Skip to content

Instantly share code, notes, and snippets.

@nullmastermind

nullmastermind/ZaloDecryptor.user.js

Forked from ElectroHeavenVN/ZaloDecryptor.user.js
Created August 7, 2025 04:24
Show Gist options
  • Save nullmastermind/48beec73d8fab71af4b6945c9ab9e6bc to your computer and use it in GitHub Desktop.
Save nullmastermind/48beec73d8fab71af4b6945c9ab9e6bc to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @ElectroHeavenVN ElectroHeavenVN revised this gist Jan 4, 2025. 1 changed file with 11 additions and 0 deletions.
    11 changes: 11 additions & 0 deletions ZaloDecryptor.user.js
    View file
    Original file line number Diff line number Diff line change
    @@ -53,6 +53,17 @@
    console_log("%c[WebSocket] %c[Receive] %cOpcode:%c " + e + ", %ccommand:%c " + t + ", %cversion:%c " + a + ", %cdata:%c " + n, 'color: red', 'color: orange', 'color: cyan', '', 'color: cyan', '', 'color: cyan', '', 'color: cyan', '');
    return await ZWSWebpack.default.original__onData(e, t, a, n);
    };
    const originalSend = WebSocket.prototype.send;
    WebSocket.prototype.send = function (d) {
    originalSend.apply(this, arguments);
    var jsonData = "";
    var buffer = new Uint8Array(d.byteLength - 4);
    for (var i = 0; i < d.byteLength - 4; i++) {
    buffer[i] = d.getInt8(i + 4);
    }
    jsonData = new TextDecoder().decode(buffer);
    console_log("%c[WebSocket] %c[Send] %cOpcode:%c " + d.getInt16(1, true) + ", %ccommand:%c " + d.getInt8(3) + ", %cversion:%c " + d.getInt8(0) + ", %cdata:%c " + jsonData, 'color: red', 'color: orange', 'color: cyan', '', 'color: cyan', '', 'color: cyan', '', 'color: cyan', '');
    };
    wsHookInstalled = true;
    }
    }
  2. @ElectroHeavenVN ElectroHeavenVN revised this gist Jan 4, 2025. 1 changed file with 6 additions and 5 deletions.
    11 changes: 6 additions & 5 deletions ZaloDecryptor.user.js
    View file
    Original file line number Diff line number Diff line change
    @@ -26,9 +26,9 @@
    if (!url.includes("api/login/getServerInfo")) return;
    if (url.includes("viewerkey")) return;
    httpHookInstalled = true;
    console_log("Installing...");
    console_log("Installing HTTP hooks...");
    const ZHttpWebpack = window.webpackJsonp.push([[Math.random()],{},[["z0WU"]]]);

    ZHttpWebpack.default.original_encodeAES = ZHttpWebpack.default.encodeAES;
    ZHttpWebpack.default.encodeAES = (e, t = 0) => {
    console_log("%c[HTTP] %c[Send] %c" + e, 'color: red', 'color: orange', '');
    @@ -42,9 +42,11 @@
    };
    };

    const originalWS = window.WebSocket;
    window.WebSocket.prototype.constructor = (...args) => {
    const originalAddEventListener = WebSocket.prototype.addEventListener;
    WebSocket.prototype.addEventListener = function (...args) {
    originalAddEventListener.apply(this, arguments);
    if (!wsHookInstalled) {
    console_log("Installing WebSocket hooks...");
    const ZWSWebpack = window.webpackJsonp.push([[Math.random()],{},[["8RMw"]]]);
    ZWSWebpack.default.original__onData = ZWSWebpack.default._onData;
    ZWSWebpack.default._onData = async (e, t, a, n) => {
    @@ -53,6 +55,5 @@
    };
    wsHookInstalled = true;
    }
    return new originalWS(...args);
    }
    })();
  3. @ElectroHeavenVN ElectroHeavenVN revised this gist Jan 4, 2025. 1 changed file with 19 additions and 11 deletions.
    30 changes: 19 additions & 11 deletions ZaloDecryptor.user.js
    View file
    Original file line number Diff line number Diff line change
    @@ -15,20 +15,20 @@
    (function() {
    'use strict';
    const console_log = window.console.log;
    var webpackHookInstalled = false;
    var httpHookInstalled = false;
    var wsHookInstalled = false;

