js-unpacker

JavaScript Unpacker (P.A.C.K.E.R. Deobfuscator)

Description

A tool to detect and deobfuscate JavaScript code obfuscated using the P.A.C.K.E.R. method. The JsUnpacker class can identify obfuscated code and convert it back to its original readable form.

Features

• Automatic detection of P.A.C.K.E.R. obfuscation
• JavaScript deobfuscation capability
• Support for multiple numeric bases (up to base 95)
• Handles custom alphabets for conversion

Installation

npm install js-unpacker

Usage

const JsUnpacker = require('js-unpacker');

const packedJS = "eval(function(p,a,c,k,e,d){...}('packed code',...,...,'symbols|split|by|pipe'))";

const unpacker = new JsUnpacker(packedJS);

if (unpacker.detect()) {
    const unpackedCode = unpacker.unpack();
    console.log(unpackedCode);
} else {
    console.log("Code doesn't appear to be P.A.C.K.E.R. obfuscated");
}

API

JsUnpacker

Constructor

new JsUnpacker(packedJS)

• packedJS: String - Obfuscated JavaScript code

Methods

Method	Returns	Description
detect()	boolean	Returns true if code appears to be P.A.C.K.E.R. obfuscated
unpack()	`string	null`

Example

const packedCode = "eval(function(p,a,c,k,e,r){...}('0 1=2',3,3,'var|foo|42'.split('|'),0,{}))";

const unpacker = new JsUnpacker(packedCode);
if (unpacker.detect()) {
    console.log(unpacker.unpack());
    // Output: var foo=42
}

How It Works

The unpacker:

1. Detects the P.A.C.K.E.R. pattern: eval(function(p,a,c,k,e,
2. Extracts the payload, radix, count and symbol table
3. Uses base conversion to map packed tokens to their original values
4. Reconstructs the original code

Limitations

• Only works with P.A.C.K.E.R. style obfuscation
• May not handle all edge cases of heavily modified variants

License

MIT License