In VBScript Obfuscator in VBScript the simple but yet powerful VBscript obfuscator is written in VBScript. The obfuscator allows you to obfuscate the VBScript source code and still the VBScript can run as expected. If you don't have the original source code, the process can still be reverted.
The VBScript Defuscator reverts the process. The defuscator tries to look for the function keyword Execute and evaluate the expression, writes the original clean source code back to the console.
The source code of the VBScript defuscator is as follows, which only works for the specific version of VBScript obfuscator:
Option Explicit
Function Defuscator(vbs)
Dim t
t = InStr(1, vbs, "Execute", 1)
t = Mid(vbs, t + Len("Execute"))
t = Eval(t)
Defuscator = t
End Function
Dim fso, i
Const ForReading = 1
Set fso = CreateObject("Scripting.FileSystemObject")
For i = 0 To WScript.Arguments.Count - 1
Dim FileName
FileName = WScript.Arguments(i)
Dim MyFile
Set MyFile = fso.OpenTextFile(FileName, ForReading)
Dim vbs
vbs = MyFile.ReadAll
WScript.Echo Defuscator(vbs)
MyFile.Close
Next
Set fso = Nothing
You can revert the process via the following vbs_defuscator.vbs
cscript.exe vbs_defuscator.vbs sample_defuscated.vbs > sample.vbs
Adding more complex obfuscation/deobfuscation steps. e.g. add a character map and reference the characters in complicated ways.
https://isvbscriptdead.com/vbs-obfuscator/
doctorlai is my github ID and you can view my profile https://github.com/DoctorLai which has my steemit URL page.