Re: [directory-discuss] JS deobfuscator needed ASAP

[Greg Rundlett (freephile)]

On Tue, Mar 29, 2016 at 3:15 PM, Joshua Gay <address@hidden> wrote:

On 03/29/2016 03:04 PM, Greg Rundlett (freephile) wrote:
> On Mon, Mar 28, 2016 at 11:58 PM, David Hedlund <address@hidden
> <mailto:address@hidden>> wrote:
>
>     Is there any package for GNU/Linux to deobfuscate JS code?
>
>
> The top hit on Google in .61 seconds
>
> http://jsbeautifier.org/ (MIT license), available online or in dozens of
> editors like emacs https://github.com/yasuyk/web-beautify (GPL license)
>
> You can make obfuscated and minified _javascript_ look better/more
> readable.  But nothing in going to replace
>
>     var a
> with
>     var apple
>
> to make it more intelligible.

Well there are programs that try to give more intelligible names to
variables and whatnot. I don't know of any free programs that do this.

Interesting.  I wonder how they do that?  Do you have a product example?

Regarding _javascript_, I found this thread which lists many resources: https://reverseengineering.stackexchange.com/questions/4561/how-to-deobfuscate-an-obfuscated-_javascript_-file-like-this

I was interested in the subject and found that there is this GPL deobfuscator for .NET code http://de4dot.com/

and this walkthrough example of using Python to deobfuscate Office macro malware https://www.trustwave.com/Resources/SpiderLabs-Blog/Deobfuscating-Malicious-Macros-Using-Python/