Automatic Simplification of Obfuscated JavaScript Code (Extended Abstract)

Legal aspects of web systems

“…A license often contains contractual restrictions on reverse engineering. For instance, using Google's JavaScript Client Library is subject to its terms of service, which state: 17 14 http://www.latestpatents.com/apple-patents-granted-on-12-march-2013/ 15 http://en.wikipedia.org/wiki/Eolas 16 Malicious JavaScript can be obfuscated to slip through malware detection programs [24]. As a result, research is actively working on de-obfuscation tools and approaches for malware detection, but, of course, these tools can be used for other purposes as well.…”

JShield

“…Rozzle [30] adopts symbolic execution, multi-execute JavaScript code, and partially mitigates differences between multiple browsers. Other previous approaches [18,23,33,46] mostly execute JavaScript and acquire de-obfuscated JavaScript code. Revolver [29] compares the similarity between different JavaScript samples and cluster them based on AST features, however as shown in Figure 10, two samples with different ASTs can trigger the same vulnerability.…”

Automatic Simplification of Obfuscated JavaScript Code: A Semantics-Based Approach

“…The basic idea is to transform the program so that each goto is either replaced by some other construct, or the goto and its target are brought closer together in a semantics-preserving transformation. Space constraints preclude a detailed description of our transformation rules; interested readers are referred to the full version of the paper [12]. The fact that SpiderMonkey always generates byte-code with reducible CFGs (due to the lack of an aggressive code optimization phase) and the difference between JavaScript byte-code and Java byte-code, makes it possible for our algorithm to have a smaller set of tranformation rules.…”

“…Experiments using a prototype implementation indicate that this approach is able to penetrate multiple layers of complex obfuscations and extract the core logic of the underlying computation. Some of the details of this work have been omitted from this paper due to space constraints; interested readers are referred to the full version of the paper, which is available online [12].…”