[GH-ISSUE #260] control flow obfuscation, dynamic code generation, highly nested functions, and some closure functions #62

New issue

Open

opened 2026-03-03 13:52:40 +03:00 by kerem · 2 comments

kerem commented

2026-03-03 13:52:40 +03:00

Owner

Originally created by @zhangyupy on GitHub (Dec 30, 2024).
Original GitHub issue: https://github.com/jehna/humanify/issues/260

Currently, the functionality can only handle simple variable name obfuscation, but it is not applicable to common obfuscation techniques such as complex control flow obfuscation, dynamic code generation, highly nested functions, and some closure functions.

Originally created by @zhangyupy on GitHub (Dec 30, 2024). Original GitHub issue: https://github.com/jehna/humanify/issues/260 Currently, the functionality can only handle simple variable name obfuscation, but it is not applicable to common obfuscation techniques such as complex control flow obfuscation, dynamic code generation, highly nested functions, and some closure functions.

kerem added the

wontfix

label

2026-03-03 13:52:40 +03:00

kerem commented

2026-03-03 13:52:41 +03:00

Author

Owner

@jehna commented on GitHub (Dec 30, 2024):

it is not applicable to common obfuscation techniques such as complex control flow obfuscation, dynamic code generation, highly nested functions, and some closure functions

Obfuscation is now handled by the package webcrack, which is a direct dependency of this project. If you need any further deobfuscation capabilities, please open an issue at the webcrack side – any new features will automatically be included in the future Humanify releases.

If you have any ideas on how to implement these features using LLMs, then I'd be happy to try to implement them at Humanify side.

@jehna commented on GitHub (Dec 30, 2024): > it is not applicable to common obfuscation techniques such as complex control flow obfuscation, dynamic code generation, highly nested functions, and some closure functions Obfuscation is now handled by the package [webcrack](https://github.com/j4k0xb/webcrack), which is a direct dependency of this project. If you need any further deobfuscation capabilities, please open an issue at the webcrack side – any new features will automatically be included in the future Humanify releases. If you have any ideas on how to implement these features using LLMs, then I'd be happy to try to implement them at Humanify side.

kerem commented

2026-03-03 13:52:41 +03:00

Author

Owner

@Acters commented on GitHub (Jan 5, 2025):

Since the LLMs are used to rename and "humanify" variables and function and the like.

It would be nice if it can rename "Labeled statements" that is used for while or for loops. As of right now, they remain untouched. This feature might be a bit complex to do as I do notice some obfuscated JS files have the labels repeated for separate while loops or the same name reused in a lambda(due to it being a separate namespace it does not affect the label or redefined the variable)

Lambda functions are also have their variables untouched, too. though it might be also complex due to them being used in .reduce( ) statements often in obfuscated code.

otherwise this is a great project and keeps it simple and clean. Most other forms of obfuscation should be directed towards the webcrack team.

@Acters commented on GitHub (Jan 5, 2025): Since the LLMs are used to rename and "humanify" variables and function and the like. It would be nice if it can rename "Labeled statements" that is used for while or for loops. As of right now, they remain untouched. This feature might be a bit complex to do as I do notice some obfuscated JS files have the labels repeated for separate while loops or the same name reused in a lambda(due to it being a separate namespace it does not affect the label or redefined the variable) Lambda functions are also have their variables untouched, too. though it might be also complex due to them being used in `.reduce( )` statements often in obfuscated code. otherwise this is a great project and keeps it simple and clean. Most other forms of obfuscation should be directed towards the webcrack team.

kerem referenced this issue

2026-03-03 13:53:14 +03:00

[PR #62] [MERGED] Bump typescript-eslint from 8.2.0 to 8.3.0 #135