Questions tagged [javascript]
JavaScript or JS is an interpreted computer programming language. It was originally implemented as part of web browsers.
103 questions
76
votes
9
answers
86k
views
Analyzing highly obfuscated JavaScript
I was recently analyzing a web page that contained some highly obfuscated JavaScript - it's clear that the author had went through quite a bit of effort to make it as hard to understand as possible. I'...
- 963
33
votes
5
answers
25k
views
What is a good tools to reverse the effects of Minify on JavaScript?
Are there any scripts and/or online tools that can reverse the effects of minification?
I'm specifically looking to unminify a minified JavaScript file. Variable renaming is not a big issue, I want ...
- 826
17
votes
4
answers
2k
views
Obfuscating JavaScript with zero-width characters - pros and cons?
This comes from comments on a question on StackOverflow about JavaScript Variables: Why aren't ◎ܫ◎ and ☺ valid JavaScript variable names?
JavaScript accepts zero-width characters as valid variable ...
- 273
16
votes
1
answer
125k
views
How to deobfuscate an obfuscated javascript file like this? [duplicate]
I'm having serious problems deobfuscating a JavaScript file at work. This file is inside a web app that I was left in charge to improve it. The problem is that I can do it without having access to ...
- 169
11
votes
4
answers
24k
views
Try to deobfuscate multi layered javascript
According to the techy zilla blog
It will be much harder to deobfuscate code that has been obfuscated using multiple obfuscating algorithms. According to them, jsbeautifier can't fix this obfuscated ...
- 211
9
votes
1
answer
4k
views
Decompiling an executable compiled by vercel/pkg
I have a .exe file that I am trying to get the source code of, After some digging I figured out that it's in node.js and was compiled using vercel/pkg
I tried using pkg-unpacker however the output is ...
- 91
8
votes
1
answer
1k
views
Reverse engineering XKCD 1190
The latest (as of now) comic is titled "Time". It's a standard-looking comic though without much action, but the picture's alt title says "Wait for it.". I waited but nothing happened (tried in Opera ...
- 36.9k
7
votes
1
answer
3k
views
How do I reverse this javascript code? How is it packed?
I've a couple of questions regarding this javascript code, I found injected in one of my web pages.
What is this script doing?
Which tool is used to pack or obfuscate this script?
How can I learn the ...
7
votes
3
answers
2k
views
Get used jQuery plugins from website
I want to know what jQuery plugins Facebook uses for their special scrollbar, like the two on the left, not the normal one on the right:
(source)
Generally, how should I go when I want to know what ...
user187
5
votes
3
answers
68k
views
How to get Video URL from embedded Link in Twitter
I'm trying to get the Video URL of ( https://twitter.com/i/videos/823649890379120640?embed_source=facebook )
I tried going over the source code but it give the same URL link
<meta property="og:...
- 51
4
votes
3
answers
420
views
Obfuscated code analysis - can unused variables be ignored?
I am analyzing a malicious javascript. The code is encoded and obfuscated in a way that I did not manage to even partially deobfuscate yet and it is filled with long strings. In order to simplify the ...
- 197
4
votes
1
answer
245
views
Is there a tool to compare javascript files for differences, while also ignoring local identifier changes?
When trying to compare the difference between two minified javascript files with random identifier names, about 95% of the changes are identifiers being renamed. I would like to use a tool that ...
- 41
4
votes
1
answer
7k
views
3
votes
2
answers
8k
views
How can I modify or decompile Hermes JS bytecode?
Since React Native 0.60.4 developers can opt-in to use the Hermes JS Engine. This generates an index.android.bundle binary that contains Hermes JS bytecode.
The Hermes documentation mentions hbcdump ...
- 133
3
votes
1
answer
1k
views
De-obfuscating code ran through JScrambler 3x via Eval() functions
I am relatively new to JS and de-obfuscation in general and I am having difficulties reversing some complicated JS. I know the code itself is obsfucated via jscrambler 3-4x and therefore is ran ...
- 41
3
votes
1
answer
3k
views
Possible to get the full url behind javascript button?
I am programming a little tool for patching. I found the microsoft update catalog, where all updates are stored, and I managed to look for some of them.
But my problem is now that the actual download ...
- 31
3
votes
0
answers
93
views
How does google.com detect I'm in Firefox when already using Chrome's user agent
It's well known that google.com doesn't show the microphone search icon in Firefox, probably to incentivize people to use their web browser. (They give it on youtube.com, which is weird for being ...
- 131
3
votes
0
answers
110
views
Yelp: getting documentId for certain operationName
Going through devtools activity for this page (reproducible for any Yelp business page), there's a reference to a GetReviewSummary GraphQL operation in a javascript file. This data shows up in the ...
- 131
3
votes
0
answers
287
views
Where to start with reversing a custom JavaScript VM?
I have recently ran into the most heavy JavaScript obfuscation I've seen. It is using a custom VM to execute bytecodes. I have never dealt with such obfuscation, and I am wondering where I can start ...
- 31
3
votes
0
answers
3k
views
Tool for JavaScript deobfuscation
I'd like to reverse engineer a JavaScript program by manually renaming minimified variable, parameter and function names. However, updating my reverse-engineered code to a newer version would be very ...
user56
3
votes
0
answers
167
views
Adobe Reader JIT Pages
I use Adobe Reader XI for a little research project.
I know that Adobe use SpiderMonkey as its JS engine.
When opening a .pdf file that contains JS, the JS code is compiled in runtime in parts (JIT)...
- 31
2
votes
2
answers
1k
views
How work this obfuscation, and how deobfuscate?
Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§=~[];Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§={___:++Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§,$$$$:(![]+"")[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§],__$:++Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§,$_$_:(![]+"")[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§],_$_:++Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§,$_$$:({}+"")[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§...
- 143
2
votes
2
answers
5k
views
Deobfuscating a javascript file
I am having a obfuscated JS file and I want to deobfuscate it (and not beautify it). I have seen answer to a similar question here and I tried de-obfuscating a the file using online version of ...
- 1,215
2
votes
1
answer
582
views
Decoding Malware javascript [closed]
My .php and .js files have been attacked twice in a month with some JavaScript code.
After going through this similar thread, I ran the JavaScript code posted there and found this decoding result.
...
2
votes
1
answer
243
views
Tools to hook browser's Javascript function implementations
I'm wondering if there is a way to hook or inject code into Javascript's implementation of a native function. For example, print the calling parameters whenever an encrypt() function is called. I not ...
- 121
2
votes
1
answer
69
views
HTML/JS app - getting a reference to an element which is not part of the DOM
I am trying to debug an app which I don't own which uses HTML5 and JS, which displays a video stream. The issue is that the video stutters when viewed in high resolution.
Note that the code is ...
- 123
2
votes
1
answer
169
views
Load a *.dylib or *.so object into the Javascript V8 runtime?
I was reading this Frida release page and noticed it made the following reference:
Short of writing the whole agent in C, one could go ahead and build a
native library, and load it using Module....
- 183
2
votes
2
answers
245
views
How to call an item of a Javascript array?
Say I have the following Javascript array:
var _0xe984=[ '\x61\x70\x70\x6c\x79',
'\x72\x65\x74\x75\x72\x6e\x20\x28\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x28\x29\x20',
'\x7b\x7d\x2e\x63\x6f\x6e\x73\...
- 143
2
votes
1
answer
9k
views
Frida manipulating arguments - Android
I've attempting to learn how to use Frida to instrument android app, just for person interest.
So far I've managed to get my environment set up with a physical android tablet and I can successfully ...
- 31
2
votes
1
answer
208
views
LastPass Android javascript behaviour
A few weeks ago I made a proof-of-concept app demonstrating how LastPass' method of filling out creds in Chrome was insecure. For those interested the source is at https://github.com/activems/...
- 123
2
votes
1
answer
567
views
frida hook `loc_*` or `sub_*`
Is it possible to hook a sub_... object in Frida ? I disassembled an arm64 executable, when running the app on my iPhone, I can see a lot of classes also in the disassembled executable, but I can't ...
- 51
2
votes
1
answer
368
views
'... Debugger undefined or null reference' error when WinDBG TTD Scripting with Javascript
I tried Javascript scripting on WinDbg (TTD specifically); but even in simple example I get error
Unable to get property 'Debugger' of undefined or null reference.
Line was simply var ctl = host....
- 21
2
votes
1
answer
91
views
automatically find the object "this" refers to in js
Im quite new to javascript and sometimes I find it really hard to find what object a keyword 'this' refers to. Is there a code editor that is able to do that for me? Or any other advice that could ...