    const originalOpen = XMLHttpRequest.prototype.open;
    XMLHttpRequest.prototype.open = function (method, url, async, user, password) {
    console_log("%c[XMLHttpRequest] %c[Send] %c" + url, 'color: red', 'color: orange', '');
    originalOpen.apply(this, arguments);
    if (webpackHookInstalled) return;
    if (httpHookInstalled) return;
    if (!url.includes("api/login/getServerInfo")) return;
    if (url.includes("viewerkey")) return;
    webpackHookInstalled = true;
    httpHookInstalled = true;
    console_log("Installing...");
    const ZHttpWebpack = window.webpackJsonp.push([[Math.random()],{},[["z0WU"]]]);
    const ZWSWebpack = window.webpackJsonp.push([[Math.random()],{},[["8RMw"]]]);


    ZHttpWebpack.default.original_encodeAES = ZHttpWebpack.default.encodeAES;
    ZHttpWebpack.default.encodeAES = (e, t = 0) => {
    console_log("%c[HTTP] %c[Send] %c" + e, 'color: red', 'color: orange', '');
    @@ -40,11 +40,19 @@
    console_log("%c[HTTP] %c[Receive] %c" + n, 'color: red', 'color: orange', '');
    return n;
    };

    ZWSWebpack.default.original__onData = ZWSWebpack.default._onData;
    ZWSWebpack.default._onData = async (e, t, a, n) => {
    console_log("%c[WebSocket] %c[Receive] %cOpcode:%c " + e + ", %ccommand:%c " + t + ", %cversion:%c " + a + ", %cdata:%c " + n, 'color: red', 'color: orange', 'color: cyan', '', 'color: cyan', '', 'color: cyan', '', 'color: cyan', '');
    return await ZWSWebpack.default.original__onData(e, t, a, n);
    };
    };

    const originalWS = window.WebSocket;
    window.WebSocket.prototype.constructor = (...args) => {
    if (!wsHookInstalled) {
    const ZWSWebpack = window.webpackJsonp.push([[Math.random()],{},[["8RMw"]]]);
    ZWSWebpack.default.original__onData = ZWSWebpack.default._onData;
    ZWSWebpack.default._onData = async (e, t, a, n) => {
    console_log("%c[WebSocket] %c[Receive] %cOpcode:%c " + e + ", %ccommand:%c " + t + ", %cversion:%c " + a + ", %cdata:%c " + n, 'color: red', 'color: orange', 'color: cyan', '', 'color: cyan', '', 'color: cyan', '', 'color: cyan', '');
    return await ZWSWebpack.default.original__onData(e, t, a, n);
    };
    wsHookInstalled = true;
    }
    return new originalWS(...args);
    }
    })();
  4. @ElectroHeavenVN ElectroHeavenVN revised this gist Jan 4, 2025. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion ZaloDecryptor.user.js
    View file
    Original file line number Diff line number Diff line change
    @@ -43,7 +43,7 @@

    ZWSWebpack.default.original__onData = ZWSWebpack.default._onData;
    ZWSWebpack.default._onData = async (e, t, a, n) => {
    console_log("%c[WebSocket] %c[Received] %cOpcode:%c " + e + ", %ccommand:%c " + t + ", %cversion:%c " + a + ", %cdata:%c " + n, 'color: red', 'color: orange', 'color: cyan', '', 'color: cyan', '', 'color: cyan', '', 'color: cyan', '');
    console_log("%c[WebSocket] %c[Receive] %cOpcode:%c " + e + ", %ccommand:%c " + t + ", %cversion:%c " + a + ", %cdata:%c " + n, 'color: red', 'color: orange', 'color: cyan', '', 'color: cyan', '', 'color: cyan', '', 'color: cyan', '');
    return await ZWSWebpack.default.original__onData(e, t, a, n);
    };
    };
  5. @ElectroHeavenVN ElectroHeavenVN revised this gist Jan 4, 2025. 1 changed file with 26 additions and 30 deletions.
    56 changes: 26 additions & 30 deletions ZaloDecryptor.user.js
    View file
    Original file line number Diff line number Diff line change
    @@ -14,41 +14,37 @@

