diff --git a/INFO/changelog.json b/INFO/changelog.json index 1408df2..e78bd94 100644 --- a/INFO/changelog.json +++ b/INFO/changelog.json @@ -4,5 +4,11 @@ "changes": [ "De4py released" ] + }, + { + "version": "1.0.1", + "changes": [ + "bug fixed for BlankOBF deobfuscator" + ] } ] \ No newline at end of file diff --git a/INFO/version b/INFO/version index 7e08c51..9b128d8 100644 --- a/INFO/version +++ b/INFO/version @@ -1 +1 @@ -V1.0 \ No newline at end of file +V1.0.1 \ No newline at end of file diff --git a/deobfuscators/blankOBF.py b/deobfuscators/blankOBF.py index 4fd13f8..6565513 100644 --- a/deobfuscators/blankOBF.py +++ b/deobfuscators/blankOBF.py @@ -15,7 +15,12 @@ def disasm(text): original_stdout = sys.stdout try: sys.stdout = disassembly_output - dis.dis(marshal.loads(base64.b64decode(codecs.decode(variable_list[0][1], 'rot13')+variable_list[2][1]+variable_list[3][1][::-1]+variable_list[1][1]))) + marshal_code=(base64.b64decode(codecs.decode(variable_list[0][1], 'rot13')+variable_list[2][1]+variable_list[3][1][::-1]+variable_list[1][1])) + try: + dis.dis(marshal.loads(marshal_code)) + except: + print("failed to dis marshal code so heres the marshal code only:\n") + print(marshal_code) finally: sys.stdout = original_stdout disassembly_text = disassembly_output.getvalue() diff --git a/deobfuscators/detector.py b/deobfuscators/detector.py index 759b2ff..48b342c 100644 --- a/deobfuscators/detector.py +++ b/deobfuscators/detector.py @@ -8,7 +8,7 @@ ("PlusOBF",r"exec\(\"\"\.join\(\[chr\(len\(i\)\) for i in d\]\)\)",PlusOBF), ('jawbreaker', r'([a-zA-Z_]\w{3})\s*=\s*([^;]+);', jawbreaker), ("wodx", r'(?:__NO_NO){23}', wodx), - ("BlankOBF", r"import base64, lzma; exec\(compile\(lzma\.decompress\(base64\.b64decode\(b'([A-Za-z0-9+/=]+)'\)\), \"\", \"exec\"\)\)", BlankOBF), + ("BlankOBF", r"import\s*base64,\s*lzma;\s*exec\(compile\(lzma\.decompress\(base64\.b64decode\(b'([A-Za-z0-9+/=]+)'\)\)\s*,\s*\"\"\s*,\s*\"exec\"\)\)", BlankOBF), ] def detect_obfuscator(file_path): file_data = open(file_path,'r',encoding='utf8').read()