Search code examples
javascriptobfuscationdeobfuscation

How does the browser decode these obfuscated class names?


This javascript file appears to have been obfuscated and the class names are not human readable, looking like lt$nkqmr. However when a browser runs the javascript, for example here or here, the browser apparently decodes the class names as the console can auto-complete class names such as lt.ImageLoader. How does the browser decode these obfuscated class names and how can I do the same?


Solution

  • TL;DR: No, generally it isn't possible.


    If you inspect the source of the linked page, you can see that the lt.ImageLoader function is defined as follows:

    lt[lt$tyopy(0x3ca)] = function() { /* function body */ }
    

    As you can see, its name is the result of evaluating lt$tyopy(0x3ca).

    The lt$tyopy function, after executing a massive amount of function calls and other unreadable code, returns the string 'ImageLoader', hence the name of the function.

    But if you inspect lt.ImageGroupLoader, for example, you'll notice that its name is generated by the function lt$sarzm, in a similar, but different way.

    And, those functions are designed to reconstruct the name of the "public" functions only and are created by the authors of the page.

    And we are still talking about a single site: other sites with other obfuscation algorithms might use completely different ways to reconstruct public names.


    So, unless you created the obfuscated code and left a way to do so, there's no way to reconstruct names which are obfuscated.