    (function() {
    'use strict';
    var console_log = window.console.log;
    const console_log = window.console.log;
    var webpackHookInstalled = false;

    const originalOpen = XMLHttpRequest.prototype.open;
    XMLHttpRequest.prototype.open = function (method, url, async, user, password) {
    console_log("%c[XMLHttpRequest] %c[Send] %c" + url, 'color: red', 'color: orange', '');
    originalOpen.apply(this, arguments);
    };
    setTimeout(() => {
    var interval = setInterval(() => {
    if (!window.webpackJsonp) return;
    try {
    const ZHttpWebpack = window.webpackJsonp.push([[Math.random()],{},[["z0WU"]]]);
    const ZWSWebpack = window.webpackJsonp.push([[Math.random()],{},[["8RMw"]]]);

    ZHttpWebpack.default.original_encodeAES = ZHttpWebpack.default.encodeAES;
    ZHttpWebpack.default.encodeAES = (e, t = 0) => {
    console_log("%c[HTTP] %c[Send] %c" + e, 'color: red', 'color: orange', '');
    return ZHttpWebpack.default.original_encodeAES(e, t);
    };
    ZHttpWebpack.default.original_decodeAES = ZHttpWebpack.default.decodeAES;
    ZHttpWebpack.default.decodeAES = (e, t = 0) => {
    var n = ZHttpWebpack.default.original_decodeAES(e, t);
    console_log("%c[HTTP] %c[Receive] %c" + n, 'color: red', 'color: orange', '');
    return n;
    };
    if (webpackHookInstalled) return;
    if (!url.includes("api/login/getServerInfo")) return;
    if (url.includes("viewerkey")) return;
    webpackHookInstalled = true;
    console_log("Installing...");
    const ZHttpWebpack = window.webpackJsonp.push([[Math.random()],{},[["z0WU"]]]);
    const ZWSWebpack = window.webpackJsonp.push([[Math.random()],{},[["8RMw"]]]);

    ZWSWebpack.default.original__onData = ZWSWebpack.default._onData;
    ZWSWebpack.default._onData = async (e, t, a, n) => {
    console_log("%c[WebSocket] %c[Received] %cOpcode:%c " + e + ", %ccommand:%c " + t + ", %cversion:%c " + a + ", %cdata:%c " + n, 'color: red', 'color: orange', 'color: cyan', '', 'color: cyan', '', 'color: cyan', '', 'color: cyan', '');
    return await ZWSWebpack.default.original__onData(e, t, a, n);
    };
    ZHttpWebpack.default.original_encodeAES = ZHttpWebpack.default.encodeAES;
    ZHttpWebpack.default.encodeAES = (e, t = 0) => {
    console_log("%c[HTTP] %c[Send] %c" + e, 'color: red', 'color: orange', '');
    return ZHttpWebpack.default.original_encodeAES(e, t);
    };
    ZHttpWebpack.default.original_decodeAES = ZHttpWebpack.default.decodeAES;
    ZHttpWebpack.default.decodeAES = (e, t = 0) => {
    var n = ZHttpWebpack.default.original_decodeAES(e, t);
    console_log("%c[HTTP] %c[Receive] %c" + n, 'color: red', 'color: orange', '');
    return n;
    };

