source[0, source.index("*/") + 2] + elif re.search(r"^\s*\/\/", source): + comment = re.search(r"^\s*\/\/", source).group(0) + else: + comment = None + + if comment: + source = re.sub(r"^\s+", "", source[len(comment) :]) + trailing_comments.append(comment) + + return "\n".join(trailing_comments) + source diff --git a/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/__init__.cpython-311.pyc b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/__init__.cpython-311.pyc new file mode 100644 index 0000000..824dc1c Binary files /dev/null and b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/__init__.cpython-311.pyc differ diff --git a/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/evalbased.cpython-311.pyc b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/evalbased.cpython-311.pyc new file mode 100644 index 0000000..38644e1 Binary files /dev/null and b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/evalbased.cpython-311.pyc differ diff --git a/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/javascriptobfuscator.cpython-311.pyc b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/javascriptobfuscator.cpython-311.pyc new file mode 100644 index 0000000..8ee047d Binary files /dev/null and b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/javascriptobfuscator.cpython-311.pyc differ diff --git a/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/myobfuscate.cpython-311.pyc b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/myobfuscate.cpython-311.pyc new file mode 100644 index 0000000..cf2948e Binary files /dev/null and b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/myobfuscate.cpython-311.pyc differ diff --git a/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/packer.cpython-311.pyc b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/packer.cpython-311.pyc new file mode 100644 index 0000000..c0abc98 Binary files /dev/null and b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/packer.cpython-311.pyc differ diff --git a/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/urlencode.cpython-311.pyc b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/urlencode.cpython-311.pyc new file mode 100644 index 0000000..ba90614 Binary files /dev/null and b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/__pycache__/urlencode.cpython-311.pyc differ diff --git a/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/evalbased.py b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/evalbased.py new file mode 100644 index 0000000..74f1f0f --- /dev/null +++ b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/evalbased.py @@ -0,0 +1,44 @@ +# +# Unpacker for eval() based packers, a part of javascript beautifier +# by Einar Lielmanis +# +# written by Stefano Sanfilippo +# +# usage: +# +# if detect(some_string): +# unpacked = unpack(some_string) +# + +"""Unpacker for eval() based packers: runs JS code and returns result. +Works only if a JS interpreter (e.g. Mozilla's Rhino) is installed and +properly set up on host.""" + +from subprocess import PIPE, Popen + +PRIORITY = 3 + + +def detect(source): + """Detects if source is likely to be eval() packed.""" + return source.strip().lower().startswith("eval(function(") + + +def unpack(source): + """Runs source and return resulting code.""" + return jseval("print %s;" % source[4:]) if detect(source) else source + + +# In case of failure, we'll just return the original, without crashing on user. + + +def jseval(script): + """Run code in the JS interpreter and return output.""" + try: + interpreter = Popen(["js"], stdin=PIPE, stdout=PIPE) + except OSError: + return script + result, errors = interpreter.communicate(script) + if interpreter.poll() or errors: + return script + return result diff --git a/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/javascriptobfuscator.py b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/javascriptobfuscator.py new file mode 100644 index 0000000..bd3a331 --- /dev/null +++ b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/javascriptobfuscator.py @@ -0,0 +1,61 @@ +# +# simple unpacker/deobfuscator for scripts messed up with +# javascriptobfuscator.com +# +# written by Einar Lielmanis +# rewritten in Python by Stefano Sanfilippo +# +# Will always return valid javascript: if `detect()` is false, `code` is +# returned, unmodified. +# +# usage: +# +# if javascriptobfuscator.detect(some_string): +# some_string = javascriptobfuscator.unpack(some_string) +# + +"""deobfuscator for scripts messed up with JavascriptObfuscator.com""" + +import re + +PRIORITY = 1 + + +def smartsplit(code): + """Split `code` at " symbol, only if it is not escaped.""" + strings = [] + pos = 0 + while pos < len(code): + if code[pos] == '"': + word = "" # new word + pos += 1 + while pos < len(code): + if code[pos] == '"': + break + if code[pos] == "\\": + word += "\\" + pos += 1 + word += code[pos] + pos += 1 + strings.append('"%s"' % word) + pos += 1 + return strings + + +def detect(code): + """Detects if `code` is JavascriptObfuscator.com packed.""" + # prefer `is not` idiom, so that a true boolean is returned + return re.search(r"^var _0x[a-f0-9]+ ?\= ?\[", code) is not None + + +def unpack(code): + """Unpacks JavascriptObfuscator.com packed code.""" + if detect(code): + matches = re.search(r"var (_0x[a-f\d]+) ?\= ?\[(.*?)\];", code) + if matches: + variable = matches.group(1) + dictionary = smartsplit(matches.group(2)) + code = code[len(matches.group(0)) :] + for key, value in enumerate(dictionary): + code = code.replace(r"%s[%s]" % (variable, key), value) + return code diff --git a/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/myobfuscate.py b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/myobfuscate.py new file mode 100644 index 0000000..0cbc7f8 --- /dev/null +++ b/venv/lib/python3.11/site-packages/jsbeautifier/unpackers/myobfuscate.py @@ -0,0 +1,90 @@ +# +# deobfuscator for scripts messed up with myobfuscate.com +# by Einar Lielmanis +# +# written by Stefano Sanfilippo +# +# usage: +# +# if detect(some_string): +# unpacked = unpack(some_string) +# + +# CAVEAT by Einar Lielmanis + +# +# You really don't want to obfuscate your scripts there: they're tracking +# your unpackings, your script gets turned into something like this, +# as of 2011-08-26: +# +# var _escape = 'your_script_escaped'; +# var _111 = document.createElement('script'); +# _111.src = 'http://api.www.myobfuscate.com/?getsrc=ok' + +# '&ref=' + encodeURIComponent(document.referrer) + +# '&url=' + encodeURIComponent(document.URL); +# var 000 = document.getElementsByTagName('head')[0]; +# 000.appendChild(_111); +# document.write(unescape(_escape)); +# + +"""Deobfuscator for scripts messed up with MyObfuscate.com""" + +import re +import base64 + +# Python 2 retrocompatibility +# pylint: disable=F0401 +# pylint: disable=E0611 +try: + from urllib import unquote +except ImportError: + from urllib.parse import unquote + +from jsbeautifier.unpackers import UnpackingError + +PRIORITY = 1 + +CAVEAT = """// +// Unpacker warning: be careful when using myobfuscate.com for your projects: +// scripts obfuscated by the free online version call back home. +// + +""" + +SIGNATURE = ( + r'["\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4A\x4B\x4C\x4D\x4E\x4F' + r"\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5A\x61\x62\x63\x64\x65" + r"\x66\x67\x68\x69\x6A\x6B\x6C\x6D\x6E\x6F\x70\x71\x72\x73\x74\x75" + r"\x76\x77\x78\x79\x7A\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x2B" + r'\x2F\x3D","","\x63\x68\x61\x72\x41\x74","\x69\x6E\x64\x65\x78' + r'\x4F\x66","\x66\x72\x6F\x6D\x43\x68\x61\x72\x43\x6F\x64\x65","' + r'\x6C\x65\x6E\x67\x74\x68"]' +) + + +def detect(source): + """Detects MyObfuscate.com packer.""" + return SIGNATURE in source + + +def unpack(source): + """Unpacks js code packed with MyObfuscate.com""" + if not detect(source): + return source + payload = unquote(_filter(source)) + match = re.search(r"^var _escape\='