Skip to content

Latest commit

 

History

History
43 lines (26 loc) · 1.6 KB

README.md

File metadata and controls

43 lines (26 loc) · 1.6 KB
Raw

de-jsfuck

It deobfuscates JSFuck into readable JavaScript.

Quick use guide

If you have already setup SBCL with Quicklisp, the you can skip installing Roswell

  • Install and setup Roswell

  • Run

    $ ./run.sh '<File_Name_Containg_JsFuck_Code>'

Background details

I had to get past some changing JSFuck code which injected some global variables and get the values of those variables. My target was to reverse a JSFuck code with only specific part varying every time. So, I embarked upon the strategy of pattern matching. In the end, I was able to decode almost all of the JSFuck code.

The important observations on which the code is based are

  • All codes began with a specific pattern which fetched Function of JS which is used to generate functions from strings.

  • All of them ended with () which called the generated function.

  • The code between them had segments enclosed within () of [], sometimes continuous, separated by +. They turned out to generate characters of the string being concatenated with +.

Note: I have added only those characters which I encountered during my inspection. The token list is not complete. If you find <unknown: section in your output, you can evaluate them and add them to the mapping in jsfuck-map.lisp. A pull request on the same will also benifit a larger audience.

TODO

  • Check the missing characters and add support for them too.

Blog post