mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.0 KiB
2.0 KiB
JavaScript Malware Deobfuscation API Reference
jsbeautifier (Python)
import jsbeautifier
opts = jsbeautifier.default_options()
opts.indent_size = 2
opts.wrap_line_length = 120
result = jsbeautifier.beautify(obfuscated_code, opts)
jsbeautifier CLI
# Beautify a file
js-beautify malicious.js -o output.js
# npx alternative
npx js-beautify script.js -o script_pretty.js
Common Decoding Patterns (Python)
import re, base64, urllib.parse
# Hex strings: \x68\x65\x6c\x6c\x6f -> hello
decoded = bytes.fromhex("68656c6c6f").decode("ascii")
# Unicode escapes: \u0068\u0065 -> he
decoded = chr(0x0068) + chr(0x0065)
# Base64 (atob equivalent)
decoded = base64.b64decode("aGVsbG8=").decode("utf-8")
# URL encoding (unescape equivalent)
decoded = urllib.parse.unquote("%68%65%6c%6c%6f")
# String.fromCharCode
decoded = "".join(chr(c) for c in [104, 101, 108, 108, 111])
Node.js VM Sandbox
const vm = require('vm');
const sandbox = {
eval: function(code) {
console.log("EVAL INTERCEPTED:", code.substring(0, 500));
return code;
},
document: { write: function(h) { console.log("DOC.WRITE:", h); } },
atob: function(s) { return Buffer.from(s, 'base64').toString(); },
window: { location: { href: "" } },
};
const context = vm.createContext(sandbox);
vm.runInContext(code, context, { timeout: 5000 });
CyberChef Operations
| Operation | Use Case |
|---|---|
| From Hex | Decode \xNN sequences |
| From Base64 | Decode atob() payloads |
| URL Decode | Decode unescape() strings |
| JavaScript Beautify | Format minified code |
| From CharCode | Decode fromCharCode arrays |
| XOR | Decode XOR-encrypted strings |
| Generic Code Beautify | Format mixed content |
IOC Extraction Regex
# URLs
re.findall(r'https?://[^\s"\'<>)]+', code)
# IP addresses
re.findall(r'\b(?:\d{1,3}\.){3}\d{1,3}\b', code)
# Domains
re.findall(r'(?:[a-zA-Z0-9-]+\.)+(?:com|net|org|io|xyz)\b', code)