question

arissearisse-9155 avatar image
0 Votes"
arissearisse-9155 asked Bruce-SqlWork answered

deobfuscation in asp.net

how can i remove obfuscated javascript from code like this https://www.seosniffer.com tool. i want only to be using c# (console application .net framework) not javascript

dotnet-csharpdotnet-aspnet-general
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Bruce-SqlWork avatar image
0 Votes"
Bruce-SqlWork answered arissearisse-9155 commented

Most of the JavaScript deobfuscaters are written in JavaScript. You could port one of the open source ones to C#. Or just use node to get a command line version

https://github.com/lelinhtinh/de4js
https://github.com/ben-sb/javascript-deobfuscator

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

i hate javascript. you cant work on something you hate ... sorry to say that

0 Votes 0 ·
karenpayneoregon avatar image
0 Votes"
karenpayneoregon answered

If there is no copy protection, look at Jet Brains dotPeek.


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

arissearisse-9155 avatar image
0 Votes"
arissearisse-9155 answered LanHuang-MSFT commented

@karenpayneoregon thank you but i want a c# code on how to deobfuscate javascript in a console application like the site above

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @arissearisse-9155,
Maybe you can try a Javascript to C# converter.
https://files.m2h.nl/js_to_c.php
Best regards,
Lan Huang

0 Votes 0 ·
arissearisse-9155 avatar image
0 Votes"
arissearisse-9155 answered

this deobfuscator https://www.seosniffer.com/javascript-deobfuscator is not bad.
is it possible to parse javascript and deobfuscate it using c#. the problem is im only good at c# and i want to biuld a deobfuscator using only c#

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

arissearisse-9155 avatar image
0 Votes"
arissearisse-9155 answered
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Bruce-SqlWork avatar image
0 Votes"
Bruce-SqlWork answered

your sample C# app is a pretty simple implementation, just a regex to handle a common obfuscation of string values.

This javascript version details some of the issues not handled:

https://github.com/ben-sb/javascript-deobfuscator

a real deobfuscator like the sample javascript one is more complex.: when writing a deobfuscator, typically you:

parse the obfuscated javascript into an abstract syntax tree (AST).
once the AST is built you can perform transformations on the AST to deobfuscate known obfuscation patterns
write the transformed AST back to javascript source.


the javascript world has a standardized AST format used by javascript language parsers. this allow a large library AST transformations.

https://github.com/estree/estree

there is a C# port of this code, which is used the asp.net web optimization tools:

https://github.com/sebastienros/esprima-dotnet

note: if you are not familiar with AST's, they are common in language parsing. in C#, lambada expression trees (used by MVC binding, EF and Line to Sql libraries, etc) are a form of an AST. But for .net language parsing the roselyn AST is typically used.

https://docs.microsoft.com/en-us/dotnet/csharp/roslyn-sdk/get-started/syntax-analysis



5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.