Improve memory usage for big scripts

[wavedevgit]

Describe the bug

WebCrack crashes due to a memory leak when I try to load web.js (its a big file) from canary.discord.com/app

Expected Behaviour

Should avoid memory leaks and work normally

Code

https://canary.discord.com/assets/web.e379f5893cb32b3b.js

Logs

wavedev@wavedev-computer:~/discord-chunks-datamining$ webcrack .js -o test
  webcrack:transforms prepare: started +0ms

<--- Last few GCs --->

[8298:0x2d090000]    10550 ms: Scavenge 2023.6 (2082.8) -> 2021.2 (2086.2) MB, pooled: 0 MB, 4.89 / 0.00 ms  (average mu = 0.483, current mu = 0.303) allocation failure; 
[8298:0x2d090000]    10567 ms: Scavenge 2026.9 (2086.2) -> 2023.7 (2103.8) MB, pooled: 0 MB, 9.07 / 0.00 ms  (average mu = 0.483, current mu = 0.303) allocation failure; 


<--- JS stacktrace --->

FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----

 1: 0xe40d2e node::OOMErrorHandler(char const*, v8::OOMDetails const&) [node]
 2: 0x12167b0 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [node]
 3: 0x1216a87 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [node]
 4: 0x1444365  [node]
 5: 0x145dbf9 v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) [node]
 6: 0x14322a8 v8::internal::HeapAllocator::AllocateRawWithLightRetrySlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [node]
 7: 0x14331d5 v8::internal::HeapAllocator::AllocateRawWithRetryOrFailSlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [node]
 8: 0x140beae v8::internal::Factory::NewFillerObject(int, v8::internal::AllocationAlignment, v8::internal::AllocationType, v8::internal::AllocationOrigin) [node]
 9: 0x186d50c v8::internal::Runtime_AllocateInYoungGeneration(int, unsigned long*, v8::internal::Isolate*) [node]
10: 0x752ef9e6c476

[wavedevgit]

hi?

[reloadedd]

Hi, as mentioned in this comment, increase the memory available for Node. Here's how to do it on Linux (increase to 8GB):

NODE_OPTIONS="--max-old-space-size=8192" webcrack bundle.js

[0xdevalias]

If you're still hitting RAM limit issues after increasing the heap size; and if you don't specifically need the deobfuscation parts of webcrack (just the JS unminify parts), then you could try wakaru's recent Rust rewrite, which runs WAY faster and with WAY less memory than it used to:

If that still doesn't work for you given the 100mb bundle size; depending on whether you specifically need the deobfuscation features of webcrack, or if you just need more general JS unminify features; you might have some luck with wakaru, which has recently been rewritten in Rust, and is much faster / much lower memory usage than it used to be:

• https://github.com/pionxzh/wakaru

You can see some of the benchmarks in this comment thread:

• Explore / benchmark wakaru against "JsDeObsBench: Measuring and Benchmarking LLMs for JavaScript Deobfuscation" + in general pionxzh/wakaru#144 (comment)

The largest sample size listed there was only 12.4mb; but it ran in ~2sec, and maxed out at only 410.9mb of RAM usage.

Originally posted by @0xdevalias in #211 (comment)

---

when I try to load web.js (its a big file) from canary.discord.com/app

Seems it's ~20mb:

⇒ wget https://canary.discord.com/assets/web.e379f5893cb32b3b.js
# ..snip..

⇒ du -sh ./web.e379f5893cb32b3b.js 
 20M  ./web.e379f5893cb32b3b.js

Using webcrack with increased heap size; seemed to hit a different bug (see #217):

⇒ ./node_modules/.bin/webcrack --version                                                              
2.16.0

⇒ NODE_OPTIONS="--max-old-space-size=8192" /usr/bin/time -l ./node_modules/.bin/webcrack web.e379f5893cb32b3b.js -o out
  webcrack:transforms prepare: started +0ms
  webcrack:transforms prepare: finished with 85270 changes +7s
  webcrack:transforms deobfuscate: started +0ms
  webcrack:deobfuscate String Array: no +0ms
  webcrack:transforms deobfuscate: finished with 0 changes +11s
  webcrack:transforms transpile, unminify: started +0ms
  webcrack:transforms transpile, unminify: finished with 810175 changes +9s
  webcrack:transforms self-defending, debug-protection, jsx, jsx-new: started +0ms
  webcrack:transforms self-defending, debug-protection, jsx, jsx-new: finished with 18959 changes +5s
  webcrack:transforms merge-object-assignments, evaluate-globals: started +0ms
  webcrack:transforms merge-object-assignments, evaluate-globals: finished with 0 changes +10s
file://~/Desktop/discord-unpack-test/node_modules/webcrack/dist/index.js:405
      throw new Error(
            ^

