Scripts

Dynamically Reverse-Engineer Code

objects.js

Emulate common browser and PDF viewer objects, methods, and properties when deobfuscating JavaScript.

Website: https://github.com/REMnux/salt-states/blob/master/remnux/config/objects/objects.js Author: Lenny Zeltser License: Public Domain Notes: The file is in /usr/local/share/remnux State File: remnux.config.objects.init

Python3 and JavaScript interop engine, fork of the original PyV8 project.

Website: https://github.com/cloudflare/stpyv8 Author: Area1 Security License: Apache License 2.0: https://github.com/cloudflare/stpyv8/blob/master/LICENSE.txt State File: remnux.python3-packages.stpyv8

Deobfuscate JavaScript scripts using AST and Partial Evaluation techniques.

Website: https://github.com/mindedsecurity/jstillery Author: Stefano Di Paola, Minded Security: https://mindedsecurity.com License: GNU General Public License (GPL) v3: https://github.com/mindedsecurity/JStillery/blob/master/LICENSE Notes: jstillery State File: remnux.node-packages.jstillery

Analyze suspicious JavaScript scripts.

Website: https://github.com/CapacitorSet/box-js Author: CapacitorSet License: MIT License: https://github.com/CapacitorSet/box-js/blob/master/LICENSE Notes: box-js, box-export State File: remnux.node-packages.box-js

Execute and deobfuscate JavaScript using Mozilla's standalone JavaScript engine.

Website: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey Author: Mozilla Foundation License: Mozilla Public License 2.0: https://www.mozilla.org/en-US/MPL/2.0/ Notes: js State File: remnux.packages.spidermonkey

GUI JavaScript debugger.

Website: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/Rhino/Debugger Author: Mozilla Project License: Mozilla Public License v2.0: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/Rhino/License Notes: rhino-debugger State File: remnux.packages.rhino

Run PowerShell scripts and commands.

Website: https://github.com/powershell/powershell Author: Microsoft Corporation License: MIT License: https://github.com/PowerShell/PowerShell/blob/master/LICENSE.txt Notes: pwsh State File: remnux.packages.powershell

Execute and deobfuscate JavaScript using a patched version of Mozilla's standalone JavaScript engine.

Website: https://blog.didierstevens.com/2018/04/19/update-patched-spidermonkey/ Author: SpiderMonkey by Mozilla Foundation, patched by Didier Stevens: https://x.com/DidierStevens License: Mozilla Public License 2.0: https://www.mozilla.org/en-US/MPL/2.0/ Notes: js-ascii, js-file State File: remnux.tools.js-patched

Deobfuscate JavaScript by removing common obfuscation techniques such as string arrays and proxy functions.

Website: https://github.com/ben-sb/javascript-deobfuscator Author: ben-sb: https://github.com/ben-sb License: Apache License 2.0: https://github.com/ben-sb/javascript-deobfuscator/blob/master/LICENSE Notes: js-deobfuscator -i input.js -o output.js State File: remnux.node-packages.js-deobfuscator

Deobfuscate, unminify, and unpack bundled JavaScript, including scripts protected with obfuscator.io.

Website: https://github.com/j4k0xb/webcrack Author: j4k0xb: https://github.com/j4k0xb License: MIT License: https://github.com/j4k0xb/webcrack/blob/master/LICENSE Notes: webcrack input.js -o output-dir State File: remnux.node-packages.webcrack

Monitor and deobfuscate JavaScript behavior in a headless browser to analyze malicious web pages.

Website: https://github.com/edygert/js_unshroud Author: Evan H. Dygert: https://www.linkedin.com/in/evandygert/ License: MIT License: https://github.com/edygert/js_unshroud/blob/master/LICENSE.txt Notes: js_unshroud. Capture with js_unshroud run --url <url> --out events.jsonl; run it without arguments to see usage. Needs a display; on headless systems the wrapper starts a virtual one automatically (xvfb). State File: remnux.tools.js_unshroud

Last updated 28 days ago