Analyzing and deobfuscating complex JS code [duplicate]

Question

I am looking to reverse engineer a very ugly piece of JS found here.

As far as I can tell, this script generates and sets some cookies on my browser that identify it on the site. Deobfuscating it seems extremely difficult as it is encrypted by Jscrambler and it is so large that seemingly no site such as https://beautifier.io/ can do anything with it.

The goal is to be able to generate these cookies manually and post them to the site so that I do not need a browser to access the site.

My questions are:

1) Is there a way to debug this code in such a s way as to identify which lines generate and set the cookies? I have tried setting breakpoints on cookie set which did not seem to help.

2) Can this be deobfuscated easily by a JS noobie such as myself and what tools should I be using?

EDIT: If anyone can get involved I would be willing to compensate.

Answer 1

It requires only a huge amount of time, but there is no JavaScript code that cannot be deobfuscated.

For the first time here I see a piece of obfuscated js without any clear weakness.

But start point after beauty is to find basic var assignment and then accurately replace occurrences of the var with its value

Reiterate

Step 1

Replace every ; with ;\n. To fo it, you must use an editor capable of regexp replacing, like VSCode or Sublime Text (and a lot of others) I got one and only one instruction per line

Step 2

Look at first assignment

T8jj.W4C="3421";

I will replace every occurence of T8jj.h6C in the following code with the value "3063". But before, using regex search, I will ensure that there is only ONE occurrency of assignment, otherwise I will do a more delicate replacement.

In this case, only one assignment! Good, so use a regexp to replace

\bT8jj\.W4C\b

with

"3421"

Note !!!! we used word separator and entered the dot as escaped, because otherwiser you could mis-replace ASDAST8jjEW4CSDFSDFD and this will create bugs !

The first regexp avoid to change eventually future occurrency of new. Do not forget trailing " because are syntattically important for js. 3421 is an integer, "3421" is a string.

For example, at roww 22233 this replaces

I(g9L.r3y(+T8jj.W4C));

with

I(g9L.r3y(+"3421"));

So string or numeric is very different !

You now think "I can remove the first line, because there is no more need for it; every referring point has now got the litteral value." Wrong ! Some obfuscator use string concatenation and other techs to keep you in a trap, so never remove code !

Only 44042 rows remaining !

Reiterate

bx8jj.h8C 

has more than one assignment, so must replace with "3871" only occurency before the next assignment, there same var receved assigned value of "1964"

Suggestions

• Use trailing \b and replace . with . when searching;
• If you got only one result or no result at all, do not delete assignment; some point in the obfuscated code could use string concatenation or use unicode chars and evals to read the variable value;
• Replace occurrencies of unicode-only strings with their litteral value; this will speed up code deobfuscation; for example '\x6e\x65\x73\x74\x65\x64' is 'nested';