Obfuscating JS doesn't change the functionality of the code but only how it looks right?
The logic is still the same and there's tools to deobfuscate.
So what's the point of it?
Hello all, I’m working on a project to deobfuscate a large JavaScript file (9mb) that employs multiple methods of obfuscation. The code's been prettified and such but the code replaces original functions, variables and such with names with calls like a0_0x1feb(0x19a8), and my goal is to replace those with valid names, relating them to their function; so that the final output looks as close as possible to the original pre-obfuscation code.
I'm struggling with finding resources to go about this, and how to effectively employ them. One tool I found was https://github.com/jehna/humanify to use AI to rename the variables, but I was unsuccessful in getting it to work with such a large file. I also looked into employing the API calls on it's own, but again faced context limits that wouldn't easily be solved with chunking, as it wouldn't be able to cross reference such a large data set I don't believe.
I'm looking for some general guidance about how I can go about getting a javascript completely de-obfuscated while leveraging AI to it's maximum potential, as I feel like it could excel at something like this. Any help is appreciated. Thank you.
Here's a new automated tool, JSNice, to try to deobfuscate/deminify it. The tool even tries to guess the variable names, which is unbelievably cool. (It mines Javascript on github for this purpose.)
The tagline on the page is "Statistical renaming, Type inference and Deobfuscation".
http://www.jsnice.org
Try this: http://jsbeautifier.org/
I tested with your code and worked as good as possible. =D
Well, so, you can use http://jsbeautifier.org/ with unescape printable chars to get the top var decoded, then, if you look closely, you should see that the values of the var are used everywhere with an index, so you can just write a quick script to replace it with the actual value. End result is here
Python to replace the var:
#Replace.py //probably not optimized, so dont be too harsh on me
_0x4b6a=[copy-pasteValueDecodedFromScript]
with open('EncodedScript.js') as fp:
for line in fp:
for i in range(0,608):
line = line.replace("_0x4b6a["+str(i)+"]", _0x4b6a[i])
print line
I'd do it as follows:
As far as I can see the main array with strings is static. It is not changed. This means that you can replace all appearances of this array members with their contents (in "") after decoding all of it from hex form.
I'd do it with python script, you can do it by the tool of your choice.
Here is the python script (js.js is a copy of your script):
initial_array = [... here should be the copy of initial array _0x4b6a ...]
def stringify(s):
return "\""+s.replace("\"", "\\\"")+"\""
f = open("js.js", "r")
data = f.read()
for idx in range(len(initial_array)):
member = "_0x4b6a[%d]" % idx
data = data.replace(member, stringify(initial_array[idx]))
print data
result is placed here: here
Please note that the result is not syntactically correct. To make it better you should work on stringify function in the script