ɘɿuɔɐɿɈ tracure1337

Deobfuscating / Unminifying Obfuscated Web App / JavaScript Code

ℹ️ This was duplicated to this blog for readability and reference

The most difficult challenge with RMM detection is contextual awareness around usage to determine if it is valid or malicious.

defaults write com.apple.appstore ShowDebugMenu -bool true

and hit the Return/⏎ key to show the debug menu in App Store.app.

	Latency Comparison Numbers (~2012)
	----------------------------------
	L1 cache reference 0.5 ns
	Branch mispredict 5 ns
	L2 cache reference 7 ns 14x L1 cache
	Mutex lock/unlock 25 ns
	Main memory reference 100 ns 20x L2 cache, 200x L1 cache
	Compress 1K bytes with Zippy 3,000 ns 3 us
	Send 1K bytes over 1 Gbps network 10,000 ns 10 us
	Read 4K randomly from SSD* 150,000 ns 150 us ~1GB/sec SSD

	/**
	* RuntimeGlobalsChecker
	*
	* You can use this utility to quickly check what variables have been added (or
	* leaked) to the global window object at runtime (by JavaScript code).
	* By running this code, the globals checker itself is attached as a singleton
	* to the window object as "__runtimeGlobalsChecker__".
	* You can check the runtime globals programmatically at any time by invoking
	* "window.__runtimeGlobalsChecker__.getRuntimeGlobals()".
	*

	#!/usr/bin/env python3

	"""
	Python script to enumerate valid Microsoft 365 domains, retrieve tenant name, and check for an MDI instance.
	Based on: https://github.com/thalpius/Microsoft-Defender-for-Identity-Check-Instance.
	Usage: ./check_mdi.py -d <domain>
	"""

	import argparse
	import dns.resolver

	# syntax=docker/dockerfile:1
	# Keep this syntax directive! It's used to enable Docker BuildKit

	# Based on https://github.com/python-poetry/poetry/discussions/1879?sort=top#discussioncomment-216865
	# but I try to keep it updated (see history)

	################################
	# PYTHON-BASE
	# Sets up all our shared environment variables
	################################

	const { argv } = require('node:process');
	const dns = require('node:dns').promises;

	const ALLOWED_RECORD_TYPES = ['A', 'AAAA', 'ANY', 'CAA', 'CNAME', 'MX', 'NS', 'NAPTR', 'PTR', 'SOA', 'SRV', 'TXT']

	async function checkDNSRecord(domain, value, recordType = 'A'){
	return new Promise(async (resolve, _) => {
	try{
	const resolver = new dns.Resolver();
	const apexDomain = domain.split('.').splice(-2).join('.')