[jawsscripts] SV: Decompiling JSB files?
- From: Bue Vester-Andersen <bva_lists@xxxxxxxxxxxxxxxxxx>
- To: <jawsscripts@xxxxxxxxxxxxx>
- Date: Wed, 14 Jul 2010 21:30:45 +0200
Hi Sina,
I started looking at the posibilities a while ago, but I never got around to
making a decompiler, although I think it should be posible.
Below is a bit of very unsystematic and very unsorted notes taken from a
minimal script file
Hope it helps, and very interested in what you may find out
Best regards
Bue
Size of empty file with empty script "testscript: 104 bytes
Header: 0x50 bytes
00-0e: "jfw script file"
0f: 1a
10-3b: (00)
3c: 04
3d-4b: (00)
4c:4: int Length of body
end of header
50: 14 00 00 00
54: 01 03 00 00
58: 24=$ (string indicator? script indicator?)
59: "testscript"
63: 00 (string terminator?)
64 03 00 00 00
int 4 bytes lsb first
string zero-terminated
4-byte alinement?
Structure
int length
int type
stringz name (starts with $ if script)
0-pad
...
03 00 00 00: end indicator
codes
01XX: Start of script (XX = length of name in 4 byte units)
02XX: Start of function (same as above)
03 00 00 00: end indicator
0a 00 01 00: -
0a 00 02 00: +
assignment int: 15 01 00 00 [value] 27 00 nn nn
assign literal to string: 14 ll1 ll2 00 [stringz] 27 00 nn nn
ll1 = ll2?
let intvar1 = intvar2: 25 00 intvar2 27 00 intvar1
Everything seems to be using postfix notation
-----Oprindelig meddelelse-----
Fra: jawsscripts-bounce@xxxxxxxxxxxxx
[mailto:jawsscripts-bounce@xxxxxxxxxxxxx] På vegne af Sina Bahram
Sendt: 14. juli 2010 20:50
Til: jawsscripts@xxxxxxxxxxxxx
Emne: [jawsscripts] Decompiling JSB files?
Hi all,
I'm interested in anything folks have learned about or done with respect to
decompiling jaws scripts.
I have several reasons for being interested in this, some of them from the
security research point of view.
I seem to remember that Doug responded to some posts about decompiling jaws
scripts, a while back? But I could be wrong about that.
If anyone has some info, that would be fantastic.
Take care,
Sina
__________???
View the list's information and change your settings at
http://www.freelists.org/list/jawsscripts
__________ Information fra ESET Smart Security, virus signatur database
version 5278 (20100714) __________
Meddelelsen blev kontrolleret af ESET Smart Security.
www.esetscandinavia.com
__________�
View the list's information and change your settings at
http://www.freelists.org/list/jawsscripts
Other related posts: