indexzero

Deobfuscating / Unminifying Obfuscated Web App / JavaScript Code

Some notes and tools for reverse engineering / deobfuscating / unminifying obfuscated web app code.

Table of Contents

• tl;dr: AKA: devalias's shortlist
• PoC
• Benchmarks / Leaderboards / etc

indexzero

# Workflow Orchestration

## 1. Plan Mode Default
- Enter plan mode for ANY non-trivial task (3+ steps or architectural decisions)
- If something goes sideways, STOP and re-plan immediately — don’t keep pushing
- Use plan mode for verification steps, not just building
- Write detailed specs upfront to reduce ambiguity

## 2. Subagent Strategy
- Use subagents liberally to keep main context window clean

indexzero

How Rspack Downloads the Correct Binary for Each Platform

Rspack uses npm's optional dependencies feature combined with platform filtering to ensure users only download the binary for their specific OS and architecture.

The Mechanism: Optional Dependencies + Platform Filtering

1. Optional Dependencies in @rspack/binding

The main @rspack/binding package (crates/node_binding/package.json) declares all platform-specific packages as optionalDependencies:

indexzero

Proxies: From Pariah to Performant

claude cosplaying as the V8-team speaking at JSConf

---

The Proxy Problem

When ES6 Proxies shipped in 2015, they came with an asterisk. The spec gave us something genuinely powerful—metaprogramming primitives that could intercept fundamental object operations—but the performance story was grim. Internal benchmarks showed property access through a Proxy running 50-100x slower than direct access. We told developers "use sparingly" and hoped for the best.

indexzero

Principles of Note

A list of select principles that have been particularly useful in helping design, refine, and debug complex systems (both computer & human)

Conway's Law

Any organization that designs a system (defined broadly) will produce a design hose structure is a copy of the organization's communication structure.

indexzero

GitHub Discussion Thread Extractor

A Chrome DevTools script to extract structured comment data from GitHub discussion threads.

Usage

1. Navigate to a GitHub discussion page
2. Open Chrome DevTools Console (Cmd+Option+J on Mac, Ctrl+Shift+J on Windows)
3. Paste the extraction script
4. Run it to get JSON structured data

indexzero

Copyright (c) 4-digit year, Company or Person's Name

Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

Source: http://opensource.org/licenses/ISC

indexzero

How does npm init work anyway?

A question on the OpenJS Foundation Slack made me wonder about this enough to go down the rabbit hole

We must go deeper, yes?

npm config references a init-module which is a path to a JS file that is passed to init-package-json which in turn passes it to promzard which uses the raw Module pattern to load the contents of the file into node/v8

indexzero

let items = [];
for (var hour = 0; hour < 24; hour++) {
  items.push([hour, 0]);
  items.push([hour, 30]);
}

const date = new Date();
const formatter = new Intl.DateTimeFormat('en-US', {
  hour: 'numeric',
  minute: 'numeric',

indexzero

var fs = require('fs'),
    path = require('path');
    Connection = require('ssh2');


var tunnelHost = process.argv[2],
    dest = process.argv[3],
    keyfile = process.argv[4];

var conn = new Connection();