AwesomeREA.org

Learning resource

Supplementary AST-Based Deobfuscation Materials

Companion code for the ReverseJS blog's 2022 series on deobfuscating JavaScript by manipulating abstract syntax trees with Babel. Each folder pairs a small obfuscated sample with a deobfuscator script and its output, covering string concealing (escape sequences, concatenation, string arrays and string encryption), constant folding including JSFuck-style code, substitution of constant variables, bracket-to-dot property access, dead-code removal, proxy functions and sequence expressions. The README presents them as short learning examples rather than a production deobfuscator.

Targets
Website
Category
Learning resources
Relationship
Learning resource
Sources reviewed

Requirements & limits

  • Reviewed at the 2023-10-20 master commit, whose last change bumped @babel/traverse to 7.23.2. The blog lists seven posts in the series from May and June 2022, and folders such as Proxy Functions and Sequence Expressions have no matching post; the README warns that code not published on the blog is outdated and experimental, may be inaccurate or buggy, will likely not be updated and should not be used in a production deobfuscator.
  • Needs Node.js and npm install: package.json declares @babel/core and js-beautify, and the lockfile resolves @babel/parser, @babel/traverse and @babel/generator 7.23.x. Each script is run with node from its folder against the bundled sample. The String Encryption example also imports chrome-remote-interface-extra, which package.json does not list.
  • The samples are short, author-written obfuscations, so applying the techniques to other code needs the analyst's own inputs and checking. The VM-evaluation proxy-function example and the String Encryption example run code from the sample through Node's vm module, which Node.js documents as not a security mechanism. The author's later blog post reports CVE-2023-45133, an arbitrary-code-execution flaw in @babel/traverse before 7.23.2; the reviewed lockfile already resolves 7.23.2.
  • There are no tests or CI (the npm test script is a placeholder); expected outputs are committed beside each sample, and nothing was run in this review.
  • MIT (LICENSE), although package.json keeps npm's default ISC field. The reviewed sources establish no REA connection.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials · Revision 3709295
  2. package.json GitHub · SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials · Revision 3709295
  3. package-lock.json GitHub · SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials · Revision 3709295
  4. String%20Concealing GitHub · SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials · Revision 3709295
  5. Proxy%20Functions GitHub · SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials · Revision 3709295
  6. String%20Concealing/String%20Encryption/deobber.js GitHub · SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials · Revision 3709295
  7. LICENSE GitHub · SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials · Revision 3709295
  8. https://steakenthusiast.github.io/2022/05/21/Deobfuscating-Javascript-via-AST-An-Introduction-to-Babel/
  9. https://steakenthusiast.github.io/2023/10/11/CVE-2023-45133-Finding-an-Arbitrary-Code-Execution-Vulnerability-In-Babel/
  10. https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92
  11. https://nodejs.org/api/vm.html

More in References and learning

All 61 entries in References and learning