24

There are a few tools that you might try when wanting to analyze JavaScript: JSDetox Malzilla JavaScript Deobfuscator ExtractScript JS-Beautifier JS-Unpack (see also blog) Rhino Debugger Firebug SpiderMonkey V8 JSNice PoisonJS See also a few tutorials on analyzing obfuscated JavaScript: Analyzing Malicious JavaScript by Dejan Lukan. Advanced obfuscated ...


15

Using Malzilla, I was able to de-obfuscate this in ~30 seconds. Step 1, open Malzilla, select the Decoder tab, and paste the JavaScript. Step 2, you can optionally press the "Format Code" button to get a rudimentary re-formatting of the JS. Step 3, check Override eval(), and click the Run script button. You'll notice that in the output box, the de-...


11

1. The script writes a <script src=...> tag at the end, so to know what it is doing, you could change the last document.write to a console.log or other defanging measures to see that this is written out: <script src="//srvjs.com/imp/gie462.js?d=«base64»"></script> Visiting that URL gives "Whoops, looks like something went wrong." in HTML,...


11

Why limit yourself to static deobfuscation? If you run that script through a JavaScript debugger and break on the return statement, you can see that _0xf81fx1 = function myFunction(){var x=5;return x}, which was the plain-text of the function before it was obfuscated. Furthermore, if you run it through http://jsbeautifier.org, the last line of the output is:...


9

UPDATE Based on @ws's comment and @nderscore's code, use this JSFiddle to decode the thing. To find the password that this script asks for, you can use a simple debugging trick. Go to JSFuck and uncheck the Eval Source option. Paste the obfuscated JavaScript Run You'll see: It seems to be calling prompt(), so put a breakpoint on it, like this: (I'll be ...


8

jsbeautifier.org is not the source for JS deobfuscation, actually. See this question for more details Analyzing highly obfuscated JavaScript After multiple de-obfuscations, it seems that code behind is: //eval function myFunction(){var x=5;return x} http://jsunpack.jeek.org/?report=24921f4d96d1e05abfc0affd2233bd69874056c9


8

This obfuscated code is taking advantage of the wide possibilities to name Javascript variables. This makes a simple-obfuscated Javascript code to look much more scarier. As noted in the great article Valid JavaScript variable names and taken by me from this answer, Javascript variables can be represented using a wide-range of characters: An identifier ...


6

I recently tried http://www.jsnice.org/ on 50+KB of a single minified JavaScript file containing lots of dynamic modification code that Cordova's runtime refused to execute (for an app targeted at Windows Phone 8.1 and Windows 10). The results were amazing as it recognises matching code fragments that are available unminified from thousands of opensource ...


5

It just uses very difficult to read variable names and do some JS trickery to confuse you what it does. If you replace those strange characters you'll get a bit of more readable form a=~[]; a={___:++a,$$$$:(![]+"")[a],__$:++a,$_$_:(![]+"")[a],_$_:++a,$_$$:({}+"")[a],$$_$:(a[a]+"")[a],_$$:++a,$$$_:(!""+"")[a],$__:++a,$_$:++a,$$__:({}+"")[a],$$_:++a,$$$:++a,$...


5

This might be true that those variables are added only to confuse analysis but remember that in Javascript there are so many ways to access the variable that I would take such info from an automated tool with a little grain of salt. It might be true but it also might be that this code uses non-direct access to those 82 variables. Having such code: re = '...


4

In addition to the other useful links here, I recommend to try Malware-Jail Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js malware-jail is written for Node's 'vm' sandbox. Currently implements WScript (Windows Scripting Host) context env/wscript.js, at least the part frequently used by ...


4

To extend on EWD-0- about the reversibility of RC4 here's how I tried it: From your actual code and reversing it a little to get "input128" encoded: arr = [99, 116, 115, 37, 16, 120, 211, 90, 197, 22, 166, 63, 146, 59, 123, 237, 93, 44, 76, 118, 168, 91, 55, 187, 62, 220, 135, 49, 127, 185, 153, 8, 66, 155, 152, 181, 117, 149, 31, 87, 169, 6, 172, 34, 101, ...


3

youtube-dl is a nice program to download media content from a lot of websites, including twitter (and despites program name). It is open source, studying it can help understand how to retrieve the correct URLs and various other stuff (media quality, etc…)


3

You were looking at the wrong piece of code. Twitter features lightly obfuscated javscript. Bring it to order and you'll receive something like this: { "duration": 55322, "scribe_widget_origin": true, "heartbeatEnabled": false, "video_url": "https:\/\/video.twimg.com\/ext_tw_video\/823648834102272000\/pu\/pl\/BZiFV49f1BCX2JkK.m3u8", "disable_embed": "0", "...


3

Well, so, you can use http://jsbeautifier.org/ with unescape printable chars to get the top var decoded, then, if you look closely, you should see that the values of the var are used everywhere with an index, so you can just write a quick script to replace it with the actual value. End result is here Python to replace the var: #Replace.py //probably not ...


