36

I am the author of JSDetox, thanks to Jurriaan Bremer for mentioning it! As already said every obfuscation scheme is different. JSDetox does not try to deobfuscate everything automatically - the main purpose is to support manual analysis. It has two main features: static analysis tries to optimize code that is "bloated up", e.g. statements like var x = -~-...


21

I'm specifically looking to unminify a minified JavaScript file. Variable renaming is not a big issue, I want it sufficiently readable to be able to analyze the execution. Your question title indicates merely reversing minified code, and not necessarily understanding it. But if you are attempting to gain an understanding of it, Opera Dragonfly sounds like a ...


18

There are a few tools that you might try when wanting to analyze JavaScript: JSDetox Malzilla JavaScript Deobfuscator ExtractScript JS-Beautifier JS-Unpack (see also blog) Rhino Debugger Firebug SpiderMonkey V8 JSNice PoisonJS See also a few tutorials on analyzing obfuscated JavaScript: Analyzing Malicious JavaScript by Dejan Lukan. Advanced obfuscated ...


17

I'm a fan of Malzilla and its embedded SpiderMonkey JS engine which allows you to decode malicious javascript. Here's a tutorial using Malzilla to decode a LuckySploit attack. You can download the pre-built binary for Malzilla on SourceForge, here.


15

Using Malzilla, I was able to de-obfuscate this in ~30 seconds. Step 1, open Malzilla, select the Decoder tab, and paste the JavaScript. Step 2, you can optionally press the "Format Code" button to get a rudimentary re-formatting of the JS. Step 3, check Override eval(), and click the Run script button. You'll notice that in the output box, the de-...


14

I prefer to use the pretty printer inbuilt in Google Chrome's Developer Tools. Here is the minified Code: On pressing the pretty print button, you get the following:


11

Why limit yourself to static deobfuscation? If you run that script through a JavaScript debugger and break on the return statement, you can see that _0xf81fx1 = function myFunction(){var x=5;return x}, which was the plain-text of the function before it was obfuscated. Furthermore, if you run it through http://jsbeautifier.org, the last line of the output is:...


11

Well, in your own programs, it's probably fine. But in a corporate setting its a maintenence nightmare without extremely good documentation and/or team continuity. Neither of which seems all that common in my experience. I think a more general question might be, "are obfuscation techniques really all that useful?" I can understand minify for page ...


11

Your best bet is to use an environment (eg FireFox) in which eval() can be overridden by using a proxy function, and the function just prints the output. That way, there is no risk in missing anything, even if the malware aliases it. Unfortunately, eval() is not designed to be overridden (and I believe is explicitly forbidden by recent ECMAScript spec), ...


11

1. The script writes a <script src=...> tag at the end, so to know what it is doing, you could change the last document.write to a console.log or other defanging measures to see that this is written out: <script src="//srvjs.com/imp/gie462.js?d=«base64»"></script> Visiting that URL gives "Whoops, looks like something went wrong." in HTML,...


9

Somebody at XKCD fora pasted a link to this gist which contains a deobfuscated and annotated source along with some explanations: The main part of Javascript that drives xkcd's "Time" comic (http://xkcd.com/1190/), deobfuscated and annotated. The bulk of the script seems to be an implementation of EventSource - which, while important, is not terribly ...


8

jsbeautifier.org is not the source for JS deobfuscation, actually. See this question for more details Analyzing highly obfuscated JavaScript After multiple de-obfuscations, it seems that code behind is: //eval function myFunction(){var x=5;return x} http://jsunpack.jeek.org/?report=24921f4d96d1e05abfc0affd2233bd69874056c9


8

Both Firefox and Chrome have useful debugging tools to help you find out more information about scripts relating to a behavior. I'll be explaining mostly in Chrome as their default debug tools are more extensive As a start, you can usually use Right Click->Inspect Element to find out information about an element quickly. However this does not appear to ...


8

Well, after online tools, You may use Revelo by KahuSecurity http://www.kahusecurity.com/tools/Revelo_v0.5.1.zip It's have less automation in process, but more powerful in de-obfuscation of customized js. Documentation is included in ZIP, you also may see examples of it's usage in Kahu blog as well: http://www.kahusecurity.com/ p.s. don't forget to use VM!


8

A good place to start is JSBeautifier. In general, it depends on the minify method that was used. This one formats the code and has lots of options. It can also unpack "packed" scripts (packed with Dean Edward's packer). A handy variant of this code is available as a Firefox plugin Javascript Deminifier.


