Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

control flow switch recovery does not work if there's case with return in if/else #162

Open
Le0Developer opened this issue Mar 8, 2025 · 3 comments
Labels
bug Something isn't working deobfuscate

Comments

@Le0Developer
Copy link
Contributor

Describe the bug

This example has a case with no trailing continue or return, so the matcher fails

m.switchCase(
m.stringLiteral(m.matcher((s) => /^\d+$/.test(s))),
m.anyList(
m.zeroOrMore(),
m.or(m.continueStatement(), m.returnStatement()),
),
),

Expected Behaviour

Not sure what the ideal fix is, but I replaced the m.anyList() with m.zeroOrMore() and it seems to work.

Code

function gl() {
  var d = "0".split("|");
  var e = 0;
  while (true) {
    switch (d[e++]) {
      case "0":
        if (true) {
          return 123;
        } else {
          return 456;
        }
    }
    break;
  }
}

Logs


@Le0Developer Le0Developer added the bug Something isn't working label Mar 8, 2025
@j4k0xb
Copy link
Owner

j4k0xb commented Mar 8, 2025

@Le0Developer
Copy link
Contributor Author

Le0Developer commented Mar 8, 2025

you are correct, it's from a ternary. the original expression is:

function gl() {
  var d = "0".split("|");
  var e = 0;
  while (true) {
    switch (d[e++]) {
      case "0":
        return i[jX(1352)] == l ? i[jX(545)](gC, e, g[h]) ? 'N' : 'f' : gB[l] || '?';
    }
    break;
  }
}

@j4k0xb
Copy link
Owner

j4k0xb commented Mar 8, 2025

Not sure what the ideal fix is

Deobfuscating control flow switch correctly the first time (most likely #44)
But removing m.anyList is an acceptable workaround too since the other matchers are still fairly strict
m.zeroOrMore is only intended to be used in m.anyList, can be removed as well.

Le0Developer added a commit to Le0Developer/webcrack that referenced this issue Mar 9, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working deobfuscate
Projects
None yet
Development

No branches or pull requests

2 participants