javascript-obfuscator VS CyberChef

I don't need/use IDA, Nemlei just used https://obfuscator.io/, which just obfuscates the crap out of the code using various known methods (which I won't go into detail, it's public knowledge) and an un-obfuscation was cooked up by others. The one fucked-up thing the website does is randomizing function names, it just changes every variable/function name. We can't "un-obfuscate" those, so it's up to our brains to figure out what the code does, and change the names back.

I was considering using a obfuscation library (https://github.com/javascript-obfuscator/javascript-obfuscator) and noticed in the usage example that backticks are used and the javascript is enclosed within. The issue is that my javascript already has backticks from using template literals so my code then errors out.

Obfuscation: JavaScript Obfuscator

What I ended up doing is having two build steps, one for renderer and other for the main process, in the main process build I use https://github.com/javascript-obfuscator/javascript-obfuscator. Works pretty fine.

It's to purposefully makes your code harder to read so it prevents people from stealing your work. Here's a tool that does it: https://obfuscator.io/

I just tested it on a little snippet of my code obfuscated with https://obfuscator.io/ and it worked seemingly perfectly.

My original code:

  function resizeImage(img) {

https://obfuscator.io/ produces a similar result, perhaps that's all they used.

Then we take the encrypted text and use CyberChef to decrypt it.

Let's go to CyberChef and insert our pieces of evidence.

A parameter was changed from '2AMBCgIQBg' to 'CgIIAdgDAQ%3D%3D' which is just the correct base64 encoding they should have been using the entire time.

I don't think this was a hostile action by Google, I think someone just added better input validation for security reasons and it accidently broke the bad requests they were sending.

https://gchq.github.io/CyberChef/#recipe=URL_Decode()From_Ba...

❗This is indeed the flag, but the text is encrypted with Base64. Usually, the presence of padding character "=" indicates that's Base64 type of encoding (but that's only one of the hints). To decrypt it, we can use CyberChef. Copy-paste the text and we either:

It uses a combination of magic bytes (like the `file` command), entropy analysis and character frequency detection to determine whether an output is likely to be of interest to the user.

The file type mechanism is written here[0]. There's a list of all signatures we detect here[1].

[0] https://github.com/gchq/CyberChef/blob/master/src/core/lib/F...

I think this can be deciphered using CyberChef...