String decoding
stringDecodingPuts the real text back into your code.
Obfuscators move every piece of text into one big lookup table, so "getElementById" arrives as something like _0x3f2a(0x1b). This finds that table and the function that reads from it, works out what each call returns, and writes the text back where it belongs. Once nothing refers to the table any more, the table is deleted too.
Text hidden in a lookup table
strings.inline ×3 strings.prune-decoders ×2
const _0x4f1a = ['https://api.example.com/v2/session', 'Session expired', 'POST'];
function _0x2b8d(_0x1c3e) {
return _0x4f1a[_0x1c3e - 0x0];
}
export function refresh(token) {
if (!token) {
throw new Error(_0x2b8d(0x1));
}
return fetch(_0x2b8d(0x0), {
method: _0x2b8d(0x2),
body: token
});
}export function refresh(token) {
if (!token) {
throw new Error('Session expired');
}
return fetch('https://api.example.com/v2/session', {
method: 'POST',
body: token
});
}Detectedstring-array-wrapperstring-array
How it worksshow
- Runs in
- strings
- On by preset
- conservative: enabledCONSbalanced: enabledBALaggressive: enabledAGGR
- Passes gated
- Tuning
- 3 options
StringDecodingOptionstiersEvaluatorTier[]Which methods may be used to replay a decoder, in the order they are tried. No preset includes sandbox: it runs code from the file you pasted, so you have to ask for it.
- CONS
- ['native', 'interpreter']
- BAL
- ['native', 'interpreter']
- AGGR
- ['native', 'interpreter']
maxDecodeCallsnumberHow many times the decoder may be called before the engine stops. Bounds a file that is broken or hostile rather than merely large.
- CONS
- 200000
- BAL
- 1000000
- AGGR
- no limit (Number.MAX_SAFE_INTEGER)
decodeDespiteStringCodebooleanPut the text back, and delete the table, even when the file builds code out of a string while it runs - eval, Function, a string handed to setTimeout. Code made that way can read the table, and can also change it, in which case the text written back is what the table held rather than what the program would have used. Off, those references are left encoded and the report names what stopped it.
- CONS
- false
- BAL
- false
- AGGR
- true
strings.discoverLocate string arrays and decoder functionsstringsstrings.inlineReplace decoder references with literalsstringsstrings.prune-decodersDelete decoder machinery once inlinedstringsstrings.merge-splitReassemble split string concatenationsstrings