Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Statistical De-minifier and De-obfuscator for JavaScript

jsnice.org

Post reply on HN
Print view View original

21–30 of 34 posts

Re: New Statistical De-minifier and De-obfuscator for JavaScript

#21

Post by enixn »

So, I saw this and wanted to see if it could decode output of something I saw earlier: http://patriciopalladino.com/files/hieroglyphy/

I took the source of a sample pasted here and ran it through the heiroglyphy generator:

var expect = function(val) { return "string" == typeof val; };

which output something along the lines of (truncated):

[][(![]+[])[!+[]+!![]+!![]]+([]+{})[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][([]+{})[!+[]+!![]+!![]+!![]+!![]]+([]+{})...

But JSNice was unable to deobfuscate this code. Any ideas why?

Re: New Statistical De-minifier and De-obfuscator for JavaScript

#22

Post by NaNaN »

enixn wrote: post #21

So, I saw this and wanted to see if it could decode output of something I saw earlier: http://patriciopalladino.com/files/hieroglyphy/ I took the source of a sample pasted here and ran it through the heiroglyphy generator: var expect = function(val) { return "string" == typeof val; }; which output something along the lines of (truncated): [][(![]+[])[!+[]+!![]+!![]]+([]+{})[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][([]…

This involves program optimizations. JSNice doesn't optimize `var x = 1+1` to `var x = 2`

Re: New Statistical De-minifier and De-obfuscator for JavaScript

#24

Post by geetee »

joliss wrote: post #3

About: http://www.srl.inf.ethz.ch/jsnice.php Apparently this is a machine learning research project. It seems that this would be quite useful for looking at the code of closed-source webapps. Would love to see it open-sourced or available as a service (via an API perhaps). Think auto-deminifying browser extension.

On average, more than 60% of the identifiers are recovered to the same name as before the minification process.

I wonder how much of that 60% comes from common libraries like jQuery or Underscore. Still, a neat project.

Re: New Statistical De-minifier and De-obfuscator for JavaScript

#25

Post by spicyj »

pajtai wrote: post #10

I took the code presented and put it into packer - http://dean.edwards.name/packer/ , and the "nice" output was not very helpful in that it still looked obfuscated. Maybe I'm misunderstanding something. So the input to js nice was the packed generateSeries function: eval(function(p,a,c,k,e,r){e=function(c) {return(c 35? String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/, String)){while(c--)r[e(c)]=k[c]||e(…

http://jsbeautifier.org/ has no problem deobfuscating that.

Re: New Statistical De-minifier and De-obfuscator for JavaScript

#26

Post by adrenalinup »

pajtai wrote: post #10

I took the code presented and put it into packer - http://dean.edwards.name/packer/ , and the "nice" output was not very helpful in that it still looked obfuscated. Maybe I'm misunderstanding something. So the input to js nice was the packed generateSeries function: eval(function(p,a,c,k,e,r){e=function(c) {return(c 35? String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/, String)){while(c--)r[e(c)]=k[c]||e(…

It's easy to depack even the packer's "Base 64 encode", just replace the eval function with a call to console.log for example, and you will have your original code.

Jsnice doesn't exceutes eval as it's doing statical analysis ie. without executing the programs.

Re: New Statistical De-minifier and De-obfuscator for JavaScript

#28

Post by veselin »

geetee wrote: post #24
joliss wrote: post #3

About: http://www.srl.inf.ethz.ch/jsnice.php Apparently this is a machine learning research project. It seems that this would be quite useful for looking at the code of closed-source webapps. Would love to see it open-sourced or available as a service (via an API perhaps). Think auto-deminifying browser extension.

On average, more than 60% of the identifiers are recovered to the same name as before the minification process. I wonder how much of that 60% comes from common libraries like jQuery or Underscore. Still, a neat project.

We tried to evaluate on data that is as much as possible independent from the training data. So we evaluate on projects outside of github.

Re: New Statistical De-minifier and De-obfuscator for JavaScript

#29

Post by FiloSottile »

pajtai wrote: post #10

I took the code presented and put it into packer - http://dean.edwards.name/packer/ , and the "nice" output was not very helpful in that it still looked obfuscated. Maybe I'm misunderstanding something. So the input to js nice was the packed generateSeries function: eval(function(p,a,c,k,e,r){e=function(c) {return(c 35? String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/, String)){while(c--)r[e(c)]=k[c]||e(…

The various jsBeautifiers special-case the eval() obfuscations, and in particular packer.

I think the scope of this tool is to annotate and de-uglify js code without changing the logic, so you get a more readable version of the routine that generates the eval()'d code, that sounds right to me.

EDIT: btw, can you please put the code in a code box, it messes with the layout. Mods: this is happening frequently, is it a bug?

Post reply on HN