Skip to main content
11 votes
Accepted

How do I reverse this javascript code? How is it packed?

1. The script writes a <script src=...> tag at the end, so to know what it is doing, you could change the last document.write to a console.log or other defanging measures to see that this is ...
kennytm's user avatar
  • 466
8 votes
Accepted

How work this obfuscation, and how deobfuscate?

This obfuscated code is taking advantage of the wide possibilities to name Javascript variables. This makes a simple-obfuscated Javascript code to look much more scarier. As noted in the great ...
Megabeets's user avatar
  • 8,999
6 votes

What is a good tools to reverse the effects of Minify on JavaScript?

I recently tried http://www.jsnice.org/ on 50+KB of a single minified JavaScript file containing lots of dynamic modification code that Cordova's runtime refused to execute (for an app targeted at ...
JulianHarty's user avatar
6 votes
Accepted

How can I deobfuscate this javascript code

The special "accent" letters are just a distraction. You can use a text-editor to replace them with "standard" letters and the code would still work. Let's add a newline after each semicolon: É=-~-~[...
Dvd848's user avatar
  • 559
6 votes
Accepted

How can I modify or decompile Hermes JS bytecode?

My friend made this tool: hbctool, a Hermes bytecode disassembler/assembler. This will help you disassemble the file into a more readable format (similar to hbcdump), so you can modify and re-assemble ...
ErbaZZ's user avatar
  • 76
5 votes
Accepted

Obfuscated code analysis - can unused variables be ignored?

This might be true that those variables are added only to confuse analysis but remember that in Javascript there are so many ways to access the variable that I would take such info from an automated ...
Paweł Łukasik's user avatar
5 votes

How work this obfuscation, and how deobfuscate?

It just uses very difficult to read variable names and do some JS trickery to confuse you what it does. If you replace those strange characters you'll get a bit of more readable form a=~[]; a={___:++...
Paweł Łukasik's user avatar
5 votes

Analyzing highly obfuscated JavaScript

In addition to the other useful links here, I recommend to try Malware-Jail Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js malware-...
api pota's user avatar
  • 193
4 votes

How to get Video URL from embedded Link in Twitter

youtube-dl is a nice program to download media content from a lot of websites, including twitter (and despites program name). It is open source, studying it can help understand how to retrieve the ...
Patrick Mevzek's user avatar
4 votes
Accepted

reverse javascript crackme encryption method algorithm

To extend on EWD-0- about the reversibility of RC4 here's how I tried it: From your actual code and reversing it a little to get "input128" encoded: arr = [99, 116, 115, 37, 16, 120, 211, 90, 197, ...
Tensibai's user avatar
  • 156
4 votes

How to copy video address from tweet?

I could not quite track how exactly it's done but youtube-dl can do it. Run it with -v or -g to see the final video URL: C:\Work>C:\Python27\Scripts\youtube-dl.exe -v https://twitter.com/starwars/...
Igor Skochinsky's user avatar
  • 36.8k
3 votes
Accepted

How decrypt hexadecimal javascript code?

Those hex values could represent anything. Look for online converters that convert hexadecimal to text (consider various formats), dec, etc. and see if the results make any sense. If not, then they ...
dsasmblr's user avatar
  • 2,234
3 votes
Accepted

Is deobfuscation of my javascript code hard or easy?

Resolved. generally nothing in js is impossible to reverse in this case the 'alert' string in plain text give me a big help, because I simply started to resolve function value one step back at time. ...
realtebo's user avatar
  • 183
3 votes
Accepted

IDA Pro Alternative for JavaScript?

Have a look at https://github.com/scottrogowski/code2flow for generating callgraphs. Turn your Python and Javascript source code into DOT flowcharts Code2flow will sweep through your project ...
Mick's user avatar
  • 7,582
3 votes

How to get Video URL from embedded Link in Twitter

You were looking at the wrong piece of code. Twitter features lightly obfuscated javscript. Bring it to order and you'll receive something like this: { "duration": 55322, "scribe_widget_origin": true,...
Nordwald's user avatar
  • 2,906
3 votes
Accepted

Is it possible to completely reverse this code?

