JavaScript Deobfuscator

What is JavaScript Obfuscation?

JavaScript obfuscation is the process of transforming readable JavaScript code into a version that's difficult to understand and reverse-engineer while maintaining the same functionality. Developers use obfuscation to protect intellectual property, prevent code theft, and make reverse engineering more challenging. However, obfuscation is also commonly used by malicious actors to hide malware and exploit code.

Common Obfuscation Techniques

1. Variable Renaming

Meaningful variable and function names are replaced with short, meaningless names:

// Original
function calculateTotal(price, quantity) {
    return price * quantity;
}

// Obfuscated
function a(b,c){return b*c;}

2. String Encoding

String literals are encoded using various methods:

// Hex encoding
var message = "\x48\x65\x6c\x6c\x6f";  // "Hello"

// Unicode encoding
var message = "\u0048\u0065\u006c\u006c\u006f";  // "Hello"

// Base64 encoding
var message = atob("SGVsbG8=");  // "Hello"

3. Code Packing (eval)

Code is compressed and wrapped in an eval() statement:

eval(function(p,a,c,k,e,d){...}('alert("Hello")',0,0,''.split('|'),0,{}))

4. Dead Code Injection

Useless code is added to confuse readers:

var x = 10;
if (false) { var y = 20; }  // Never executed
var z = x + 5;

5. Control Flow Flattening

Sequential code is transformed into a state machine:

var state = 0;
while (true) {
    switch(state) {
        case 0: /* code 1 */; state = 1; break;
        case 1: /* code 2 */; state = 2; break;
        case 2: return;
    }
}

6. JSFuck

JavaScript code written using only six characters: []()!+

[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+...

Why Deobfuscate JavaScript?

• Security Analysis: Examine suspicious scripts for malware or exploits
• Code Review: Understand third-party libraries and dependencies
• Debugging: Troubleshoot issues in minified production code
• Learning: Study obfuscation techniques and code patterns
• Recovery: Restore lost source code from minified versions
• Vulnerability Research: Analyze potentially malicious code

Deobfuscation Techniques

1. Unpacking Eval Statements

Replace eval() with console.log() to reveal packed code:

// Original packed code
eval(function(p,a,c,k,e,d){...})

// Replace eval with console.log
console.log(function(p,a,c,k,e,d){...})
// Output: actual code

2. Decoding Strings

Convert encoded strings back to readable text:

// Hex to string
"\x48\x65\x6c\x6c\x6f" → "Hello"

// Unicode to string
"\u0048\u0065\u006c\u006c\u006f" → "Hello"

// Base64 to string
atob("SGVsbG8=") → "Hello"

3. Code Beautification

Reformat minified code with proper indentation and line breaks:

// Minified
function a(b){return b*2}

// Beautified
function a(b) {
    return b * 2;
}

4. Variable Renaming

Rename obfuscated variables to meaningful names:

// Obfuscated
function a(b,c){return b+c}

// Renamed
function add(num1, num2) {
    return num1 + num2;
}

Popular Obfuscators

• JavaScript Obfuscator: Open-source obfuscator with multiple features
• UglifyJS: JavaScript minifier and compressor
• Closure Compiler: Google's JavaScript optimizer
• Webpack: Built-in minification and obfuscation
• JSFuck: Esoteric obfuscation using 6 characters
• AAEncode/JJEncode: Japanese-style obfuscation

Obfuscation Detection

Signs that JavaScript code is obfuscated:

• Single-letter or meaningless variable names (a, b, c, _0x1234)
• Heavy use of eval() or Function() constructor
• String arrays with encoded values
• No whitespace or formatting (minified)
• Unusual character patterns (JSFuck: []()!+)
• Excessive use of escape sequences (\x or \u)
• Large arrays of hex or base64 strings
• Complex control flow with many switches

Limitations of Deobfuscation

Best Practices

1. Always backup: Keep a copy of the original obfuscated code
2. Use safe environments: Run untrusted code in sandboxed environments
3. Manual review: Automated tools may miss complex obfuscation
4. Multiple passes: Some code requires multiple deobfuscation rounds
5. Test functionality: Verify that deobfuscated code works correctly
6. Check for malware: Be cautious with unknown scripts

Legal and Ethical Considerations

Tools and Resources

• JS Beautifier: Online tool for formatting JavaScript
• de4js: Multi-decoder for various obfuscation types
• UnPacker: Tool for unpacking packed JavaScript
• Chrome DevTools: Browser developer tools for debugging
• Firefox Developer Tools: Similar capabilities to Chrome
• VSCode: Excellent for manual analysis and refactoring