AwesomeREA.org

Tool

JS-Deobfuscator (0x1Avram)

Node.js deobfuscator for JavaScript produced by Timofey Kachalov's javascript-obfuscator, also offered as obfuscator.io. It parses the sample with esprima and runs eleven stages named after the obfuscator's own, which remove injected self-defending and debug-protection code, unwind control-flow flattening and dead-code injection, restore converted literals and object keys, replace string-array calls with the decoded strings, simplify the result and recursively process code passed to eval. String-array code is detected automatically or supplied as separate files, and an Examples folder pairs original, obfuscated and deobfuscated samples.

Targets
Website
Category
Website analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Inactive since the reviewed main commit, a README update on 2023-04-17. The last release, 1.0.7 (2022-12-29), attaches binaries.zip with standalone Windows and Linux builds made with pkg, while package.json still reports 1.0.2. The README says it was developed with Node.js 16.15 and worked with obfuscator versions current at the time; output from older obfuscator versions may produce a different AST.
  • Run from source after npm install (esprima, escodegen, esquery, estraverse, winston and yargs) with node index.js -i input -o output. When automatic detection fails, the string array, its wrappers, the wrapper names and the rotate code are passed as separate files with -s, -w, -n and -r. esprima does not parse all newer JavaScript syntax, so the README suggests transpiling such input with Babel first.
  • The README warns that the code is not secure and should run only in an isolated environment such as a virtual machine: string-array decoding evaluates code taken from the sample with eval inside the deobfuscator's own Node.js process. The identifier- and property-renaming stages are empty placeholders, so obfuscated names are not recovered.
  • Supply the obfuscated script yourself. The Examples text files are derived from small snippets, javascript-obfuscator's example script (BSD-2-Clause) and javascript-algorithms (MIT), with both licenses included.
  • MIT (LICENSE). A different project from the catalog's ben-sb javascript-deobfuscator, whose npm package is also named js-deobfuscator; this one is used from its repository or release binaries. No scripts were deobfuscated for this entry.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · 0x1Avram/js-deobfuscator · Revision 3a4a20a
  2. package.json GitHub · 0x1Avram/js-deobfuscator · Revision 3a4a20a
  3. deobfuscator.js GitHub · 0x1Avram/js-deobfuscator · Revision 3a4a20a
  4. Stages/stage_09_preparing.js GitHub · 0x1Avram/js-deobfuscator · Revision 3a4a20a
  5. Stages/stage_03_stringarray.js GitHub · 0x1Avram/js-deobfuscator · Revision 3a4a20a
  6. Stages/stage_04_renameidentifiers.js GitHub · 0x1Avram/js-deobfuscator · Revision 3a4a20a
  7. Examples GitHub · 0x1Avram/js-deobfuscator · Revision 3a4a20a
  8. LICENSE GitHub · 0x1Avram/js-deobfuscator · Revision 3a4a20a
  9. https://github.com/0x1Avram/js-deobfuscator/releases/tag/1.0.7

More in Websites

All 48 entries in Websites