obfuscator-io-deobfuscator: Make Obfuscated JavaScript Easier to Read

Overview

obfuscator-io-deobfuscator processes JavaScript obfuscated by Obfuscator.io and attempts to restore more readable code. It targets transformations such as encoded strings, proxy functions, and control-flow flattening, which can make scripts difficult to review or investigate.

It is available as an online tool and as a command-line application. Its README says it handles most Obfuscator.io forks and does not run the supplied code, making it useful for static inspection rather than execution or general-purpose JavaScript formatting.

Key Features

• Recovers strings from obfuscated scripts.
• Removes proxy functions and simplifies objects.
• Simplifies arithmetic expressions and string concatenation.
• Removes dead code.
• Reverses control-flow flattening.
• Detects configuration automatically.
• Processes input without executing it.
• Supports most Obfuscator.io forks, according to the project README.

Use Cases

• Developers can inspect a script that their team needs to understand but received in obfuscated form.
• Security researchers can statically examine suspicious JavaScript without running the submitted code through this tool.
• Incident responders can try to clarify Obfuscator.io-obfuscated scripts during an investigation.
• Analysts can use the online version for occasional files, or the CLI when incorporating the tool into a local review workflow.

Getting Started

Install the CLI globally with npm:

npm install -g obfuscator-io-deobfuscator

Run obfuscator-io-deobfuscator <input> -o [output]. For more usage details, see the README. The online version is also available.

Considerations

The tool is aimed specifically at Obfuscator.io-style JavaScript, not arbitrary obfuscation schemes. The README describes support for most forks, which does not guarantee successful recovery for every input. Its safety claim is that it does not execute supplied code; the result should still be reviewed before use, and deobfuscation does not establish that a script is safe.