Skip to content

Instantly share code, notes, and snippets.

@dheffx
Created February 16, 2018 17:08
Show Gist options
  • Save dheffx/62ee892a9b4e8ec74cb51252fa547a59 to your computer and use it in GitHub Desktop.
Save dheffx/62ee892a9b4e8ec74cb51252fa547a59 to your computer and use it in GitHub Desktop.
example to unobfuscate a variant of obfuscated javascript
const atob = require('atob');
const fs = require('fs');
const unminify = require('unminify');
const obfuscated = require('./obfuscated').data;
const outputFile = "output.js";
let decoded = atob(obfuscated);
let escaped = escape(decoded);
let ready = decodeURIComponent(escaped);
let unobfuscated = unobfuscate(ready);
let unminified = unminify(unobfuscated)
fs.writeFile(outputFile, unminified, function(e) {
console.log("saved")
});
function unobfuscate(_string) {
let _dict = {},
_array = (_string + "").split(""),
_currentChar = _array[0],
_offset = _currentChar,
_result = [_currentChar],
_count = 256,
_predicate;
for (let i=1; i < _array.length; i++) {
let _nextCharCode = _array[i].charCodeAt(0);
if (_nextCharCode < 256) {
_predicate = _array[i];
} else{
_predicate = _dict[_nextCharCode] ? _dict[_nextCharCode] : (_offset + _currentChar);
}
_result.push(_predicate);
_currentChar = _predicate.charAt(0);
_dict[_count] = _offset + _currentChar;
_count++;
_offset = _predicate;
}
return _result.join("");
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment