https://github.com/j4k0xb/krunkscript-pwn

Extract/deobfuscate/hook/inject maps with KrunkScript enabled
https://github.com/j4k0xb/krunkscript-pwn

ast codemod hooks injector krunker krunkerio krunkscript reverse-engineering

Last synced: about 2 months ago
JSON representation

Extract/deobfuscate/hook/inject maps with KrunkScript enabled

• Host: GitHub
• URL: https://github.com/j4k0xb/krunkscript-pwn
• Owner: j4k0xb
• License: gpl-3.0
• Created: 2022-09-06T19:29:01.000Z (almost 3 years ago)
• Default Branch: master
• Last Pushed: 2025-04-03T20:47:37.000Z (2 months ago)
• Last Synced: 2025-04-03T21:31:53.836Z (2 months ago)
• Topics: ast, codemod, hooks, injector, krunker, krunkerio, krunkscript, reverse-engineering
• Language: TypeScript
• Homepage: https://krunkscript-deobfuscator.netlify.app
• Size: 158 KB
• Stars: 5
• Watchers: 2
• Forks: 4
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# KrunkScript Pwn

Userscript no longer works because JSON.parse can't be hooked.

> [!TIP]

> Check out the new decompiler: 

>

> - Outputs almost 100% identical KrunkScript syntax

> - Infers types through constraint propagation and data flow analysis

>

> ![Decompiler comparison](https://github.com/user-attachments/assets/8fe59fe0-e507-44d7-8fcb-8988bbfcd4db)

## Installation

1. Install [Tampermonkey](http://www.tampermonkey.net) for your browser.

2. Add the [userscript](https://github.com/j4k0xb/krunkscript-pwn/raw/master/script.user.js).

## Features

- Extract, deobfuscate and beautify compiled KrunkScript when you join a map with scripts.

- Online deobfuscator: 

![Deobfuscator comparison](https://user-images.githubusercontent.com/55899582/188747147-44ee146f-7d93-4920-996d-3972bd1cb8ef.png)

- Read/modify global variables.

- Access everything from `GAME`.

- Inject own actions.

## How To Download Scripts

1. Join a map with scripts

2. Use a chromium based browser

3. Open the developer console (F12)

4. Execute `queryObjects(Function.prototype)` (this may take a while)

5. Right-click on the resulting array and select "Store as global variable"

6. Execute `temp1.find(f=>f.name==='V_start')`

7. Click on the function to see the whole script in the sources tab