Error: Unexpected reference (JSXIdentifier): _Component
    at file://~/Desktop/discord-unpack-test/node_modules/webcrack/dist/index.js:405:13
    at Array.forEach (<anonymous>)
    at renameFast (file://~/Desktop/discord-unpack-test/node_modules/webcrack/dist/index.js:402:26)
    at exportVariable (file://~/Desktop/discord-unpack-test/node_modules/webcrack/dist/index.js:4075:7)
    at enter (file://~/Desktop/discord-unpack-test/node_modules/webcrack/dist/index.js:4042:13)
    at NodePath._call (~/Desktop/discord-unpack-test/node_modules/@babel/traverse/lib/path/context.js:50:20)
    at NodePath.call (~/Desktop/discord-unpack-test/node_modules/@babel/traverse/lib/path/context.js:36:15)
    at NodePath.visit (~/Desktop/discord-unpack-test/node_modules/@babel/traverse/lib/path/context.js:87:31)
    at TraversalContext.visitQueue (~/Desktop/discord-unpack-test/node_modules/@babel/traverse/lib/context.js:96:16)
    at TraversalContext.visitMultiple (~/Desktop/discord-unpack-test/node_modules/@babel/traverse/lib/context.js:68:17)

Node.js v24.15.0
       74.55 real        94.27 user         5.88 sys
          6670696448  maximum resident set size
                   0  average shared memory size
                   0  average unshared data size
                   0  average unshared stack size
              607047  page reclaims
                 118  page faults
                   0  swaps
                   0  block input operations
                   0  block output operations
                   0  messages sent
                   0  messages received
                   0  signals received
                   1  voluntary context switches
              143181  involuntary context switches
        966153518101  instructions retired
        333988054580  cycles elapsed
          7159583376  peak memory footprint

Looks like it ran for ~74.55sec before crashing from this bug, and used ~6.21GB of RAM before it crashed.

Trying again, but this time using wakaru's new Rust rewrite:

⇒ npx @wakaru/cli --version
wakaru 1.0.0

⇒ /usr/bin/time -l npx @wakaru/cli web.e379f5893cb32b3b.js --unpack -o out/
# ..snip..
total: 15944 module(s)

       11.33 real        22.23 user         5.80 sys
           652591104  maximum resident set size
                   0  average shared memory size
                   0  average unshared data size
                   0  average unshared stack size
               51215  page reclaims
                 560  page faults
                   0  swaps
                   0  block input operations
                   0  block output operations
                  22  messages sent
                  44  messages received
                   0  signals received
                1537  voluntary context switches
              124293  involuntary context switches
          3161711315  instructions retired
          1239719274  cycles elapsed
            52780016  peak memory footprint

So looks like for the ~20mb web*.js file, it ran in wakaru's new Rust rewrite in ~11.33sec and maxed out at ~622 MiB RAM.

---

See Also

• De-Obfuscate large .js Files #197
• Conversation to desktop application #211
• etc

And tangentially related:

• Improving performance with transpilers or compilers #24

[malvoapoc]

Did you find a solution?

[0xdevalias]

Did you find a solution?

@malvoapoc Have you tried increasing the heap size as mentioned in #204 (comment) ?

[malvoapoc]

Did you find a solution?

@malvoapoc Have you tried increasing the heap size as mentioned in #204 (comment) ?

I tried it, but it doesn't work.

[0xdevalias]

I tried it, but it doesn't work.

@malvoapoc Assuming this is the ~70mb bundle mentioned in your other issue? Is it something that you're able to share, or that is public somewhere so I could test it myself?

[malvoapoc]

I tried it, but it doesn't work.

@malvoapoc Assuming this is the ~70mb bundle mentioned in your other issue? Is it something that you're able to share, or that is public somewhere so I could test it myself?