3

If I understand well, you would like to reverse a Java applet in order to plug your own tool on a specific API (which is incidentally a trading platform). I do not know why you are speaking about Javascript/Python... If you are reversing a Java application, then you need to know about Java applications... There is no escape from reality, unfortunately. ...


3

Yes, the domain is owned (or pwned, they could have hacked a site and use that to stay under the radar) by the group / individual that has attacked you. To avoid future attacker review your code, secure your passwords and check on this every one and then. But, this is very much off-topic. You want the Security Stack Exchange and not this one. This one is ...


3

Those hex values could represent anything. Look for online converters that convert hexadecimal to text (consider various formats), dec, etc. and see if the results make any sense. If not, then they could just be 100% obfuscated to not recover any sort of meaningful name. Therefore, just make meaningful names yourself where you see repeated occurrences of ...


3

Resolved. generally nothing in js is impossible to reverse in this case the 'alert' string in plain text give me a big help, because I simply started to resolve function value one step back at time. same thing for the setInterval, it was in plain Text This is near the same identical schema of obfuscation of a PDF virus, a JS that internally was doing ...


3

The special "accent" letters are just a distraction. You can use a text-editor to replace them with "standard" letters and the code would still work. Let's add a newline after each semicolon: É=-~-~[],ó=-~É,Ë=É<<É,þ=Ë+~[]; Ì=(ó-ó)[Û=(''+{})[É+ó]+(''+{})[ó-É]+([].ó+'')[ó-É]+(!!''+'')[ó]+({}+'')[ó+ó]+(!''+'')[ó-É]+(!''+'')[É]+(''+{})[É+ó]+({}+'')[ó+ó]+(...


3

Having such code the first thing to do is to analyze what part is the obfuscation algorithm and what's the actual code. Here' it's not that difficult as all the code is on top. So let's analyze it step by step: var norm = ["cookie", "toUTCString",... defines an array with string that will be used in the application. Having them in an array and not in the ...


2

You could try using de4js. For the javascript snippet in the original post, de4js produces the following output: var _0x2815 = ["3 1(){2 0=5;4 0}", "|", "split", "x|myFunction|var|function|return|", "replace", "", "\\w+", "\\b", "g"]; eval(function (_0xf81fx1, _0xf81fx2, _0xf81fx3, _0xf81fx4, _0xf81fx5, _0xf81fx6) { _0xf81fx5 = function (_0xf81fx3) { ...


2

In short, no. If they're going to implement the "crypto" in Javascript in this way there isn't anything you can do beyond more obfuscation. This is 100% applicable to this situation but see MataSano's article here explaining pitfalls of client side authentication using JavaScript. Similar to what's touched on in the article, the issue is that no matter ...


2

This is dean edwards' js packer : http://dean.edwards.name/packer/. I see it quite frequently being used to obfuscate scripts as it is freely available. It's written in Javascript but there are also versions in other langages on the site. By the way the Decode button and text area is only disabled via HTML attributes, so you can reenable them using The ...


2

you can either print out the eval values on a custom html page using something like <html> <body> <script> document.write('<textarea cols="120" rows="10">'); document.write(contents of eval); document.write('</textarea>'); </script> </body> </html> or use malzilla or http://matthewfl.com/unPacker.html


2

If I understand your question correctly, you want to change the parameter, v, inside the inner function. Right? If that's the case, you would already have access to the v argument inside your inner function. So what you can do is something like this: Java.perform(function () { // Function to hook is defined here var SpeedometerView = Java.use('adL'); // ...


2

The variable _0xe984 in your example is an array of strings, therefore, calling it with _0xe984("0xa") is actually to call as if it was a function that gets the string "0xa" as a parameter. Thus, the interpreter will throw an exception because _0xe984 is not a function. However, calling _0xe984[0xa] will output the item in the index 0xa (i.e index 10) of ...


2

All the strings you see \x41\x42\x43 are nothing but normal chars encoded as hex of their ascii values. You can decode them as follows: >>> "\x41\x42\x43".decode("utf-8") u'ABC' by trying to decode var _0x6770=[some list] will give you some base64 encoded strings. You can decode them as shown below >>> "ZWFjaA==".decode("base64") 'each' ...


2

You can use this tool to partial deobfuscate that code: http://jsnice.org/ In that case I get this: 'use strict'; (function(data, i) { /** * @param {number} isLE * @return {undefined} */ var write = function(isLE) { for (; --isLE;) { data["push"](data["shift"]()); } }; write(++i); })(_0xf75e, 194); /** * @param {string} ...


2

--print-bytecode is not safe. echo "process.exit(42)" > test.js node --print-bytecode ./test.js It exists with status_code = 42. So that code is getting executed. It is not safe.


Only top voted, non community-wiki answers of a minimum length are eligible