jehna / humanify

Deobfuscate Javascript code using ChatGPT
MIT License
301 stars 19 forks source link

You spelled decompile wrong #9

Closed mattkenefick closed 3 months ago

mattkenefick commented 3 months ago

You wrote "Un-minify" but this is just meant to decompile other people's code

jehna commented 3 months ago

I think decompile would mean that there would be a code compilation step; compilation at Wikipedia is defined as:

In computer programming, the translation of source code into object code by a compiler

In Javascript land there's no different object code from source code, as Javascript is an interpreted language. Javascript talks more about transpilation (translating from one source code to anohter, such as Typescript ➡️ Javascript or ES6 ➡️ ES5). One step that many build processes in Javascript land take is to minify the source code, which Wikipedia describes as:

...the process of removing all unnecessary characters from the source code of interpreted programming languages or markup languages without changing its functionality

One of the most significant parts of minifying Javascript is to discard the function and variable names and replace them with shorter ones. This project's most significant part is to reverse that renaming process of the minification, which I think is pretty well described by calling it un-minifying the code.

Please let me know if I got something wrong, happy to change wording if you can point out how decompilation would be better term!

mattkenefick commented 3 months ago

Please let me know if I got something wrong, happy to change wording if you can point out how decompilation would be better term!

Minifying refers to making something smaller, and while it's true shorter variable names achieve this, it's more common to occur due to obfuscation; obfuscation at Wikipedia is defined as:

In software development, obfuscation is the act of creating source or machine code that is difficult for humans or computers to understand. Like obfuscation in natural language, it may use needlessly roundabout expressions to compose statements. Programmers may deliberately obfuscate code to conceal its purpose (security through obscurity) or its logic or implicit values embedded in it, primarily, in order to prevent tampering, deter reverse engineering, or even to create a puzzle or recreational challenge for someone reading the source code.

Minifying JavaScript code is about reducing the overall footprint. Obfuscation, changing variable names and similar, contributes to that even though a significant purpose is to deter others from reverse engineering and stealing their work.

It's one thing to use a code formatter to restructure minified/non-obfuscated code, like in developer tools, but this project seems to try and rename intentionally misnamed objects using AI which seems to more accurately be unobfuscation. Yes, JavaScript isn't "compiled" in the traditional sense, but the general idea of "decompiling" something to gain access to source that was intentionally obfuscated still fits; a term from when not everything was on the web.

So I guess the suggested alternate term would be "Unobfuscator" or "Deobfuscator". Not sure which is more correct.

jehna commented 3 months ago

I do agree that miniying javascript variables is a mean of obfuscation, and reversing obfuscated code would IMO be called "deobfuscating".

Humanify does internally use a deobfuscator called Webcrack, which does make Humanify an efficient deobfuscator too.

Historically I think the README was written before Webcrack was introduced, at which point the project was indeed just a one trick pony without any other functionalities than restoring the variable name, but I do think it would be better to call it deobfuscator now 🤔

jehna commented 3 months ago

Updated README & project metadata 🎉

Thank you for bringing this up, great to hear an outside view about the project. I think decompiling is a good way to describe the project too and I can see people googling for it who would like to find Humanify, so it's now in the README too.