- 21
2
votes
0
answers
75
views
Javascript: Compare Control Flow (to evade anti-debug and anti-tamper traps)
When reverse engineering obfuscated javascript, it may be protected by anti-tamper mechanisms.
I have a script which will work when run untouched, but cause a fatal javascript error when run in node ...
- 143
2
votes
0
answers
164
views
Access a XREFs with frida
I have a string which has a XREF to a func. This func changes of address at every updates of the app I am working on. So this string is the only "stable" point I can rely on to access to ...
- 51
2
votes
0
answers
28
views
Generating specific request cookies for a website
I have a script that autocheckouts products on a website (bot), recently the site seemed to update something and I keep getting 403 blocks(Perimeter X). My old solution was simply to rotate and brute ...
- 21
2
votes
0
answers
160
views
De-Obfuscating/unminifying a JS code [not duplicate]
I have come across a lot of similar questions on the same heading but unfortunately, none of them provided me with the intended results.
I have a piece of code which, initially I am trying to ...
- 21
2
votes
0
answers
130
views
Frida hook InsertMenuItemW
I'm trying to get information about menu items in an application. Experimentally established that InsertMenuItemW is called. Thanks to the documentation, I set the number of input parameters and wrote ...
- 85
2
votes
0
answers
506
views
How to get video file URL from Twitter
I am looking how to find the video URL of a Twitter video so I can code a converter later (using nodejs or something), but I can't figure out how to do this. I saw this but it doesn't really clear ...
- 121
2
votes
0
answers
100
views
Trying to replicate encryption of an android app
I was trying to replicate/copy the encryption of an android app which uses CryptoJS with sha256 encryption as having seen in the source code of the android app. fingerprinting the app, it was built ...
- 309
2
votes
0
answers
223
views
Javascript equivalent of JEB
In case you already know, there is a full-feature decompiler for Java/Android called JEB (https://www.pnfsoftware.com/)
Some of the most important features include the ability to rename identifiers ...
- 277
2
votes
0
answers
929
views
How to analyse the communication between a WebApp loaded with awesomium and the native program?
I have a Windows program that uses awesomium to display a WebApp. This WebApp communicates in some way with the client program through some native calls. I found references to window.externalHost and ...
- 3,079
1
vote
2
answers
550
views
reverse javascript crackme encryption method algorithm
This crackme contains a text input element on the screen and a button to validate
The value you enter is set into _inputValue, afterwards you click on a button, the function executes, in the last ...
- 283
1
vote
2
answers
4k
views
How to copy video address from tweet?
Twitter has an option to right-click on a video and "copy video address" but this button seems to be broken as it doesn't copy anything to the clipboard, even after I disable Ghostery/adblock. I ...
- 119
1
vote
1
answer
309
views
Is it possible to completely reverse this code?
i have this code i'm trying to deobfuscate
https://pastebin.com/g5mHpWE4
I used
https://beautifier.io/ and
http://www.jsnice.org/
but the result is still not good, current code:
https://pastebin.com/...
- 113
1
vote
2
answers
5k
views
Is deobfuscation of my javascript code hard or easy?
I am trying to protect my app code from theft. Since most of it is written in javascript I had to use many obfuscation techniques to make it incomprehensible.
I have written a very small piece of ...
- 113
1
vote
2
answers
1k
views
IDA Pro Alternative for JavaScript?
I am looking for a good "disassembler" for JavaScript, like IDA Pro but for JS. I am looking at a chrome extension, but the JavaScript is heavily obfuscated. After deobfuscating, I am left with ...
- 23
1
vote
2
answers
4k
views
Any good places to learn about JS de-obfuscation?
I am trying to make a bot on a specific website, so I have to reverse a lot of JS scripts. The reversing it self is not that hard but the de-obfuscation is. Lots of the scripts are obfuscated with ...
- 11
1
vote
2
answers
589
views
Reverse Engineering Javascript - Out of Memory
I found this javascript file on one of those online movie streaming services and was interested in finding out what it does. However, after trying many deobfuscators I am still stuck. A major ...
- 21
1
vote
1
answer
126
views
What's wrong with my mitm to support rr commands with gdbserver on IDA?
First of here is the gdb remote protocol doc.
The idea of the below script is the following - you enter an actual command (one that will be send as a direct packet see packets) in the gdb window then ...
- 475