RC4 Encoding Extremely Easy to Bypass with Cache

The RC4 encoding is incredibly easy to bypass by finding the cache variable. From my testing it appears to always be in the second function, which is declared as

var decoder = function(cacheIndexStr, key)

The cache can be identified by going to the bottom in the last if statement and looking for the last line which should be similar to

decoder['cache'][index] = decodedValue

If you can identify that line you just have to obtain the first part

decoder['cache']

or

decoder.cache

and enter it into a debug console to get the decoded string cache, from there the index in the cache matches the first parameter of the decoder call. After that it is easy to match up all of the strings (and function names) in the code.

Identifying the cache is not at all affected by self defending. Debug protection also does not affect the ability to print the cache, the console will still function when the code has hit a breakpoint.

Environment

• Obfuscator version used: 1.1.5
• Node version used: 6.9.5

[sanex3339]

I released 2.15.4 with some changes. Now you can’t access the cache through the console without debug tools.

[sanex3339]

@da411d what do you think?