Skip to content

Conversation

enbyte
Copy link
Contributor

@enbyte enbyte commented Aug 15, 2025

Hello,

The new dynamic propagation pass looks awesome!

This pull request adds decodeURIComponent and encodeURIComponent builtin functions to the dynamic constprop analysis. They both work as expected with Unicode. This might not be the most useful pull request of all time, since I don't really know of any obfuscators that use decodeURIComponent, but it is a small step towards hopefully 100% coverage of builtins.

Things to note:

  • There aren't currently any tests for the two functions because I don't see a script like the conversion test generator for the transforms. Should I just paste in the build template and output of a manual run, or is there a script to handle that?
  • This doesn't handle decodeURI and encodeURI, which are similar but have slightly different sets of characters that they exclude. Those should be easy to patch in and I will make another PR soonish adding them.

@phisiart
Copy link
Collaborator

Thanks for the contribution! I just checked and it seems that decodeURIComponent and encodeURIComponent are available as global functions in QuickJS.

./qjs
QuickJS - Type "\h" for help
qjs > decodeURIComponent
function decodeURIComponent()
qjs > encodeURIComponent("test?")
"test%3F"

Therefore, we would prefer invoking QuickJS over reimplementing our own. Could you double check they are indeed available and if so, adjust your PR? Thanks!

There are two ways to do this:

  • In DynamicPrelude::Create(), add decodeURIComponent and encodeURIComponent to prelude_symbols. Note that atob and btoa are not available in QuickJS and that's why we unfortunately had to implement our own.

  • Manually invoke QuickJS, like EmulateBinOp().

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants