Hacker News Reader

Comment by lhorie | Hacker News Reader

Minified js isn't particularly hard to reverse engineer compared to tools that are geared towards actual obfuscation, and regardless, you don't even need to look at the code if all you care about is privacy. A look at the dev console's network tab should tell you all you need to know.

View on HN

I've done obfuscated Javascript on a CTF. Only a few hundred lines and I can tell you, it's way easier to just write it new from scratch, especially if you have a product that you like and can just copy.

I’ve reversed and broken real-life products written in JS, Java, WebAssembly and native code.

Minified JS and obfuscated Java (DexGuard or ProGuard) are almost identical in complexity, you can restore the actual datatypes still, and you can even restore the rough outlines of where control structures were.

Obfuscated WebAssembly, NaCl or native code is much worse to work with, and often data structures and control structures are gone entirely.

I'd be very interested about your findings decompiling wasm. Do you have a blog, by chance?

From parent's HN profile:

Janne Koschinski, CompSci student. https://github.com/justJanne

Current maintainer of QuasselDroid https://quasseldroid.info/ https://github.com/sandsmark/QuasselDroid

I don’t maintain a blog currently, sorry. And if I had one I doubt I’d be able to write interesting articles about this topic.

Generally I share such info on IRC, and then it gets just forgotten over time.

Reply on news.ycombinator.com