Simplest way to "unpack" obfuscated javascript from within a Java program

815 views Asked by At

Let's say that you have a web page that only contains obfuscated Javascript in the form of an eval(...) function within a script tag.

Dean Edwards' online unpacker (link) correctly unpacks this Javascript.

I would like to write a simple Java class that loads the initial web page (I use HttpClient), extracts the eval(...) function from the HTML, and unpacks it, in order to obtain the de-obfuscated Javascript.

I've tried with Rhino, here's my code :

int start = html.indexOf("<script>eval") + "<script>".length();
int end = html.indexOf("</script>");
javascript = html.substring(start, end);
evaled = eval(javascript);
NativeFunction fEvaled = (NativeFunction) evaled;
String encodedSource = fEvaled.getEncodedSource();
log.info("encodedSource: " + encodedSource);

and the "eval" java function called:

private Object eval(String javascript){
    ScriptEngineManager factory = new ScriptEngineManager();
    ScriptEngine engine = factory.getEngineByName("JavaScript");
    Object eval = null;
    try {
        eval = engine.eval(javascript);
    } catch (ScriptException e) {
        // TODO Auto-generated catch block
        log.error("Exception evaluating javascript " + javascript, e);
    }
    return eval;
}

But, that doesn't work, the code returned is far from being the correct code (returned by Edwards' unpacker). I've inspected the Rhino variables, found nothing useful.

Am I doing something wrong ?

I'm open to any suggestion, for example if there's a command-line tool that will work I can make a system call.

I'm on Ubuntu.

Thanks.

0

There are 0 answers