During my PDF training at 44CON I got the idea for a simple modification: now with document.write(), a third file is created. The file is write.bin.log and contains the pure UNICODE data, e.g. without 0xFFFE header.
To extract shellcode now, you no longer need to edit write.uc.log to remove the 0xFFFE header.
I also included binaries for Windows and Linux (compiled on CentOS 6.0) in the ZIP file.
js-1.7.0-mod-b.zip (https)
MD5: 85B369B5650D4C041D21E8574CF09B9A
SHA256: D3827DF7B2EA81EEE91181B2DE045320E1CFEC46EED33F7CD84CA63C3A36BC38
Didier Stevens 