Tree
MediumMalware Reverse Engineering
Overview
We have a JavaScript obfuscated file; I heard that AST could come in handy here.
Lab Details
Prerequisites & Requirements
- JavaScript Internals: Proficiency in ES6+ syntax, bitwise operators, and Buffer object manipulation.
- Obfuscation Patterns: Familiarity with Control Flow Flattening and state-machine-based execution logic.
- Number Theory: Basic understanding of modular arithmetic and the concept of a Modular Multiplicative Inverse .
- AST Fundamentals: Conceptual knowledge of Abstract Syntax Trees and how they represent code structure.
What will you learn?
- Deconstructing Control Flow Flattening: Manually tracing nested while-switch loops to normalize flattened logic into a linear execution path.
- Algorithm Reversal: Reversing deterministic shuffling/permutation algorithms by identifying loop invariants and index dependencies.
- Cryptographic Recovery: Applying modular inverses to undo non-linear transformations (Modular Multiplication) within a data pipeline.
- Data Normalization: Handling underflow and overflow in modular operations (
e.g., v - i * 5 % 256).
Tools
- Runtime:
Node.js(for testing recovery scripts). - Formatting: JS Beautifier / AST Explorer (for structural analysis).
Job Positions
Malware Analyst
Tags
Static AnalysisDynamic AnalysisMalware AnalysisObfuscationBehavioral Analysis