Having such code the first thing to do is to analyze what part is the obfuscation algorithm and what's the actual code. Here' it's not that difficult as all the code is on top. So let's analyze it ...
Paweł Łukasik's user avatar
2 votes

Try to deobfuscate multi layered javascript

You could try using de4js. For the javascript snippet in the original post, de4js produces the following output: var _0x2815 = ["3 1(){2 0=5;4 0}", "|", "split", "x|myFunction|var|function|return|", "...
user29581's user avatar
2 votes

Frida manipulating arguments - Android

If I understand your question correctly, you want to change the parameter, v, inside the inner function. Right? If that's the case, you would already have access to the v argument inside your inner ...
qre0ct's user avatar
  • 121
2 votes

How to call an item of a Javascript array?

The variable _0xe984 in your example is an array of strings, therefore, calling it with _0xe984("0xa") is actually to call as if it was a function that gets the string "0xa" as a parameter. Thus, the ...
Megabeets's user avatar
  • 8,999
2 votes

How do I decode this JavaScript code?

You can use this tool to partial deobfuscate that code: http://jsnice.org/ In that case I get this: 'use strict'; (function(data, i) { /** * @param {number} isLE * @return {undefined} */ ...
Álvaro Romero's user avatar
2 votes

would be possible to deobfuscate javascript code?

All the strings you see \x41\x42\x43 are nothing but normal chars encoded as hex of their ascii values. You can decode them as follows: >>> "\x41\x42\x43".decode("utf-8") u'ABC' by trying ...
Tom Riddle's user avatar
2 votes
Accepted

Is v8's --print-bytecode safe?

--print-bytecode is not safe. echo "process.exit(42)" > test.js node --print-bytecode ./test.js It exists with status_code = 42. So that code is getting executed. It is not safe.
Evan Carroll's user avatar
  • 1,789
2 votes
Accepted

Load a *.dylib or *.so object into the Javascript V8 runtime?

I was misinterpreting the context of the comment in the original link, it seems. I was under the impression that Module.load was a v8-ism, while it in fact appears to be a Frida-API. https://frida.re/...
sherrellbc's user avatar
2 votes

How can I modify or decompile Hermes JS bytecode?

Refer below link someone added support for version 84 in his forked repo hbc-v84
Ace's user avatar
  • 21
2 votes
Accepted

HTML/JS app - getting a reference to an element which is not part of the DOM

Look for any requests to document.createElement or document.createElementNS in the code that may be creating and appending the <video> element to the DOM. You might be able to locate the <...
raheel0x01's user avatar
2 votes

Tools to hook browser's Javascript function implementations

If you have access to the DevTools console and you're able to make the call to encrypt happen whenever you want after the page loads, then you could just redefine the encrypt method to log what's ...
dsasmblr's user avatar
  • 2,234
1 vote

Decrypt config.bin file from Huawei B5328 router. I have source files

Unfortunately, knowledge of JS probably isn't going to help. The HTML passes along the uploaded file to the cgi-bin/maintenance.cgi file which is a compiled ARM BE8 binary that's a bit more work to ...
Jordan's user avatar
  • 171
1 vote

De-obfuscating code ran through JScrambler 3x via Eval() functions

If I'm not mistaken, jscrambler has built-in capabilities against de-obfuscators. If you look at their docs you'll see that they were already doing this at version 3. Since they are an enterprise tool ...
Ashley Green's user avatar
1 vote

WebSocket debugging in Javascript app gives "401 Unauthorized"

Ok, I figured it out. The websocket-client library I use for python writes its own Origin header by default and I was ending up with two Origin headers, which may have been tipping off the server. I ...
FailedShack's user avatar
1 vote

How do you un-obfuscate JS code that is evaluating your browser environment?

Start from making JS code more readable using some JS beautifier, there are online tools for that too: https://beautifier.io Then start debugging it in some JS IDE, or just in Chrome developer tools ...
Anton Kukoba's user avatar
  • 1,850

Only top scored, non community-wiki answers of a minimum length are eligible