Learning resource
Supplementary AST-Based Deobfuscation Materials
Companion code for the ReverseJS blog's 2022 series on deobfuscating JavaScript by manipulating abstract syntax trees with Babel. Each folder pairs a small obfuscated sample with a deobfuscator script and its output, covering string concealing (escape sequences, concatenation, string arrays and string encryption), constant folding including JSFuck-style code, substitution of constant variables, bracket-to-dot property access, dead-code removal, proxy functions and sequence expressions. The README presents them as short learning examples rather than a production deobfuscator.
- Targets
- Website
- Category
- Learning resources
- Relationship
- Learning resource
- Sources reviewed
Requirements & limits
- Reviewed at the 2023-10-20 master commit, whose last change bumped @babel/traverse to 7.23.2. The blog lists seven posts in the series from May and June 2022, and folders such as Proxy Functions and Sequence Expressions have no matching post; the README warns that code not published on the blog is outdated and experimental, may be inaccurate or buggy, will likely not be updated and should not be used in a production deobfuscator.
- Needs Node.js and npm install: package.json declares @babel/core and js-beautify, and the lockfile resolves @babel/parser, @babel/traverse and @babel/generator 7.23.x. Each script is run with node from its folder against the bundled sample. The String Encryption example also imports chrome-remote-interface-extra, which package.json does not list.
- The samples are short, author-written obfuscations, so applying the techniques to other code needs the analyst's own inputs and checking. The VM-evaluation proxy-function example and the String Encryption example run code from the sample through Node's vm module, which Node.js documents as not a security mechanism. The author's later blog post reports CVE-2023-45133, an arbitrary-code-execution flaw in @babel/traverse before 7.23.2; the reviewed lockfile already resolves 7.23.2.
- There are no tests or CI (the npm test script is a placeholder); expected outputs are committed beside each sample.
- MIT (LICENSE), although package.json keeps npm's default ISC field.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials · Revision 3709295
- package.json GitHub · SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials · Revision 3709295
- package-lock.json GitHub · SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials · Revision 3709295
- String%20Concealing GitHub · SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials · Revision 3709295
- Proxy%20Functions GitHub · SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials · Revision 3709295
- String%20Concealing/String%20Encryption/deobber.js GitHub · SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials · Revision 3709295
- LICENSE GitHub · SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials · Revision 3709295
- https://steakenthusiast.github.io/2022/05/21/Deobfuscating-Javascript-via-AST-An-Introduction-to-Babel/
- https://steakenthusiast.github.io/2023/10/11/CVE-2023-45133-Finding-an-Arbitrary-Code-Execution-Vulnerability-In-Babel/
- https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92
- https://nodejs.org/api/vm.html
More in References and learning
- MCP Reversing Dataset (mrexodia) · Learning resource
- ICSim (Instrument Cluster Simulator) · Learning resource
- CNNPRE (IEEE Access 2023) · Research
- RPISEC Malware Analysis course (CSCI 4976) · Learning resource
- Corkami pics · Learning resource
- Practical Malware Analysis · Learning resource