James Smith

Challenge Description

The bots kept yelling James Smith, but maybe they were corrupt?

Flag: Raptor{Wh0S3_GREAT_id34_w4S_thiS?_AND_NOW_JS_TOO!?_JESUS_GUY!!}

Provided: obfuscate.zip → obfuscate.js

The File

Unzipping reveals a single JavaScript file. At the very top is a large obfuscated string array, a classic pattern from tools like javascript-obfuscator, where all string literals in the original code get stripped out, shuffled into an array, and replaced with indexed lookups to hinder static analysis:

_0x5f5dfd=['ited\x20unexp','ng\x20WHAMazo','toString','emqqc','match','log',
'\x0aGeneratin','2542017bgmfgG','BRCAq','ync','le\x20buffer\x20','base64',
'\x0aWHAMazon\x20','Reconnecti','_JESUS_GUY','qyUwQ','forEach',
'S3_GREAT_i','747gNBeZF','aeOja','te.','Uavnr','fgrVB','ng\x20to\x20HR\x20B',
'to\x20Corpora','forward\x20di','\x20written\x20t','odules...','for\x20choosi',
'1854078AebBnF','ic:\x20morale','n\x20Autonomo','ectedly','y\x20crash\x20du',
'Raptor{Wh0','BtvpO','from','\x20daemon\x20ex','bFVJK','130445DBKkrU',
'2471608xvvKRu','Loading\x20co','jenHh','o\x20internal','0xDEADBEEF',
'WHAMazon\x20I','ot-42...','WAnez','loyee\x20mora','10290040lAUyqi',
'7JykUUO','==========','37970NammCG','d34_w4S_th','iS?_AND_NO',
'\x0a🤖\x20Please\x20','n\x20☁️','\x0a🤖\x20WHAMazo','us\x20Diagnos',
'tic\x20Termin','D:\x20INTERN-','1708299WZMBGa','Crash\x20dump',
'zvMew','\x20storage.','SQpPQ','Kernel\x20Pan','148JpDVRE',
'crashdump','VBPbk','W_JS_TOO!?','iWliG','agnostics\x20','writeFileS',
'.whamazon_','pgPHo','exit','g\x20emergenc','ERROR:\x20Emp','mpliance\x20m',
'Incident\x20I','Thank\x20you\x20','hot\x0a','mory\x20Snaps','overflow\x20d',
'NSFrZ','etected.','nternal\x20Me','\x0a🚩\x20FLAG:','gvwxR','mp...',
'!!}','==\x0a\x0a']

The Approach

No need to execute or deobfuscate the full script. The string array contains all the human-readable content the program uses, log messages, error strings, and the flag, all jumbled together with random garbage identifiers (emqqc, BRCAq, qyUwQ etc.) used as decoy noise.

Raptor{ is immediately visible. From there it was a matter of pulling the flag-shaped fragments out and arranging them by reading the surrounding strings for context. The non-flag strings form coherent log messages when read in sequence, which helps confirm ordering:

'\x0aGeneratin' + 'g\x20emergenc' + 'y\x20crash\x20du' + 'mp...'
→ "\nGenerating emergency crash dump..."

'Kernel\x20Pan' + 'ic:\x20morale'
→ "Kernel Panic: morale"

'ERROR:\x20Emp' + 'loyee\x20mora' + 'le\x20buffer\x20'
→ "ERROR: Employee morale buffer "

'\x0a🚩\x20FLAG:' + 'Raptor{Wh0' + 'S3_GREAT_i' + 'd34_w4S_th' 
+ 'iS?_AND_NO' + 'W_JS_TOO!?' + '_JESUS_GUY' + '!!}'
→ "\n🚩 FLAG: Raptor{Wh0S3_GREAT_id34_w4S_thiS?_AND_NOW_JS_TOO!?_JESUS_GUY!!}"

Key Takeaways

JavaScript obfuscation via string array shuffling looks intimidating but is entirely static, the strings themselves are never transformed, just reordered and accessed by index at runtime. Scanning the raw array for recognizable fragments (Raptor{, readable English phrases, known error messages) is faster than attempting to deobfuscate the whole file.

The garbage identifiers (emqqc, BRCAq, etc.) are pure noise inserted to pad the array and make automated analysis harder, they can be ignored entirely. If the flag hadn't been visible in the raw array, the next step would be running the script in a sandboxed Node.js environment and intercepting console.log output, rather than wrestling with the obfuscation manually.