Deobfuscating a javascript file

Question

I am having a obfuscated JS file and I want to deobfuscate it (and not beautify it). I have seen answer to a similar question here and I tried de-obfuscating a the file using online version of JSUnpack and JSDetox. However, I am still not able to deobfuscate it. The JS file is not a malware but it is used to inject ads into web-page. So, any analyser analysing the file won't find anything malicious. The problem is that the JS stores (hex) strings in string array and using it to concatenate the code. JSDetox atleast decodes the string array in the beginning of the file. However, the readability is not improved anyway as the whole code makes use of the string array. If anyone wants to take a look at the file they can find it here.

Any kind of help would be appreciated! Thanks.

Edit: I have also tried Malzilla now because I found a similar technique here. However, the script probably has some errors which is tolerated by Chrome. However, when I click "Run Script" in Malzilla, I get a message saying "Script cannot be compiled". I tried to debug script using the "Debug Script" button, the window highlights some line saying "InterYeildOptions is not defined" and I don't know what to do about it. :-/

Answer 1

Well, so, you can use http://jsbeautifier.org/ with unescape printable chars to get the top var decoded, then, if you look closely, you should see that the values of the var are used everywhere with an index, so you can just write a quick script to replace it with the actual value. End result is here

Python to replace the var:

#Replace.py //probably not optimized, so dont be too harsh on me
_0x4b6a=[copy-pasteValueDecodedFromScript]
with open('EncodedScript.js') as fp:
    for line in fp:
        for i in range(0,608):
            line = line.replace("_0x4b6a["+str(i)+"]", _0x4b6a[i])      
        print line

Answer 2

I'd do it as follows:

As far as I can see the main array with strings is static. It is not changed. This means that you can replace all appearances of this array members with their contents (in "") after decoding all of it from hex form.

I'd do it with python script, you can do it by the tool of your choice.

Here is the python script (js.js is a copy of your script):

    initial_array = [... here should be the copy of initial array _0x4b6a ...]
    def stringify(s):
        return "\""+s.replace("\"", "\\\"")+"\""

    f = open("js.js", "r")
    data = f.read()

    for idx in range(len(initial_array)):
        member = "_0x4b6a[%d]" % idx
        data = data.replace(member, stringify(initial_array[idx]))

    print data

result is placed here: here

Please note that the result is not syntactically correct. To make it better you should work on stringify function in the script