JS De-obfuscator

[Mayayana]

I've been working on a fun project lately that
I though people might find useful. Maybe there
will also be comments or suggestions:

http://www.jsware.net/jsware/scrfiles.php5#jsdeob

It's an HTA. I've been finding that webpage code
increasingly uses very bloated and obfuscated JS
to create the page. In some cases I've even found
JSON, embedded in script, which in turns embeds
the HTML of the page! In some cases the idea seems
to be to force people to enable script. In other cases
it seems to be to either hide or protect the code.

In any case, I wanted to be able to dump the
obfuscated script into a window and clean it up.
The result is at the link above. It starts with an
OSS script to format, then uses my own VBS to
further clean up the code and add color syntax
highlighting.

[GS]

Post by Mayayana
I've been working on a fun project lately that
I though people might find useful. Maybe there
http://www.jsware.net/jsware/scrfiles.php5#jsdeob
It's an HTA. I've been finding that webpage code
increasingly uses very bloated and obfuscated JS
to create the page. In some cases I've even found
JSON, embedded in script, which in turns embeds
the HTML of the page! In some cases the idea seems
to be to force people to enable script. In other cases
it seems to be to either hide or protect the code.
In any case, I wanted to be able to dump the
obfuscated script into a window and clean it up.
The result is at the link above. It starts with an
OSS script to format, then uses my own VBS to
further clean up the code and add color syntax
highlighting.

Interesting that not all browsers support vbs!

I built my website using Frontpage because it shipped with my Office
2000 Developer Edition. I switched to using ExpressionWeb when M$ offer
a cheap upgrade for FP users. (This has also been deprecated, and v4 is
available free since there's no longer any support for it!)

I recently moved my website to a newer server (same host but 1/3 the
annual cost) from an older 'legacy' server where I was making use of
Frontpage Server Extensions. This, of course, was deprecated circa 2002
and is not supported on the new server. I thought I'd have to implement
some js to substitute the FSE features no longer available. I managed
to replace my webform/webmail stuff with Perl scripts, though.

In my research I ran across Dojo. This is a heavy duty js package that
also makes use of JSON and Regex. Older versions of the Dojo package
apparently required lots of js scripting over what they're calling
'Modern Dojo'. As far as I could see they're are millions of web
developers using this stuff.

I also looked at Wordpress but passed since I like a WYSIWYG editor UI.
I went with the newest version of EW since I'm familiar with it. Don't
know how much js WP uses, but I suspect plenty since html alone can't
do much of the features it offers.

I still have some js in place for parsing values passed in a URL. It
would be nice, though, if I could replace it with html somehow!

[Mayayana]

| Interesting that not all browsers support vbs!
|

I think it was Microsoft's way of competing with
Netscape. They thought they'd force compatibility
with their system, but Netscape never made an
effort to support VBS. I used to have an old VBS book
that said VBScript would "soon" be supported by all
browsers... That was 1996, so all browsers meant
Netscape. :)

Frontpage was also known as a monstrosity. Microsoft's
tool for making webpages designed for IE.

I'd avoid Wordpress. They seem to get hacked about
once per week, due to the extreme amount of highly
functional script and plugins they use.

It's a big topic. I see script getting *so* overused.
Fortunately I'm able to block it most of the time. And
on my own site I like to code "by hand", avoiding script.
The only script I've ever needed has been for older
versions of IE that don't support CSS hover for "flyout"
menus. For that I use VBS. To me JS is just to ugly
and terse to really get interested in.

I guess partly my attitude dates to an earlier time
when script was being phased out for security and
CSS was starting to fill the gaps. It made sense to
try to eliminate script. But these days it permeates
many commercial sites.


| I still have some js in place for parsing values passed in a URL. It
| would be nice, though, if I could replace it with html somehow!
|

I wonder what you're doing that requires script
on your site. Many things can now be done with
CSS. Much can also be done with PHP on Unix/Linux,
or maybe aspx on Windows servers. I'm not sure
about URL parameters, but I would think that's
one of the most common things to deal with. On
my own site I use PHP to check the userAgent
and provide one of two versions of the page,
depending on whether the visitor is using IE or
another browser. It all happen server-side, so I
don't need script in the page.

[GS]

Post by Mayayana
I wonder what you're doing that requires script
on your site. Many things can now be done with
CSS. Much can also be done with PHP on Unix/Linux,
or maybe aspx on Windows servers. I'm not sure
about URL parameters, but I would think that's
one of the most common things to deal with. On
my own site I use PHP to check the userAgent
and provide one of two versions of the page,
depending on whether the visitor is using IE or
another browser. It all happen server-side, so I
don't need script in the page.

This is how I was having licensed apps 'registered' on my website. I've
since revised my licensing code to do this via a form and email, so I
probably don't need that js anymore for this purpose.

My app installer download page uses js to parse the download filename.
Otherwise, I'd need a separate download page for each app (and is
probably the way to go!).