reversing-obfuscated-javascript

Reversing Obfuscated JavaScript

Client-side JavaScript ships the whole program to the reader — there is no stripped binary here, only code deliberately made unreadable. That changes the job: you are almost never recovering missing information, you are undoing a transformation. Identify the transformation first, reverse it with the tool built for it, and fall back to hand-written AST passes only for the custom layer no off-the-shelf tool knows.

When to Use

• A page or extension ships a large minified/bundled .js you need to read
• Code is full of _0x1234 identifiers, a big string array, and a rotation IIFE at the top — the obfuscator.io signature
• A .js.map sourcemap is reachable, or webpack left //# sourceMappingURL
• You must locate where a request signature, HMAC, token, or crypto key is computed inside a running bundle
• Reproducing a client-side algorithm (an anti-bot signal, a licence check, a paywall gate) from the shipped code

When NOT to Use

• React Native / Hermes mobile bundles (index.android.bundle, main.jsbundle, Hermes magic bytes) — use reversing-react-native-apps.
• A custom bytecode VM or virtualized-JS obfuscator where control flow is interpreted, not just flattened — that is devirtualization; use unpacking-protected-binaries for the VM-lifting approach.
• Malicious JS in a compromised site or npm package where the goal is IOCs and behaviour, not readability — use hunting-web-backdoors for planted web payloads and auditing-supply-chain for a malicious package.
• Testing the web app itself (the endpoints the JS calls, XSS, auth) — use testing-web-applications; come back here only to recover a client-side algorithm it needs.
• WASM modules loaded by the page — that is analyzing-binaries territory.

Identify the Layer Before Touching a Tool

Running the wrong deobfuscator produces plausible garbage. Read the first few hundred bytes and classify:

What you see	Transformation	Reverse it with
Short names, no whitespace, readable strings	Minification only	An unminifier / prettier + rename
webpackChunk, a module map {123: function(e,t,n){…}}	Webpack/Rollup bundling	Unbundle to per-module files
//# sourceMappingURL=… or a reachable .map	Nothing — the source is right there	Sourcemap recovery
_0x hex names + one big string array + a rotation IIFE	obfuscator.io string-array	webcrack / synchrony / restringer
Nested ternaries, while(true){switch(_0x..)} dispatcher	Control-flow flattening	AST pass to relink the switch
debugger in a setInterval, self-defending function	Anti-debug / self-defense	Strip the guard before other passes