mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
87 lines
2.0 KiB
Markdown
87 lines
2.0 KiB
Markdown
# JavaScript Malware Deobfuscation API Reference
|
|
|
|
## jsbeautifier (Python)
|
|
|
|
```python
|
|
import jsbeautifier
|
|
|
|
opts = jsbeautifier.default_options()
|
|
opts.indent_size = 2
|
|
opts.wrap_line_length = 120
|
|
|
|
result = jsbeautifier.beautify(obfuscated_code, opts)
|
|
```
|
|
|
|
## jsbeautifier CLI
|
|
|
|
```bash
|
|
# Beautify a file
|
|
js-beautify malicious.js -o output.js
|
|
|
|
# npx alternative
|
|
npx js-beautify script.js -o script_pretty.js
|
|
```
|
|
|
|
## Common Decoding Patterns (Python)
|
|
|
|
```python
|
|
import re, base64, urllib.parse
|
|
|
|
# Hex strings: \x68\x65\x6c\x6c\x6f -> hello
|
|
decoded = bytes.fromhex("68656c6c6f").decode("ascii")
|
|
|
|
# Unicode escapes: \u0068\u0065 -> he
|
|
decoded = chr(0x0068) + chr(0x0065)
|
|
|
|
# Base64 (atob equivalent)
|
|
decoded = base64.b64decode("aGVsbG8=").decode("utf-8")
|
|
|
|
# URL encoding (unescape equivalent)
|
|
decoded = urllib.parse.unquote("%68%65%6c%6c%6f")
|
|
|
|
# String.fromCharCode
|
|
decoded = "".join(chr(c) for c in [104, 101, 108, 108, 111])
|
|
```
|
|
|
|
## Node.js VM Sandbox
|
|
|
|
```javascript
|
|
const vm = require('vm');
|
|
const sandbox = {
|
|
eval: function(code) {
|
|
console.log("EVAL INTERCEPTED:", code.substring(0, 500));
|
|
return code;
|
|
},
|
|
document: { write: function(h) { console.log("DOC.WRITE:", h); } },
|
|
atob: function(s) { return Buffer.from(s, 'base64').toString(); },
|
|
window: { location: { href: "" } },
|
|
};
|
|
const context = vm.createContext(sandbox);
|
|
vm.runInContext(code, context, { timeout: 5000 });
|
|
```
|
|
|
|
## CyberChef Operations
|
|
|
|
| Operation | Use Case |
|
|
|-----------|----------|
|
|
| From Hex | Decode `\xNN` sequences |
|
|
| From Base64 | Decode `atob()` payloads |
|
|
| URL Decode | Decode `unescape()` strings |
|
|
| JavaScript Beautify | Format minified code |
|
|
| From CharCode | Decode `fromCharCode` arrays |
|
|
| XOR | Decode XOR-encrypted strings |
|
|
| Generic Code Beautify | Format mixed content |
|
|
|
|
## IOC Extraction Regex
|
|
|
|
```python
|
|
# URLs
|
|
re.findall(r'https?://[^\s"\'<>)]+', code)
|
|
|
|
# IP addresses
|
|
re.findall(r'\b(?:\d{1,3}\.){3}\d{1,3}\b', code)
|
|
|
|
# Domains
|
|
re.findall(r'(?:[a-zA-Z0-9-]+\.)+(?:com|net|org|io|xyz)\b', code)
|
|
```
|