8

This obfuscated code is taking advantage of the wide possibilities to name Javascript variables. This makes a simple-obfuscated Javascript code to look much more scarier. As noted in the great article Valid JavaScript variable names and taken by me from this answer, Javascript variables can be represented using a wide-range of characters: An identifier ...


7

A big con is posed in the following Questions: Which JavaScript-Interpreters break when confronted with such code? Is this acceptable? A simple normal Obfuscator should yield acceptibly obtuse code without breaking some JavaScript-Interpreters. If one really wants to work with zero-width characters in variable names, it would be included in the Code-...


7

You might be lucky trying either JSDetox, http://www.relentless-coding.com/projects/jsdetox, which is an automated javascript+html unpacker in Ruby, or my own library which is work-in-progress and only supports javascript (but does a bit more than JSDetox), https://github.com/jbremer/jsunpck. For JSDetox you can give the html as input through the ...


7

UPDATE Based on @ws's comment and @nderscore's code, use this JSFiddle to decode the thing. To find the password that this script asks for, you can use a simple debugging trick. Go to JSFuck and uncheck the Eval Source option. Paste the obfuscated JavaScript Run You'll see: It seems to be calling prompt(), so put a breakpoint on it, like this: (I'll be ...


6

Well, personally i would either use JSDetox (http://relentless-coding.org/projects/jsdetox) if i'm feeling lazy to analyse it manually. It's probably one of the better tools out there.


5

You might try http://jsunpack.jeek.org/ which works for some stuff. I personally just use Chrome's built-in JS console in a VM, replacing eval()s. This might be helpful too, although it is more for improving readability.


5

I recently tried http://www.jsnice.org/ on 50+KB of a single minified JavaScript file containing lots of dynamic modification code that Cordova's runtime refused to execute (for an app targeted at Windows Phone 8.1 and Windows 10). The results were amazing as it recognises matching code fragments that are available unminified from thousands of opensource ...


5

Deobfuscating variable names with zero-width characters is as easy as renaming variables. That's something you'd do anyway as part of the deobfuscation process, as you infer the intent behind the variables and give them meaningful names. So this technique might at most prompt the reader to make an initial renaming pass. The additional deobfuscation cost is ...


5

It just uses very difficult to read variable names and do some JS trickery to confuse you what it does. If you replace those strange characters you'll get a bit of more readable form a=~[]; a={___:++a,$$$$:(![]+"")[a],__$:++a,$_$_:(![]+"")[a],_$_:++a,$_$$:({}+"")[a],$$_$:(a[a]+"")[a],_$$:++a,$$$_:(!""+"")[a],$__:++a,$_$:++a,$$__:({}+"")[a],$$_:++a,$$$:++a,$...


4

This might be true that those variables are added only to confuse analysis but remember that in Javascript there are so many ways to access the variable that I would take such info from an automated tool with a little grain of salt. It might be true but it also might be that this code uses non-direct access to those 82 variables. Having such code: re = '...


3

Well, so, you can use http://jsbeautifier.org/ with unescape printable chars to get the top var decoded, then, if you look closely, you should see that the values of the var are used everywhere with an index, so you can just write a quick script to replace it with the actual value. End result is here Python to replace the var: #Replace.py //probably not ...


3

In addition to the other useful links here, I recommend to try Malware-Jail Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js malware-jail is written for Node's 'vm' sandbox. Currently implements WScript (Windows Scripting Host) context env/wscript.js, at least the part frequently used ...


3

Yes, the domain is owned (or pwned, they could have hacked a site and use that to stay under the radar) by the group / individual that has attacked you. To avoid future attacker review your code, secure your passwords and check on this every one and then. But, this is very much off-topic. You want the Security Stack Exchange and not this one. This one is ...


3

This also breaks some beautifers (but not all). For example, running your code through JS Beautifier: var ab = "Hello, world!", a‍ b = "Completely different string!", a‌ b = "Yet another completely different string!"; document.getElementById('result1').innerHTML = ab; document.getElementById('result2').innerHTML = a‍ b; document....


3

If I understand well, you would like to reverse a Java applet in order to plug your own tool on a specific API (which is incidentally a trading platform). I do not know why you are speaking about Javascript/Python... If you are reversing a Java application, then you need to know about Java applications... There is no escape from reality, unfortunately. ...


Only top voted, non community-wiki answers of a minimum length are eligible