-2

Each file starts with the same function:

(function(_0x128f83, _0x1ae5b9) {
    var _0x1b5471 = function(_0x339be5) {
        while (--_0x339be5) {
            _0x128f83['push'](_0x128f83['shift']());
        }
    };
    _0x1b5471(++_0x1ae5b9);
}(_0xf75e, 0xc2));
var _0x4e13 = function(_0x24c6e1, _0x3b52a9) {
    _0x24c6e1 = _0x24c6e1 - 0x0;
    var _0xc16529 = _0xf75e[_0x24c6e1];
    return _0xc16529;
};
'use strict';
Object[_0x4e13('0x0')](exports, '__esModule', {
    'value': !![]
});

I did some research and have come to the conclusion that the code was obfuscated with a library similar to obfuscator.io. My question is how do i decode the hexadecimal values, as many of the variables in the file are reliant on them (e.g. const electron_1 = require(_0x4e13('0x1'));). Any feedback would be much appreciated.

1

1 Answer 1

2

You can use this tool to partial deobfuscate that code: http://jsnice.org/

In that case I get this:

'use strict';
(function(data, i) {
  /**
   * @param {number} isLE
   * @return {undefined}
   */
  var write = function(isLE) {
    for (; --isLE;) {
      data["push"](data["shift"]());
    }
  };
  write(++i);
})(_0xf75e, 194);
/**
 * @param {string} level
 * @param {?} ai_test
 * @return {?}
 */
var _0x4e13 = function(level, ai_test) {
  /** @type {number} */
  level = level - 0;
  var rowsOfColumns = _0xf75e[level];
  return rowsOfColumns;
};
"use strict";
Object[_0x4e13("0x0")](exports, "__esModule", {
  "value" : !![]
});
5
  • Got it. How do I go about decoding the _0x4e13-like values, though?
    – solo
    Commented Jul 10, 2018 at 11:45
  • I don't have idea, I tried to complete it with zeros until it had 6 characters, but it doesn't work. Commented Jul 10, 2018 at 11:47
  • @solo: why do you want to? Clearly it's just a random object name (or hashed beyond recall), and there is nothing to decode to.
    – Jongware
    Commented Jul 10, 2018 at 11:53
  • I need to read the rest of the source code and it's hard to read when most of the variables are in that format.
    – solo
    Commented Jul 10, 2018 at 12:00
  • @solo: then rename them to whatever you find easier to read.
    – Jongware
    Commented Jul 10, 2018 at 14:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.