Skip to content

It deobfuscates JSFuck into readable JavaScript

License

Notifications You must be signed in to change notification settings

Sakhma-Dyck/de-jsfucker

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

15 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

de-jsfuck

It deobfuscates JSFuck into readable JavaScript.

Quick use guide

If you have already setup SBCL with Quicklisp, the you can skip installing Roswell

  • Install and setup Roswell

  • Run

    $ ./run.sh '<File_Name_Containg_JsFuck_Code>'
    

Background details

I had to get past some changing JSFuck code which injected some global variables and get the values of those variables. My target was to reverse a JSFuck code with only specific part varying every time. So, I embarked upon the strategy of pattern matching. In the end, I was able to decode almost all of the JSFuck code.

The important observations on which the code is based are

  • All codes began with a specific pattern which fetched Function of JS which is used to generate functions from strings.

  • All of them ended with () which called the generated function.

  • The code between them had segments enclosed within () of [], sometimes continuous, separated by +. They turned out to generate characters of the string being concatenated with +.

Note: I have added only those characters which I encountered during my inspection. The token list is not complete. If you find <unknown: section in your output, you can evaluate them and add them to the mapping in jsfuck-map.lisp. A pull request on the same will also benifit a larger audience.

TODO

  • Check the missing characters and add support for them too.

Blog post

About

It deobfuscates JSFuck into readable JavaScript

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Common Lisp 99.5%
  • Shell 0.5%