Impact
Recovered execution intent from packed and minified scripts.
Impact
Mapped source-to-sink paths across browser APIs and network calls.
Impact
Produced reviewable findings with confidence scoring and evidence trails.
Deliverables
- AST transform workflow
- Behavior graph and sink map
- Technical findings report
Technical Overview
Obfuscated scripts hide behavior behind string tables, control-flow wrappers, dynamic property access, and runtime evaluation. The project needed a repeatable way to recover intent without relying on manual beautification alone.
Architecture
flowchart LR
input_js[Packed JavaScript] --> ast_parse[Parse to AST]
ast_parse --> string_decode[Decode strings]
ast_parse --> flow_unwrap[Unwrap control flow]
string_decode --> behavior_map[Behavior map]
flow_unwrap --> behavior_map
input_js --> runtime_trace[Runtime trace]
runtime_trace --> behavior_map
behavior_map --> final_report[Evidence report]
Model
where R is finding priority, C is confidence, W is sink severity, and F is the false-positive cost for a path p.
Implementation Sketch
for (const pass of transformPasses) {
ast = pass.apply(ast);
evidence.merge(pass.evidence);
}
for (const sink of ['fetch', 'XMLHttpRequest', 'eval', 'localStorage']) {
behaviorGraph.tagSinks(findCalls(ast, sink));
}Engineering Approach
- Parse and normalize the source into an AST before applying deobfuscation passes.
- Recover string tables, inline wrapper functions, and tag high-risk browser APIs.
- Validate static findings against runtime traces so reports distinguish suspected behavior from observed behavior.
Results
- Converted opaque scripts into named behaviors such as credential access, redirect logic, fingerprinting, and outbound request construction.
- Reduced ambiguous findings by separating AST-only hypotheses from runtime-confirmed paths.
- Created a workflow that scales from one-off script reviews to repeated malware and web-security triage.
What This Demonstrates
- Good reverse engineering preserves intermediate evidence so each conclusion can be audited.
- AST-level transforms are more reliable than regex-based cleanup for obfuscated JavaScript.
- Runtime traces are essential when code generation or environment checks alter execution paths.