This is the project address: js-deobfuscator-demo

[0xdevalias]

I tried it, but it doesn't work.

Assuming this is the ~70mb bundle mentioned in your other issue? Is it something that you're able to share, or that is public somewhere so I could test it myself?

This is the project address: https://github.com/malvoapoc/js-deobfuscator-demo

@malvoapoc Thanks. I was able to deobfuscate it by setting NODE_OPTIONS="--max-old-space-size=16384", though it only seemed to peak around ~10.5GB of heap usage.

Note that neither webcrack nor wakaru seemed to properly detect / unbundle the Webpack 5 bundle + UMD library wrapper though; see the following issues for that:

• [bundleDetection/unpacker] Improve Webpack 5 bundle + UMD library wrapper support #221
• [bundleDetection/unpacker] Improve Webpack 5 bundle + UMD library wrapper support pionxzh/wakaru#171
  • [bundleDetection/unpacker] Support 'raw' AMD / UMD / RequireJS / etc patterns pionxzh/wakaru#160

tl;dr

You should be able to run it in ~2min or less, using ~10.5GB or so max heap (though with the actual limit set to 16GB) using:

NODE_OPTIONS="--max-old-space-size=16384" npx webcrack@latest --no-unpack malvoapoc-js-deobfuscator-demo.js > malvoapoc-js-deobfuscator-demo-deobfuscated.js

Or attempting to also unpack the bundle (which doesn't work currently) using:

NODE_OPTIONS="--max-old-space-size=16384" npx webcrack@latest malvoapoc-js-deobfuscator-demo.js -o out-webcrack

Which gave me this ~5.6mb file after deobfuscation:

• deobfuscated.js

Note that neither webcrack or wakaru currently seem to detect / unbundle the Webpack 5 bundle + UMD library wrapper that becomes visible after deobfuscation.

---

While the above summarises my findings; see below for the full explorations I did along the way.

---

Deep Dive

Setup, Methodology and Tool Versions

We can see what node's current heap memory size allowed is with:

⇒ node -e 'console.log(require("v8").getHeapStatistics().heap_size_limit / 1024 / 1024)'
4288

And then we can check that it is being increased by the NODE_OPTIONS="--max-old-space-size=8192" we pass through with:

⇒ NODE_OPTIONS="--max-old-space-size=8192" node -e 'console.log(require("v8").getHeapStatistics().heap_size_limit / 1024 / 1024)'
8384

⇒ NODE_OPTIONS="--max-old-space-size=8192" npx node -e 'console.log(require("v8").getHeapStatistics().heap_size_limit / 1024 / 1024)'
8384

By using /usr/bin/time -l to run webcrack, we can see some stats about the how much memory it used, with "maximum resident set size" and "peak memory footprint" being most interesting:

⇒ /usr/bin/time -l npx webcrack@latest --version
2.16.0
        0.49 real         0.33 user         0.11 sys
           111165440  maximum resident set size
                   0  average shared memory size
                   0  average unshared data size
                   0  average unshared stack size
               14182  page reclaims
                 189  page faults
                   0  swaps
                   0  block input operations
                   0  block output operations
                  22  messages sent
                  44  messages received
                   0  signals received
                   3  voluntary context switches
                2429  involuntary context switches
          2598027224  instructions retired
          1012846536  cycles elapsed
            61922552  peak memory footprint

This shows:

• maximum resident set size: 111165440 / 1024 / 1024 ~= 106.02 MiB
• peak memory footprint: 61922552 / 1024 / 1024 ~= 59.05 MiB

These are the node / webcrack versions I am using + the size of the input file:

⇒ node --version
v24.15.0

⇒ npx webcrack@latest --version
2.16.0

⇒ du -sh malvoapoc-js-deobfuscator-demo.js             
 72M  malvoapoc-js-deobfuscator-demo.js

Webcrack with default ~4GB heap size + --no-unpack --no-unminify = [Error: FatalProcessOutOfMemory] in ~15.55sec

We can then run webcrack (with --no-unpack --no-unminify to reduce the work it is needing to do) with the default heap size (~4GB) like below, which as we expect, errors due to v8::internal::V8::FatalProcessOutOfMemory after ~15.55sec:

