I have read about de-obfuscating JS files and about multi-layered obfuscation. I have come across a file (which I have uploaded here) and it doesn't seem to be obfuscated except for lines 21 and 42. I there seems to be some HTML components on those lines but when I tried using JSBeautifier and JSDetox on it, it doesn't help.

  1. Have any of the reverse engineers come across this type of obfuscation? if yes, how is it done?

  2. Is thereany way to de-obfuscate it?

2 Answers 2


you can either print out the eval values on a custom html page using something like

document.write('<textarea cols="120" rows="10">');
document.write(contents of eval);

or use malzilla or http://matthewfl.com/unPacker.html


This is dean edwards' js packer : http://dean.edwards.name/packer/. I see it quite frequently being used to obfuscate scripts as it is freely available. It's written in Javascript but there are also versions in other langages on the site.

By the way the Decode button and text area is only disabled via HTML attributes, so you can reenable them using The Developer Tools in Google Chrome for example :) Here are the 2 decoded scripts from your sample :

http://pastebin.com/duWWwWuQ http://pastebin.com/VUaivSVk

Not the answer you're looking for? Browse other questions tagged or ask your own question.