JavaScript array deobfuscation

Question

Solved: Replace array-mapped variables with the actual variable name/string?

I'm trying to decode some JS and I've got a good portion of it done, however, I'm stumped here. The code does something like this:

var arr = ["value", "value1", "value2"];
console.log(arr[0]);

Except the file is around 12k lines and there are over 1.4k things in the array. Is there a way I can replace arr[0] with the actual value of arr[0] (in the example, it would be "value"), then save the file? I tried using RegExp but got nowhere.

Any help will be appreciated.

Did you write to write the output into a file? `node script.js > myfile.txt` — Yangshun Tay, Apr 28 '17 at 05:43
@Rahul I tried to iterate through it and then replace the array and value with the actual one but I just couldn't work the logic out. — Eli Richardson, Apr 28 '17 at 05:50
@EliR: Please add that in your post along with code if possible. — Rahul, Apr 28 '17 at 05:51
Your question is unclear. What is the nature of your file (share a small sample)? What output are you looking for from it? — gurvinder372, Apr 28 '17 at 05:55
@gurvinder372 I can't post a snippet right now, but the file is JS code. I'm trying to replace the array name and index (ex: arr[0]), with the actual value of it (ex: "value"). — Eli Richardson, Apr 28 '17 at 05:59
Though many details are missing. I don't think it's a good idea to just search for `arr[0]` and replace with `value`. — Rahul, Apr 28 '17 at 06:00
I think it is better to simply let the method load as-is and then override that method with yours after it has been loaded. — gurvinder372, Apr 28 '17 at 06:01
@Rahul Yes. Just one array. It has been obfuscated. I've fixed most of it, but having this array thing fixed would make it much more readable. — Eli Richardson, Apr 28 '17 at 06:02
@gurvinder372 I could try that, it's just very difficult to read with the array because I have to keep checking to see what the value is. — Eli Richardson, Apr 28 '17 at 06:04
Do you only need to replace `0` index with its corresponding value? — revo, Apr 28 '17 at 06:06
So for example there would be `arr[254]` in file which you want to replace as well? — revo, Apr 28 '17 at 06:08
@revo Yes. I don't think they are in perfect order, and some are used more than once. — Eli Richardson, Apr 28 '17 at 06:09

revo · Accepted Answer · 2017-04-28T09:21:54.183

1

A simple idea would be having arrays in current scope and use target javascript file content as input string for replace() method:

var arr = ['hello', 'my', 'world']
var str = `
var arr = ['hello', 'my', 'world']
console.log('arr[2]')
console.log('arr[0]')
console.log('arr[1]')
`
console.log(str.replace(/\b(\w+)\[(\d+)]/g, function(match, $p1, $p2) {
   return window[$p1][$p2];
}))

edited Apr 28 '17 at 09:21

answered Apr 28 '17 at 06:45

revo

47,783
14
74
117

JavaScript array deobfuscation

1 Answers1