JavaScript Deobfuscator
What do we mean by obfuscator?
Technically, an obfuscator is a method or procedure that we employ to make a script harder for users to read while maintaining the same functionality, i.e., producing the same output from both scripts.
Obfuscation has been observed in a variety of programming languages, including Perl, C++, and others. Ironically, we can also utilize it in English. For instance, the basic version
“The company may have to fire some employees due to financial difficulties.”
Obfuscator version:
“It is becoming more and more necessary for the organization to engage in strategic realignment of its human capital resources, which may require a recalibration of our workforce levels, given the current macroeconomic volatility and the resulting fiscal constraints.”
Code:
Simple JavaScript:
console.log ("Hello, this is a sample code");Obfuscated JavaScript:
`` var _0xb4a9bc=_0x219d;
function _0x219d(_0x5982da,_0x2a292e){var _0xf44994=_0xf449();
return _0x219d=function(_0x219da9,_0x37715c){_0x219da9=_0x219da9–0x1eb;
var _0x38d9dc=_0xf44994[_0x219da9];
return _0x38d9dc;
},
_0x219d(_0x5982da,_0x2a292e);}function _0xf449()
{var _0x582e29=['54ydJmhs','72oiXnCZ','1106072bYJqyr','13848XTGkZp','3412088jJfRUN','8921xAkvLq','771137pHPTxB','Hello,\x20This\x20is\x20a\x20sample\x20code','10scHsyI','21WoekvA','142731rRTPxe','1280568iTQirF','1660xxKSOQ'];
_0xf449=function(){return _0x582e29;};
return _0xf449();
}
(function(_0x57e2c7,_0x5425cc){var _0x47303f=_0x219d,_0x1fe7b7=_0x57e2c7();
while(!![])
{try{var _0x3eb557=parseInt(_0x47303f(0x1f0))/0x1+parseInt(_0x47303f(0x1eb))/0x2*(-parseInt(_0x47303f(0x1f4))/0x3)+-parseInt(_0x47303f(0x1ec))/0x4*(parseInt(_0x47303f(0x1f2))/0x5)+parseInt(_0x47303f(0x1f5))/0x6+parseInt(_0x47303f(0x1f3))/0x7*(parseInt(_0x47303f(0x1ee))/0x8)+parseInt(_0x47303f(0x1f7))/0x9*(-parseInt(_0x47303f(0x1f6))/0xa)+-parseInt(_0x47303f(0x1ef))/0xb*(-parseInt(_0x47303f(0x1ed))/0xc);
if(_0x3eb557===_0x5425cc)
break;
else _0x1fe7b7['push'](_0x1fe7b7['shift']());}
catch(_0x3b950d){_0x1fe7b7['push'](_0x1fe7b7['shift']());}}}
(_0xf449,0xe3d44),console['log'](_0xb4a9bc(0x1f1))); ``Now that we have a gist of obfuscation, let us learn about deobfuscation. In simpler terms, it is defined as reverse obfuscation, which is a technique to decipher code that has been obfuscated.
Why Deobfuscation?
Now this feels counterintuitive, as we know obfuscation is important for people for security, why is there a need to reverse the process? Well, though obfuscation is a fantastic technique, it can be used by malicious actors to hide different payloads that they are going to inject.
Deobfuscation is important in antivirus software to detect these malicious codes. It is also used in your firewalls, IDS, and malware analysis tools that aid in identifying potential threats.
Obfuscation is another tactic used by cybercriminals. To avoid being discovered and penetrated by security measures and antiviral programs, they mask harmful code. It’s a tactic to hide one’s true intentions from cybersecurity defence experts.
The deobfuscation process has become essential to cybersecurity due to the misuse of obfuscation by hackers. In order to reverse the obfuscation and make the malicious code understandable, deobfuscation tools and procedures are essential. This helps experts in cybersecurity comprehend how a malicious program or piece of malware operates, locates its origin, and creates justifiable defences against it.
Get Kushagra Singhal’s stories in your inbox
Join Medium for free to get updates from this writer.
How to Deobfuscate a Script
Deobfuscation can be done either automatically or manually. Manual deobfuscation entails a comprehensive, step-by-step examination of the code, the decryption of algorithmic patterns, the translation of code between forms, and the simplification of the code, a procedure called code refactoring. This procedure can be labour and time intensive and demands a high level of coding competence, depending on the degree of obfuscation.
Conversely, automatic deobfuscation makes use of instruments and programs created especially for this purpose. These programs employ various techniques such as string manipulation, data flow analysis, and parsing intricate code to restore it to a comprehensible state.
We may also make use of the following internet resources:
Similar to that, you can utilize the developer tools for Chrome or Firefox directly to get a similar outcome (see https://www.labnol.org/software/deobfuscate-javascript/19815/#: \:text=If%20you%20have%20Google%20Chrome, That%27s%20it).
Types of Deobfuscation
A. STATIC ANALYSIS
Static analysis uses reverse engineering to retrieve information from a program by scanning the whole APK.
Without launching the software. Application data can be extracted using a static analysis technique from configuration files, binary files, source code, bytecode, and other related files.
After that, several features are gathered and included in numerical feature vectors in order to train statistical or machine learning models. The benefits of static analysis techniques, like great code coverage and high efficiency, make them popular for use in Android malware detection.
B. DYNAMIC ANALYSIS
In order to identify malicious activity, dynamic analysis approaches use information flow tracking, which gathers data from processes in operation, including system calls and network traffic. When compared to static analysis, dynamic analysis approaches have a few advantages. One such advantage is the ability to gather data on network traffic and dynamically loaded code.
Code that loads dynamically comes from a path inside the device or from a remote system. Dynamic class loading is a common strategy used by Android developers to update their applications; therefore, its existence might not always be a sign of criminal activity. The drawback of dynamic analysis is that it can affect malware behaviour when code execution occurs in a constrained context. Due to the lack of availability of its command-and-control server, the malware could not be able to carry out the malicious event or load the code dynamically. Additionally, there exist techniques to identify sandbox environments and halt their malevolent actions so as to evade discovery through dynamic analysis.
References
·https://javascript.plainenglish.io/javascript-deobfuscation-7da22f0b98fa
·Impact of Code Deobfuscation and Feature Interaction in Android Malware Detection by IEEE Access Research Paper
