Last active
May 8, 2021 09:27
-
-
Save LasseSkogland/375945009a3a13a941516dead6b26483 to your computer and use it in GitHub Desktop.
Javascript Deobfuscator - Online Version: https://rawgit.com/LasseSkogland/375945009a3a13a941516dead6b26483/raw/67ccb6fcde3e42e42412d96998d855242825f3f0/JS-Deobfuscate.html Original Script: http://output.jsbin.com/hazevo/1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<!DOCTYPE html> | |
<meta name="robots" content="noindex"> | |
<html><head> | |
<title>Obfuscated name remapper</title> | |
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> | |
<style type="text/css"> | |
body { | |
background: white; | |
color: black; | |
font-family: "Trebuchet MS",Helvetica,Tahoma,Arial,sans-serif; | |
font-size: 90.01%; | |
font-weight: normal; | |
line-height: 150%; | |
min-width: 680px; | |
padding: 0 3em; | |
text-align: left; | |
} | |
h1, h2, h3 { | |
line-height: 125%; | |
margin-bottom: 0.9em; | |
} | |
h1 { | |
font-size: 1.2em; | |
} | |
em { | |
white-space: nowrap; | |
} | |
.taContnr > label:after { | |
content:"\a"; | |
white-space: pre; | |
} | |
textarea { | |
width: 80%; | |
height: 30vh; | |
white-space: pre; | |
word-wrap: normal; | |
overflow-x: scroll; | |
} | |
#errDisplay { | |
background: pink; | |
border: 3px solid darkred; | |
border-radius: 0.5ex; | |
margin: 0 1em; | |
padding: 0.5ex 1em; | |
display: none; | |
} | |
#errDisplay > pre { | |
white-space: pre-line; | |
} | |
</style> | |
</head><body> | |
<h1>use <a href="http://jsnice.org/">jsnice.org<a/> to cleanup code (Options: Rename local=true, Infer types=false, Pretty=true). | |
</h1> | |
<h2 id="errDisplay">Error message goes here</h2> | |
<p class="taContnr"> | |
<label for="inpTxt">Paste jsBeautified code here:</label> | |
<textarea id="inpTxt"></textarea> | |
</p> | |
<button id="remapBtn">Attempt Remap</button> | |
<p class="taContnr"> | |
<label for="rezTxt">Remapped code:</label> | |
<textarea id="rezTxt"></textarea> | |
</p> | |
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/2.1.0/jquery.min.js"></script> | |
<script type="text/javascript"> | |
$(document).ready (jQueryMain); | |
function jQueryMain () { | |
$("#remapBtn").click ( function () { | |
$("#errDisplay").hide (); | |
var beautySrcRaw = $("#inpTxt").val ().trim (); | |
var J = 0, LGI = 0; | |
var btyExArry; | |
var beautySrc = ""; | |
var btyLineRegEx = /(.+), *\n/g; | |
while (btyExArry = btyLineRegEx.exec (beautySrcRaw) ) { | |
if (btyExArry.index != LGI) | |
break; | |
beautySrc += btyExArry[1] + ', '; | |
LGI = btyLineRegEx.lastIndex; | |
} | |
beautySrc += beautySrcRaw.slice (LGI); | |
var keyArryEgEx = /^(?:var)?\s*([_\w]+)\s*=\s*(\[.+?\]);?\s*$/gm; | |
var keyArrayMtch = keyArryEgEx.exec (beautySrc); | |
if ( ! keyArrayMtch) { | |
reportError ( | |
'Unexpected format. Require key array to be up top. EG:' + | |
'<pre>var _0xf17f = ["(", ")", "div", ...]</pre>' | |
); | |
return; | |
} | |
var keyVarName = keyArrayMtch[1]; | |
var keyArry; | |
try { | |
keyArry = eval (keyArrayMtch[2]); | |
var loopRegex = new RegExp ('\\}\\)\\(' + keyVarName + ', ([0123456789]+)\\)\\;'); | |
var loopNum = loopRegex.exec(beautySrc); | |
var i = (loopNum[1] - 0) + 1; | |
for(;--i;) | |
keyArry.push(keyArry.shift()); | |
} | |
catch (err) { | |
reportError ( | |
err.message + '\nReference:\n' + | |
'<pre>' + keyArrayMtch[2].replace (/[^\.\?^\w()\[\]+,;\"\'\\\/\s-]/g, "@") + '</pre>' | |
); | |
return; | |
} | |
if ( ! Array.isArray (keyArry) ) { | |
reportError ( | |
'Not an array:' + | |
'<pre>' + keyArrayMtch[2].replace (/[^\.\?^\w()\[\]+,;\"\'\\\/\s-]/g, "@") + '</pre>' | |
); | |
return; | |
} | |
beautySrc = beautySrc.slice (keyArryEgEx.lastIndex).trim (); | |
var funcRegex = new RegExp ('var ([_0123456789abcdefx]+) = function\\(timeoutKey, dataAndEvents\\)', 'g'); | |
var funcName = funcRegex.exec(beautySrc); | |
var nameRegex = new RegExp (funcName[1] + '\\s*\\(\s*\\"([0123456789abcdefx]+)\\"\\s*\\)', 'g'); | |
replacedSrc = beautySrc.replace (nameRegex, function (matchStr, p1Str) { | |
return '"' + keyArry[ parseInt (p1Str, 16) ] + '"'; | |
} ); | |
$("#rezTxt").text (replacedSrc); | |
} ); | |
} | |
function reportError (errHTML) { | |
$("#errDisplay").show ().html (errHTML); | |
} | |
</script> | |
</body></html> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment