3 ms·

Not quite, minify JS can be "beautified" to get pretty reasonable JS back, sans variables and functions having letters for names as you noted. But this is becau

by Drakim 3y ago

Not quite, minify JS can be "beautified" to get pretty reasonable JS back, sans variables and functions having letters for names as you noted. But this is because obfuscated JS is still valid JS, it's just made ugly. Obfuscated assembly is often changed in such a way that there are no corresponding language constructs to "reverse" back to, if it originally came from a language like C++. Sure you can see the actual assembly code, but you can't recreate the higher level C++ constructs in a sane way, because the obfuscation technique scrambles things too much.

slimsag 3y ago
I think you're missing a good amount of nuance here minified JS can be turned into reasonable JS, yes, but you're probably not going to get TypeScript code back, so the same sort of challenge exists there. Assembly -> high-level language is harder, but there are absolutely binary -> C decompilers that are very popular/used in the RE community to make changes to existing programs. But that doesn't even matter, WASM is much higher level than assembly, it's a stack machine, there is no arbitrary control flow / labels / `goto`, there are pre-defined data types, etc. all of this means it's easier to convert WASM -> high-level language than it is with a generic x86/arm binary. There are WASM decompilers[0][1] which can convert WASM binaries into C code and back. In both cases (minified JS and WASM), you're not going to get out exactly what you put in, but WASM doesn't really change the situation very much given the widespread adoption of 'compile to JS' languages like TypeScript these days. [0] https://chromium.googlesource.com/external/github.com/WebAssembly/wabt/+/HEAD/wasm2c/README.md https://chromium.googlesource.com/external/github.com/WebAss... [1] https://github.com/wwwg/wasmdec https://github.com/wwwg/wasmdec
pjmlp 3y ago
Except WASM isn't as low level as machine code proper, and also needs to obey certain rules due to code verification, thus it is as easy as any other bytecode format. You might not get the original C++ code back, but it is relatively easy to get an alternative version in C code back, which is already good enough as starting point.

by Drakim 3y ago

slimsag 3y ago

I think you're missing a good amount of nuance here minified JS can be turned into reasonable JS, yes, but you're probably not going to get TypeScript code back, so the same sort of challenge exists there. Assembly -> high-level language is harder, but there are absolutely binary -> C decompilers that are very popular/used in the RE community to make changes to existing programs. But that doesn't even matter, WASM is much higher level than assembly, it's a stack machine, there is no arbitrary control flow / labels / `goto`, there are pre-defined data types, etc. all of this means it's easier to convert WASM -> high-level language than it is with a generic x86/arm binary. There are WASM decompilers[0][1] which can convert WASM binaries into C code and back. In both cases (minified JS and WASM), you're not going to get out exactly what you put in, but WASM doesn't really change the situation very much given the widespread adoption of 'compile to JS' languages like TypeScript these days. [0] https://chromium.googlesource.com/external/github.com/WebAssembly/wabt/+/HEAD/wasm2c/README.md https://chromium.googlesource.com/external/github.com/WebAss... [1] https://github.com/wwwg/wasmdec https://github.com/wwwg/wasmdec

pjmlp 3y ago

Except WASM isn't as low level as machine code proper, and also needs to obey certain rules due to code verification, thus it is as easy as any other bytecode format. You might not get the original C++ code back, but it is relatively easy to get an alternative version in C code back, which is already good enough as starting point.