js-string-decode

JavaScript Constant-Key String Decoder

Statically recover strings that JavaScript hides with a constant-key XOR / charCode scheme, and write them out as plaintext so a downstream scanner can read them. Pure-Python stdlib, read-only — it never runs a JS engine or executes any part of the input.

When to use

A file (often a carved single-file-executable bundle) keeps its telltale strings — C2 URLs, victim domains, timezone names like Asia/Shanghai, shell commands — out of a plain strings dump by XORing each character with a constant byte and reassembling them with String.fromCharCode. js-covert-scan flags that an XOR / charCode tactic is present; this skill decodes it, statically, and hands the plaintext back for rescanning.

It is the zero-execution complement to js-deobfuscate (which recovers encoded string arrays by running the decoder inside a sandbox). Reach for this one when the scheme is the constant-key case and you want no execution at all.

What it does

python3 scripts/decode.py <input.js> [outdir]:

1. Scan the JS with regex/heuristics (no JS engine, no execution). It finds constant-key XOR/charCode decode sites: a String.fromCharCode(<x> ^ <KEY>) or <c> ^ <KEY> applied over a static encoded literal.
2. Resolve <KEY> when it is a small int literal (0x91, 145) or a variable assigned a small int nearby (var kk5=91) — best-effort constant propagation by nearest-preceding assignment (so reused minified names resolve to the right scope).
3. Decode each site (apply the XOR to the encoded data → plaintext).
4. Write the recovered strings to <outdir>/decoded-strings.js:

   // decoded from <input>
   /* key=91 base64/fn:c57 off=4835057 */ "cn,sankuai.com,netease.com,163.com,…"
   

   one per line as JS string literals, so the fold rescans it as source and sees the plaintext URLs / hostnames / commands.
5. Emit JSON to stdout (the default — no flag needed):

   {"ok": true, "outputDir": "<abs>", "decoded": [{"key": 91, "count": 2,
     "sample": "cn,sankuai.com,…"}], "siteCount": 2}
   

   Nothing to decode → {"ok": true, "outputDir": "<abs>", "decoded": [], "siteCount": 0}. Bad input → {"ok": false, "error": "…"} and a non-zero exit.