Tree

MediumMalware Reverse Engineering

Overview

We have a JavaScript obfuscated file; I heard that AST could come in handy here.

Lab Details

Prerequisites & Requirements

  • JavaScript Internals: Proficiency in ES6+ syntax, bitwise operators, and Buffer object manipulation.
  • Obfuscation Patterns: Familiarity with Control Flow Flattening and state-machine-based execution logic.
  • Number Theory: Basic understanding of modular arithmetic and the concept of a Modular Multiplicative Inverse .
  • AST Fundamentals: Conceptual knowledge of Abstract Syntax Trees and how they represent code structure.

What will you learn?

  • Deconstructing Control Flow Flattening: Manually tracing nested while-switch loops to normalize flattened logic into a linear execution path.
  • Algorithm Reversal: Reversing deterministic shuffling/permutation algorithms by identifying loop invariants and index dependencies.
  • Cryptographic Recovery: Applying modular inverses to undo non-linear transformations (Modular Multiplication) within a data pipeline.
  • Data Normalization: Handling underflow and overflow in modular operations ( e.g ., v - i * 5 % 256).

Tools

  • Runtime: Node.js (for testing recovery scripts).
  • Formatting: JS Beautifier / AST Explorer (for structural analysis).

Job Positions

Malware Analyst

Tags

Static AnalysisDynamic AnalysisMalware AnalysisObfuscationBehavioral Analysis