Obfuscated code

Wakaru is not a deobfuscator. Minification and obfuscation look alike at a glance, but they serve different purposes. Minification shrinks code for delivery. Obfuscation makes it harder to understand on purpose. Wakaru reverses the first and leaves the second to a dedicated tool.

Wakaru lets you inspect suspicious samples without executing their code.

Minified or obfuscated?

A few tells:

• Short names, !0, comma chains, one long line. That is minification. Wakaru handles it directly.
• A large array of strings near the top, and every string in the code is looked up by index. That is string-array obfuscation.
• Functions built as one big while (true) loop with a switch over a state variable. That is control-flow flattening.
• Code that decodes a blob and runs it through its own interpreter. That is a VM-based protector.

The last three need stripping first.

Strip first, then decompile

# 1. strip the obfuscation
npx webcrack --no-unpack --no-unminify obfuscated.js > deobfuscated.js
# 2. recover readable modules
npx wakaru deobfuscated.js --unpack -o out/

webcrack can also unpack and unminify. The two flags turn that off, so each tool does one job. Unpacking and unminifying happen in step 2.

An obfuscated bundle is still a bundle once the obfuscation is gone, which is why step 2 uses --unpack. For a single file, drop the flag.

Reviewing suspicious code

Use --level minimal for security review. It favors behavioral fidelity over stronger recovery. See Rewrite levels.

Names

Stripping obfuscation does not bring names back. Mangled names like e and t stay short unless a source map has the originals. See Variable names for the options.