    clearInterval(interval);
    }
    catch {}
    }, 100);
    }, 1000);
    ZWSWebpack.default.original__onData = ZWSWebpack.default._onData;
    ZWSWebpack.default._onData = async (e, t, a, n) => {
    console_log("%c[WebSocket] %c[Received] %cOpcode:%c " + e + ", %ccommand:%c " + t + ", %cversion:%c " + a + ", %cdata:%c " + n, 'color: red', 'color: orange', 'color: cyan', '', 'color: cyan', '', 'color: cyan', '', 'color: cyan', '');
    return await ZWSWebpack.default.original__onData(e, t, a, n);
    };
    };
    })();
  6. @ElectroHeavenVN ElectroHeavenVN revised this gist Jan 4, 2025. 1 changed file with 3 additions and 1 deletion.
    4 changes: 3 additions & 1 deletion ZaloDecryptor.user.js
    View file
    Original file line number Diff line number Diff line change
    @@ -1,13 +1,15 @@
    // ==UserScript==
    // @name ZaloDecryptor
    // @namespace http://tampermonkey.net/
    // @version 2025-01-04
    // @version 1.0.0
    // @description Decrypt and log Zalo's HTTP requests and WebSocket traffics
    // @author ElectroHeavenVN
    // @match https://chat.zalo.me/*
    // @icon https://www.google.com/s2/favicons?sz=64&domain=zalo.me
    // @grant none
    // @run-at document-start
    // @updateURL https://gist.github.com/ElectroHeavenVN/ded1eb9c791018ec134ab6f0cff57f2f/raw/ZaloDecryptor.user.js
    // @downloadURL https://gist.github.com/ElectroHeavenVN/ded1eb9c791018ec134ab6f0cff57f2f/raw/ZaloDecryptor.user.js
    // ==/UserScript==

    (function() {
  7. @ElectroHeavenVN ElectroHeavenVN created this gist Jan 4, 2025.
    52 changes: 52 additions & 0 deletions ZaloDecryptor.user.js
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,52 @@
    // ==UserScript==
    // @name ZaloDecryptor
    // @namespace http://tampermonkey.net/
    // @version 2025-01-04
    // @description Decrypt and log Zalo's HTTP requests and WebSocket traffics
    // @author ElectroHeavenVN
    // @match https://chat.zalo.me/*
    // @icon https://www.google.com/s2/favicons?sz=64&domain=zalo.me
    // @grant none
    // @run-at document-start
    // ==/UserScript==

    (function() {
    'use strict';
    var console_log = window.console.log;

    const originalOpen = XMLHttpRequest.prototype.open;
    XMLHttpRequest.prototype.open = function (method, url, async, user, password) {
    console_log("%c[XMLHttpRequest] %c[Send] %c" + url, 'color: red', 'color: orange', '');
    originalOpen.apply(this, arguments);
    };
    setTimeout(() => {
    var interval = setInterval(() => {
    if (!window.webpackJsonp) return;
    try {
    const ZHttpWebpack = window.webpackJsonp.push([[Math.random()],{},[["z0WU"]]]);
    const ZWSWebpack = window.webpackJsonp.push([[Math.random()],{},[["8RMw"]]]);

    ZHttpWebpack.default.original_encodeAES = ZHttpWebpack.default.encodeAES;
    ZHttpWebpack.default.encodeAES = (e, t = 0) => {
    console_log("%c[HTTP] %c[Send] %c" + e, 'color: red', 'color: orange', '');
    return ZHttpWebpack.default.original_encodeAES(e, t);
    };
    ZHttpWebpack.default.original_decodeAES = ZHttpWebpack.default.decodeAES;
    ZHttpWebpack.default.decodeAES = (e, t = 0) => {
    var n = ZHttpWebpack.default.original_decodeAES(e, t);
    console_log("%c[HTTP] %c[Receive] %c" + n, 'color: red', 'color: orange', '');
    return n;
    };

    ZWSWebpack.default.original__onData = ZWSWebpack.default._onData;
    ZWSWebpack.default._onData = async (e, t, a, n) => {
    console_log("%c[WebSocket] %c[Received] %cOpcode:%c " + e + ", %ccommand:%c " + t + ", %cversion:%c " + a + ", %cdata:%c " + n, 'color: red', 'color: orange', 'color: cyan', '', 'color: cyan', '', 'color: cyan', '', 'color: cyan', '');
    return await ZWSWebpack.default.original__onData(e, t, a, n);
    };

    clearInterval(interval);
    }
    catch {}
    }, 100);
    }, 1000);
    })();