0

Someone here already had success to deobfuscate 100% a "hexadecimal" Javascript code?

E.g.:

var _0x22bc92 = function() {
    var _0x26938d = !![];
    return function(_0x100751, _0x54d399) {
        var _0x1a7790 = _0x26938d ? function() {
            if (_0x54d399) {
                var _0x28145f = _0x54d399[_0x4734('0x0')](_0x100751, arguments);
                _0x54d399 = null;
                return _0x28145f;
            }
        } : function() {};
        _0x26938d = ![];
        return _0x1a7790;
    };
}();

If yes, how do I do it?

2
  • 1
    Correct me if I am wrong, but this merely looks like obfuscated code to make it harder to read. Simply give those entities whose names start with _0x some more sensible names and you're golden. This isn't really about reverse engineering, though.
    – 0xC0000022L
    Commented Jul 5, 2018 at 14:42
  • 1
    I'm voting to close this question as off-topic because it's not about reverse engineering, it's just obfuscated Javascript code any developer should be able to comprehend. So it should be migrated to StackOverflow or be closed.
    – 0xC0000022L
    Commented Jul 5, 2018 at 14:44

1 Answer 1

3

Those hex values could represent anything. Look for online converters that convert hexadecimal to text (consider various formats), dec, etc. and see if the results make any sense. If not, then they could just be 100% obfuscated to not recover any sort of meaningful name.

Therefore, just make meaningful names yourself where you see repeated occurrences of names. For instance, look at how many times you see the value _0x26938d (which I've changed to _0x26938d_CHANGE_ME) appear below. Simply change all of those occurrences to your own name. You can apply a more meaningful name to them once you read through the code and/or execute it to understand its behavior.

var _0x22bc92 = function() {
    var _0x26938d_CHANGE_ME = !![];
    return function(_0x100751, _0x54d399) {
        var _0x1a7790 = _0x26938d_CHANGE_ME ? function() {
            if (_0x54d399) {
                var _0x28145f = _0x54d399[_0x4734('0x0')](_0x100751, arguments);
                _0x54d399 = null;
                return _0x28145f;
            }
        } : function() {};
        _0x26938d_CHANGE_ME = ![];
        return _0x1a7790;
    };
}();

Not the answer you're looking for? Browse other questions tagged or ask your own question.