MENAS'S JavaScript Obfuscation Challenge

Five medium-difficulty challenges based on JavaScript obfuscation: string-array encoding, control-flow flattening, anti-debugging traps, dynamic Function() evaluation, and a small custom bytecode VM. Everything is solvable by reading and running the code with Node.js, your browser's dev tools, or an AST beautifier. Flags look like MENAS{...}.

1. String Array & Encoding Mapping

   The flag's bytes are stored hex-encoded inside an array, but the array has been rotated out of order and each byte shifted by a small additive constant before encoding. Find the rotation amount, undo it, then reverse the byte offset to recover each character. Everything you need is in the decode function itself.

   ▸show code

2. Control Flow Flattening

   This script builds its output one character at a time inside a single while(true){switch(...)} loop, but the case labels are not written in the order they execute. A separate jump-table array determines the real execution sequence trace it index by index rather than reading the switch top to bottom.

   ▸show code

3. Anti-Debugging & Dynamic Trap

   This one notices when you try to intercept its output. Patch console.log to capture what gets printed and you'll get a decoy instead of the real flag. The genuine value only assembles inside a getter think about what “still native code” means, and whether you need to touch console.log at all.

   ▸show code

4. Custom CharCode Decoder / Self-Evaluating JS

   The array in this file isn't the flag it's the source code of a tiny snippet that produces the flag, hidden behind a decoder that avoids the obvious String.fromCharCode call. Once decoded, the snippet is handed to new Function(...) and executed. Reverse the routine by hand, or catch the source right before it runs.

   ▸show code

5. Mini Virtual Machine / Bytecode Interpreter

   The flag is never written anywhere as a string it's the output of a small custom stack-based VM executing an array of [opcode, operand] instructions. Read the opcode table, then trace the bytecode by hand or instrument the interpreter to recover the output stream.

   ▸show code