AwesomeREA.org

Tool

de4js

Browser-based JavaScript deobfuscator and unpacker, built as a Jekyll site that also works offline as a progressive web app. It detects or lets the user pick an encoding and reverses Dean Edwards' Packer, eval- and array-based obfuscators, some Obfuscator.IO output, JSFuck, JJencode, AAencode, URL encoding, My Obfuscate and WiseLoop, then beautifies and highlights the result, with options to unescape strings, merge strings, recover object paths and evaluate constant expressions. An optional userscript sends the code to the JS Nice service to rename unreadable identifiers.

Requirements & limits

  • The repository is archived. The last release, v1.12.0, was published 2021-03-28, and the reviewed master commit from 2021-11-12 adds only dependency updates and a fix to how option values are converted to booleans. The README notes that Obfuscator.IO is always up to date and that automatic tools, this one included, usually do not match its latest version. The homepage, lelinhtinh.github.io/de4js, still served the app through a redirect at review.
  • No installation is needed for the hosted page. Local copies run with docker-compose, or with Ruby 2.1+, Bundler and the GitHub Pages Jekyll gems, at localhost:4000/de4js/; npm run build also needs workbox-cli to generate the offline service worker. The Wise unpackers load from the NotSoWise git submodule, which must be checked out.
  • Input is pasted code, an opened file or a script fetched from a URL. The Eval, JSFuck, Array, _Number, Obfuscator.IO and AAencode decoders and the expression-evaluation option run all or part of the input with eval inside a Web Worker, so untrusted code executes in the browser's worker context. The JS Nice userscript sends code to jsnice.org over plain HTTP and does not work offline.
  • package.json defines no tests and the repository has no automated tests or CI. Whether a decoder succeeds depends on the obfuscator and its version, so output should be checked by reading it.
  • MIT; the bundled js-beautify, highlight.js, clipboard.js, math.js, Workbox and magic-check code and the AAencode and JJencode decoders keep their own notices. The reviewed sources state no REA use, and this collection deobfuscated nothing.

About this entry

Type
Tool
Category
JavaScript and Electron tools
Relationship
Foundation tool
Targets
Website

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · lelinhtinh/de4js · Revision b06fff9
  2. worker/decode.js GitHub · lelinhtinh/de4js · Revision b06fff9
  3. lib/evaldecode.js GitHub · lelinhtinh/de4js · Revision b06fff9
  4. lib/utils.js GitHub · lelinhtinh/de4js · Revision b06fff9
  5. _data/methods.yml GitHub · lelinhtinh/de4js · Revision b06fff9
  6. _data/options.yml GitHub · lelinhtinh/de4js · Revision b06fff9
  7. userscript/de4js_helper.user.js GitHub · lelinhtinh/de4js · Revision b06fff9
  8. .gitmodules GitHub · lelinhtinh/de4js · Revision b06fff9
  9. package.json GitHub · lelinhtinh/de4js · Revision b06fff9
  10. docker-compose.yml GitHub · lelinhtinh/de4js · Revision b06fff9
  11. LICENSE GitHub · lelinhtinh/de4js · Revision b06fff9
  12. https://github.com/lelinhtinh/de4js/releases/tag/v1.12.0

More in Apps

All 113 entries in Apps