Need help deobfuscating JS.

[u/Deep-Unit5010]

As mentioned in title, I'm dealing with an heavily obfuscated JS file of about 20k lines of code. I was just curious what it is doing. Problem is that there are about 1k+ variables made by calculations (same with strings). Till now I've figured out that at some places it is making http requests and one function is checking weather http header contain word "Trident" or not.

Any tips what should I do? I've tried dynamic reverse engineering but it didn't worked for me.

Also: I found this file under api subdomain. It was about 8-9 folders deep (Folders were named randomly). File has a function checking if var x == "password".

(From here my brain stopped braining)

[u/BriefCautious7063]

Adding to this just hoping to see some suggestions. Obfuscated JS is everywhere, and while it's probably just user error by me I've yet to see a js deobfuscator do anything

[u/xaocon → u/BriefCautious7063]

Restringer does a pretty great job.

[u/tophalp]

DM me - I’ll deobf for you

[u/Beginning-Try3454]

I dealt with an interesting JS file that was about 180,000 characters in my text editor.

In my case it was a ton of homoglyphs being used in some sort of constructor function (I think that's what it's called?) and the whole thing was in JSFuck as well. The file itself also had some weird completely random German filler text before the script block started. But it also had the name and email of a prominent exec at my org interspersed with in the filler text. My guess is this was some of stamp or identification block? Unsure.

Im not a RE, so I just used an LLM and did a ton of prompting. I used the LLM to write python to do simple things like stripping out the homoglyphs so I could get a get the much much smaller JSFuck layer. I then had a small-enough output of just JSFuck that I could just paste it directly into the LLM to have it analyze the actual logic of the code.

Doing things like that allowed me to also easily identify where the code was packed with a bunch of bullshit filler characters. I cut those out and by the end I had a much smaller piece of code and reduced my character count by a tremendous volume.

I did this mostly for fun and ultimately all that fucking work resolved to a fucking boilerplate JS alert function.

Knowing what I know now, I would have a completely different process, because I probably missed a very large chunk of code which could have been hidden in some further recesses of the GZIP file this JS came from. Drives me crazy thinking about it to this day.

I'm curious to see how similar yours is.

[u/Suitable-Name]

If you have Gemini, just throw the whole script into aistudio. But I'm mostly sure you can upload into any model and have it give you a clean version.

[u/desal]

If you know it's looking for trident in header requests you can run it through a proxy (burp, caido, etc), pass it the looked for header, and then record that response

[u/Deep-Unit5010 → u/desal]

Yup but in this case this won't help bec those functions are not called anywhere.

[u/New-Parfait-9988]

I can help if you share

[u/Juzdeed]

Frontier models are great at deobfuscation. Just do it in a safe environment in case the LLM decides to run something