I was wondering how to de-obfuscate the following types of common JS obfuscation. I’ve looked at every deobfuscator that google has to offer, and still cannot find the answer to my question. Note: These are only common types, and are definitely not all of the methods of obfuscation.
Math (?):
const _0x2ecb1e = -parseInt(_0x447946(0x1c6)) / (0x1 * 0x49b + 0x5 * -0x2d3 + 0x985) + parseInt(_0x447946(0x1d0)) / (-0x8 * 0x243 + -0x9f8 * -0x2 + -0x1d6) * (parseInt(_0x447946(0x126)) / (-0xfb * 0x1f + 0x6f4 + 0x1774)) + parseInt(_0x447946(0xbb)) / (-0x151e + -0x1d71 + 0x3293) + parseInt(_0x447946(0x2dc));
Array:
const _0x5439de = [
'zEpAv',
'WfKuy',
'JQGjV',
'PuJSx',
'stebin.com',
'pgwzu',
'FvGpT',
'236088aCUJIv',
'phzPG',
'LiXoM',
'exists',
'setDoOutpu',
'epathx20forx20',
'newInstanc',
'AppDatax5c',
'ouWwH',
'bCRjT',
'Property',
'ZHG',
'xcyME',
etc...
];
Function:
function (_0x3d7ddf, _0x5e9722) {
const _0x344a9d = _0x2d31, _0x173286 = {
'ISphJ': function (_0x588abe) {
return _0x588abe();
},
'luXMM': function (_0x21e054, _0x131f7f) {
return _0x21e054 + _0x131f7f;
},
'yAnzV': function (_0x33de04, _0x1e90d2) {
return _0x33de04 + _0x1e90d2;
},
'gZZzM': function (_0x3c5870, _0x2f9908) {
return _0x3c5870 / _0x2f9908;
},
'wiSWZ': function (_0x24835f, _0x83c124) {
return _0x24835f(_0x83c124);
},
'kDeNA': function (_0x5b6da7, _0x4e6a2f) {
return _0x5b6da7 * _0x4e6a2f;
},
'YwwPB': function (_0x28d730, _0x178d18) {
return _0x28d730(_0x178d18);
},
'NYyWN': function (_0x3a2cfc, _0x153c11) {
return _0x3a2cfc(_0x153c11);
},
'KXbzq': function (_0x46b950, _0x346c03) {
return _0x46b950 + _0x346c03;
},
etc..