webcrack

Deobfuscate

• Fix: Don't inline objects into function etc
• Fix: Avoid false positives when detecting read-only object accesses
• Fix: inline function call with too few args (#139)

Unpack Bundle

• Fix error when output directory has a trailing slash (#141)

Playground

• Download zip (#130)
• Add setting for word wrap and sticky scroll

General

• CommonJS support: now require("webcrack") also works without errors

Deobfuscate

• Evaluate atob, unescape, decodeURI and decodeURIComponent calls (#53)
• Inline variable with multiple assignments (#121)
• Log original string array name, length and decoder function names:
• Detect arrow-function iife (#127)
• Fixed a bug where inlining string arrays and merging strings could mess them up
• Fixed a bug where not all decoder aliases were detected (#119)

Playground

• Open file from URL:
• Show syntax error alerts with line/col:

Security

• Fixed an arbitrary file write vulnerability: https://github.com/j4k0xb/webcrack/security/advisories/GHSA-ccqh-278p-xq6w Who's affected: Windows users which run the CLI with --output or (await webcrack(input)).save(dir) in JS Credits to @SteakEnthusiast for finding it

Unminify

• Fixed a Maximum call stack size exceeded error on some comparisons (NaN == NaN)

Unminify

• No longer extract sequence from while (a(), b()) c();
• No longer invert relational operators (!(a > b); -> a <= b) due to breaking with NaN
• Faster unminify (mainly string merging and numeric expressions)
• Remove double negations: if (!!a) b(); -> if (a) b(); in if, ternary, array.filter
• Extract sequence from for-of: for (let value of (a = 1, array)) {} -> a = 1; for (let value of array) {}
• Mangle: names are inferred based on type (variable, function, parameter, class) and some expressions:

var iîiíiîï = exports;
function iìíïîíï(iïîiïîï, iìíìïîî, iìiiïiî) {
  var iïíïíiî = Array(Math.max(iïîiïîï.bitLength(), iìiiïiî) + 1);
  iïíïíiî.fill(0);
  var iiïiïîï = 1 << iìíìïîî + 1;
  var iìîíiîí = iïîiïîï.clone();

->

var vExports = exports;
function f(p, p2, p3) {
  var vArray = Array(Math.max(p.bitLength(), p3) + 1);
  vArray.fill(0);
  var v = 1 << p2 + 1;
  var v2 = p.clone();

Transpile

• Fixed default parameters offset issue
• Transpile default parameter with value true or false
• Transpile default destructuring parameters:

function f() {
  let { x, y } = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
  let [z] = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : [];
}

->

function f({ x, y } = {}, [z] = []) {}

Deobfuscate

• Inline objects like var obj = ({ x: 1 }).x; decode(obj) to decode(1)
• Support inlined control flow objects: ({ QuFtJ: function (n, r) { return n === r; }}).QuFtJ(u, v); -> u === v

Playground

• Menu bar
• Error alerts
• CSP to disallow network requests etc in sandbox
• Mangle filter presets:

CLI

• Added --no-jsx, --no-unpack, --no-deobfuscate, --no-unminify arguments

(the playground always has the latest changes, but the npm release was a bit outdated)