Deobfuscating Javascript with Rhino

134
vote

I use spider monkey or rhino to decode javascripts. both are nice tools.in rhino use version 1.6 as for 1.7 i am still not able to figure out how to run GUI,may be it is missing some files?
sans has posted a nice diary here.i m going to show you two tricks.
1)when a script uses document.write function,rhino or spider monkey does not work.because there is no document object and there is no document.write method.so to overcome this use following:
function doc(){
this->write=write();
}
function write(value)
{
print(value);
}

add this to your script and rhino/spider monkey will work just fine.you can set breakpoint in rhino to watch the "value"

2)Another trick is that when some script uses location.href how will you do it?simple use the code bellow(courtesy of someone on the net i don't remember but if you know please let me know and i will add link here)
function loc(){}
var location=new loc();
location.href='http://locationhere';

oh yes forgot to say by using rhino and spidermonkey, you can easily defeat the arguments.callee protection which some script uses to make it harder to decode :)


Trackback URL for this post:

http://www.secgeeks.com/trackback/2129