How does the browser decode these obfuscated class names?

Question

This javascript file appears to have been obfuscated and the class names are not human readable, looking like lt$nkqmr. However when a browser runs the javascript, for example here or here, the browser apparently decodes the class names as the console can auto-complete class names such as lt.ImageLoader. How does the browser decode these obfuscated class names and how can I do the same?

Does this answer your question? [How to unminify the js files?](https://stackoverflow.com/questions/50153889/how-to-unminify-the-js-files) — A. L, May 25 '20 at 09:26
Do you have a line:column number where such an obfuscated value is being used as the property of a object directly? Fast looking at this script, they do a lot of `garbled[ otherGarbled( yetOtherGarbled ) ] = moreGarble` probably that `otherGarbled()` function returns human readable strings. — Kaiido, May 25 '20 at 09:54
@A.L The answers to that question state that minification is a destructive process and can't be undone. In my case the browser is able to reconstruct the class names some how, so there is a way it can be done, I want to know how. — Jamie Kitson, May 25 '20 at 09:57
@A.L Can you point out to me where these source maps are in this case? — Jamie Kitson, May 25 '20 at 10:15

FZs · Accepted Answer · 2020-05-25T10:37:26.697

TL;DR: No, generally it isn't possible.

If you inspect the source of the linked page, you can see that the lt.ImageLoader function is defined as follows:

lt[lt$tyopy(0x3ca)] = function() { /* function body */ }

As you can see, its name is the result of evaluating lt$tyopy(0x3ca).

The lt$tyopy function, after executing a massive amount of function calls and other unreadable code, returns the string 'ImageLoader', hence the name of the function.

But if you inspect lt.ImageGroupLoader, for example, you'll notice that its name is generated by the function lt$sarzm, in a similar, but different way.

And, those functions are designed to reconstruct the name of the "public" functions only and are created by the authors of the page.

And we are still talking about a single site: other sites with other obfuscation algorithms might use completely different ways to reconstruct public names.

So, unless you created the obfuscated code and left a way to do so, there's no way to reconstruct names which are obfuscated.

Thanks very much. I didn't realise it was so easy to jump to the definition of a function. It's actually not that hard in this case. There is an array of encoded strings, `lta`, and a function `ltb` to decode a particular string, so you can iterate through those and map the human readable name to the index. — Jamie Kitson, May 25 '20 at 11:07
@JamieKitson Well, I didn't analyzed the code that far... And yes, that's definitely a case where the "Show declaration" function is useful! — FZs, May 25 '20 at 12:51

How does the browser decode these obfuscated class names?

1 Answers1