JS Deobfuscator VM

A specialized Node.js utility for deobfuscating JavaScript bundles (like those packed with obfuscator.io or similar string-array obfuscators) by executing the decryption routines safely inside an isolated Node.js vm context.

Overview

Modern JavaScript obfuscators often hide sensitive strings (API endpoints, keys, logic markers) by placing them into a shuffled string array and accessing them via a decoder function. Static analysis of these files is notoriously difficult because the string array is often shifted dynamically at runtime.

This tool bypasses the need for static analysis by:

1. Extracting the string array and the decoder function from the target file.
2. Wrapping them in an isolated Node.js vm context to safely execute the initial array shuffling.
3. Exposing the decoder function so you can dynamically query it for decrypted strings.

Usage

const fs = require('fs');
const vm = require('vm');

// 1. Load the obfuscated bundle
const wallData = fs.readFileSync('wall_bundle.js', 'utf8');

// 2. Extract the string array and decoder function using string manipulation or regex
// (See decode_wall.js for an exact implementation tailored to a specific bundle)
// ...

// 3. Create a safe VM context
const context = vm.createContext({
    parseInt: parseInt,
    String: String,
    decodeURIComponent: decodeURIComponent
});

// 4. Execute the extracted logic in the VM
const decrypt = vm.runInContext(wrappedCode, context);

// 5. Query the decoder function to extract strings
console.log("vote_url:", decrypt(0xa21, 'A3Ms'));

Security Warning

Running arbitrary code from an obfuscated payload can be dangerous. This tool uses Node.js vm module to mitigate risks by isolating the execution context. Do not pass the global object or sensitive environment variables into the VM context.