In VBScript Obfuscator in VBScript the simple but yet powerful VBscript obfuscator is written in VBScript. The obfuscator allows you to obfuscate the VBScript source code and still the VBScript can run as expected. If you don't have the original source code, the process can still be reverted.

The VBScript Defuscator reverts the process. The defuscator tries to look for the function keyword Execute and evaluate the expression, writes the original clean source code back to the console.

The source code of the VBScript defuscator is as follows, which only works for the specific version of VBScript obfuscator:

Option Explicit
Function Defuscator(vbs)
    Dim t
    t = InStr(1, vbs, "Execute", 1)
    t = Mid(vbs, t + Len("Execute")) 
    t = Eval(t)
    Defuscator = t
End Function
Dim fso, i
Const ForReading = 1
Set fso = CreateObject("Scripting.FileSystemObject")
For i = 0 To WScript.Arguments.Count - 1
    Dim FileName
    FileName = WScript.Arguments(i)
    Dim MyFile
    Set MyFile = fso.OpenTextFile(FileName, ForReading)
    Dim vbs
    vbs = MyFile.ReadAll    
    WScript.Echo Defuscator(vbs)
    MyFile.Close
Next
Set fso = Nothing

You can revert the process via the following vbs_defuscator.vbs

cscript.exe vbs_defuscator.vbs sample_defuscated.vbs > sample.vbs

TODO

Adding more complex obfuscation/deobfuscation steps. e.g. add a character map and reference the characters in complicated ways.

Online VBScript Obfuscator/Defuscator

https://isvbscriptdead.com/vbs-obfuscator/

Proof of work

doctorlai is my github ID and you can view my profile https://github.com/DoctorLai which has my steemit URL page.

• Commit: https://github.com/DoctorLai/VBScript_Obfuscator/commit/1bde003d20439456ce9acd13f2d5b1fc4a80a8f3