Awesome JavaScript Deobfuscation

Tools, techniques and references for reading obfuscated, packed and minified JavaScript, from malware triage to understanding a third-party bundle.

The most important property of any tool here is whether it runs the code it analyses. Running a skimmer or loader to recover its strings is sometimes the only way through, but it is a decision you should make on purpose, not discover afterwards. Entries that execute sample code are marked ⚠️.

Maintained by Defuscator, whose own tools are listed alongside everyone else's. Entries are grouped, not ranked. Corrections and additions are welcome, see CONTRIBUTING.

Contents

• Deobfuscators
• Decompilers and unbundlers
• AI-assisted
• Malware sandboxes
• Beautifiers and formatters
• Name recovery
• Parsers and AST toolkits
• Obfuscators
• Benchmarks
• Techniques

Deobfuscators

• Defuscator - Static deobfuscation and risk triage for obfuscator.io string arrays, P.A.C.K.E.R., encoded strings and source maps, with IOC extraction and SARIF output. Web app, API, CLI, GitHub Action and VS Code extension. Never executes the sample.
• webcrack - Deobfuscates obfuscator.io output, unminifies, and unpacks webpack/browserify bundles. ⚠️ Evaluates string-array decoders in an isolated VM.
• synchrony - Cleaner and deobfuscator focused on javascript-obfuscator output.
• REstringer - Modular deobfuscator with safe AST transforms plus ⚠️ optional modules that evaluate code in an isolated VM.
• javascript-deobfuscator - General-purpose deobfuscator covering common array, proxy and string transforms.
• js-deobfuscator - Automated deobfuscation built on the Babel AST, with an online playground.
• JStillery - Deobfuscation through partial evaluation. Unmaintained since 2019.
• de4js - Browser-based unpacker for legacy packers, JSFuck, JJEncode and AAEncode. Archived.

Decompilers and unbundlers

• wakaru - Decompiler for modern frontend output: unpacks bundles and reverses transpiler and minifier transforms.

AI-assisted

• humanify - Uses a language model to rename identifiers and make deobfuscated code readable. Check its output against the input; names are suggestions, not recovered facts.

Malware sandboxes

Use these when static analysis runs out, in a disposable environment.

• box-js - ⚠️ Emulated environment for studying JavaScript malware, logging URLs, files and payloads it touches.
• malware-jail - ⚠️ Sandbox for semi-automatic JavaScript malware analysis, deobfuscation and payload extraction.

Beautifiers and formatters

Formatting is not deobfuscation, but it is usually the first step.

• js-beautify - Long-standing beautifier with a P.A.C.K.E.R. unpacker option.
• Prettier - Opinionated formatter; reliable for reformatting code that already parses.

Name recovery

• UnuglifyJS - Open-source version of JSNice, predicting identifier names from a statistical model.

Parsers and AST toolkits

For writing your own transforms.

• Babel - Parser, traversal and generator; the base of most AST-based deobfuscators.
• Acorn - Small, fast, spec-compliant JavaScript parser.

Obfuscators

Knowing the transforms is most of reversing them.

• javascript-obfuscator - The engine behind obfuscator.io: string arrays with rotation and encoding, control-flow flattening, self-defending code.
• JSFuck - Encodes any program using six characters: []()!+.
• JS-Confuser - Obfuscator with control-flow, string and lock transforms.
• JavaScript Obfuscator - Commercial obfuscator from the team behind Defuscator.

Benchmarks

• deobfuscation-benchmark - Scores a deobfuscator against samples generated by the real obfuscators, checking correctness by executing the decoded output. Tool-agnostic: point it at any CLI that emits JSON.

Techniques

Guides that explain a technique rather than sell a tool.

• Unpacking Dean Edwards P.A.C.K.E.R. without eval - How the packer's base62 dictionary works and how to regenerate the source statically.
• obfuscator.io string arrays - Rotation, encoding and offset decoders, and why a table one position out still looks correct.
• Hex and unicode escapes - Decoding escape layers without changing what the code means.
• Recovering sources from source maps - Inline and external maps, and when sourcesContent gives you the original.

License

To the extent possible under law, the contributors have waived all copyright and related rights to this list.