For the first time here I see a piece of obfuscated js without any clear weakness.
But start point after beauty is to find basic var assignment and then accurately replace occurrences of the var with its value
;\n. To fo it, you must use an editor capable of regexp replacing, like VSCode or Sublime Text (and a lot of others)
I got one and only one instruction per line
Look at first assignment
I will replace every occurence of
T8jj.h6C in the following code with the value
"3063". But before, using regex search, I will ensure that there is only ONE occurrency of assignment, otherwise I will do a more delicate replacement.
In this case, only one assignment! Good, so use a regexp to replace
Note !!!! we used word separator and entered the dot as escaped, because otherwiser you could mis-replace ASDAST8jjEW4CSDFSDFD and this will create bugs !
The first regexp avoid to change eventually future occurrency of new. Do not forget trailing
" because are syntattically important for js.
3421 is an integer,
"3421" is a string.
For example, at roww 22233 this replaces
So string or numeric is very different !
You now think "I can remove the first line, because there is no more need for it; every referring point has now got the litteral value."
Wrong ! Some obfuscator use string concatenation and other techs to keep you in a trap, so never remove code !
Only 44042 rows remaining !
has more than one assignment, so must replace with "3871" only occurency before the next assignment, there same var receved assigned value of "1964"
- Use trailing \b and replace . with . when searching;
- If you got only one result or no result at all, do not delete assignment; some point in the obfuscated code could use string concatenation or use unicode chars and evals to read the variable value;
- Replace occurrencies of unicode-only strings with their litteral value; this will speed up code deobfuscation; for example