bl0odlaw
Yes j'ai tenté plusieurs deobfuscateur ça reste très illisible
Le HT reçu ça semble être du Base64
J'ai juste traduit la fonction à la main, un peu à l'arrache mais ça donne une bonne idée de ce qui est fait.
Curieux de voir ce qui peut en sortir ;)
_0x5289db.exports.getTelemetry = async function (key, _0x3fcd92) {
var _0x22bea2;
var _0x4c8ae2 = key.split("|");
try {
_0x22bea2 = _0xb105b4.decrypt(_0x4c8ae2[0], 'utf8');
} catch (err) {
return void console.error(err);
}
if (null == _0x22bea2) {
return 'err';
}
var decodedString;
var _0x517feb = _0x22bea2.split("|");
try {
decodedString = crypto.enc.Base64.parse(_0x517feb[0]);
} catch (err) {
return void console.error(err);
}
var _0x4543b4 = _0x517feb[1] != _0x3fcd92.basics[33]; // basics[33] = dofusPseudo
var _0x22b578 = _0x517feb[2];
var _0x5c8a0a = _0x22b578 ? _0x22b578.split(",") : [];
var _0x48a990 = _0x517feb[3];
const iv = crypto.lib.WordArray.random(16);
var encodedResult = await async function (_0x801f02, _0x23ee79, _0x5481f0, _0x59a6b1) {
var _0x28e9f5 = new Function("contextData", _0x23ee79)(_0x5481f0);
var _0x2aac5d = [];
await _0x3a6a89();
var _0x2b4cbd = _0x564f06.cfData.hash;
_0x2aac5d.push(_0x2b4cbd);
_0x2aac5d.push(_0x28e9f5);
_0x2aac5d.push(_0x59a6b1 ? 1 : 0);
var _0x49c9b5 = 0;
if (_0x801f02.length > 0) try {
var _0x5b6ae7 = await _0x381c3d.processLoad(_0x801f02.join(","))
for (var i = 0; i < _0x5b6ae7.length; i++) {
var _0x1d5589 = _0x5b6ae7;
if (_0x1d5589.pid) {
for (var _0x384f8e = -1, _0x4daac8 = _0x1d5589.proc, j = 0; j < _0x801f02.length; j++) {
if (_0x801f02[j] == _0x4daac8) {
_0x384f8e = j;
break;
}
}
if (-1 != _0x384f8e) {
_0x49c9b5 |= 2 ** _0x384f8e;
}
}
}
} catch (err) {
_0x49c9b5 = -1;
}
_0x2aac5d.push(String(_0x49c9b5));
_0x2aac5d.push(getRandomNetworkKey());
return _0x2aac5d.join("|");
}(_0x5c8a0a, _0x48a990, _0x3fcd92, _0x4543b4);
try {
encodedResult = function (passphrase, _0x1ab429, iv) {
var message = crypto.enc.Utf8.parse(_0x1ab429);
return crypto.AES.encrypt(message, passphrase, {
iv: iv,
mode: crypto.mode.CBC,
padding: crypto.pad.Pkcs7,
});
}(decodedString, encodedResult, iv);
} catch (err) {
return void console.error(err);
}
encodedResult += "|" + iv;
document.getElementById("flashGame").onTelemetryCallback({ answer: encodedResult });
};