⇒ /usr/bin/time -l npx webcrack@latest --no-unpack --no-unminify malvoapoc-js-deobfuscator-demo.js > malvoapoc-js-deobfuscator-demo-deobfuscated.js
  webcrack:transforms prepare: started +0ms

<--- Last few GCs --->

[42801:0x74740c000]    14551 ms: Mark-Compact 4083.3 (4105.9) -> 4075.4 (4105.7) MB, pooled: 1 MB, 568.46 / 0.00 ms  (average mu = 0.311, current mu = 0.231) allocation failure; scavenge might not succeed
[42801:0x74740c000]    15141 ms: Mark-Compact 4083.4 (4105.7) -> 4075.5 (4105.9) MB, pooled: 0 MB, 587.83 / 0.00 ms  (average mu = 0.177, current mu = 0.004) allocation failure; scavenge might not succeed

FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory

----- Native stack trace -----

 1: 0x1022c1aec node::OOMErrorHandler(char const*, v8::OOMDetails const&) [~/.nodenv/versions/24.15.0/bin/node]
 2: 0x102514314 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [~/.nodenv/versions/24.15.0/bin/node]
 3: 0x102773700 v8::internal::Heap::stack() [~/.nodenv/versions/24.15.0/bin/node]
 4: 0x102776ad4 v8::internal::Heap::HasLowYoungGenerationAllocationRate() [~/.nodenv/versions/24.15.0/bin/node]
 5: 0x102787cc8 v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags)::$_1::operator()() const [~/.nodenv/versions/24.15.0/bin/node]

..snip..

time: command terminated abnormally
       15.55 real        48.45 user         3.24 sys
          4528766976  maximum resident set size
                   0  average shared memory size
                   0  average unshared data size
                   0  average unshared stack size
              347482  page reclaims
                 212  page faults
                   0  swaps
                   0  block input operations
                   0  block output operations
                  22  messages sent
                  44  messages received
                   1  signals received
                   3  voluntary context switches
               67134  involuntary context switches
          2581959007  instructions retired
           974450610  cycles elapsed
            61398192  peak memory footprint
zsh: abort      /usr/bin/time -l npx webcrack@latest --no-unpack --no-unminify  > 

• maximum resident set size: 4528766976 / 1024 / 1024 ~= 4318.97 MiB
• peak memory footprint: 61398192 / 1024 / 1024 ~= 58.55 MiB

Webcrack with ~8GB heap size + --no-unpack --no-unminify = [Error: FatalProcessOutOfMemory] in ~83.75sec

Increasing the heap size to ~8GB (NODE_OPTIONS="--max-old-space-size=8192"), we try again, and see that it gets further, but ultimately still errors with v8::internal::V8::FatalProcessOutOfMemory after ~83.75sec (~1min 23.75sec):

⇒ NODE_OPTIONS="--max-old-space-size=8192" /usr/bin/time -l npx webcrack@latest --no-unpack --no-unminify malvoapoc-js-deobfuscator-demo.js > malvoapoc-js-deobfuscator-demo-deobfuscated.js
  webcrack:transforms prepare: started +0ms
  webcrack:transforms prepare: finished with 22429 changes +16s
  webcrack:transforms deobfuscate: started +0ms
  webcrack:deobfuscate String Array: a0_0x28ef, length 287696 +0ms
  webcrack:deobfuscate String Array Rotate: yes +1ms
  webcrack:deobfuscate String Array Decoders: a0_0x5754 +7ms
  webcrack:transforms inline-object-props: started +26s
  webcrack:transforms inline-object-props: finished with 12397 changes +9s
  webcrack:transforms inline-decoder-wrappers: started +0ms

<--- Last few GCs --->

[47119:0x84580c000]    80585 ms: Scavenge (interleaved) 8115.6 (8197.0) -> 8105.5 (8198.7) MB, pooled: 0 MB, 19.75 / 0.00 ms  (average mu = 0.234, current mu = 0.163) allocation failure; 
[47119:0x84580c000]    83122 ms: Mark-Compact (reduce) 8122.6 (8204.0) -> 8109.3 (8177.2) MB, pooled: 0 MB, 1100.21 / 0.00 ms  (+ 1340.0 ms in 267 steps since start of marking, biggest step 5.1 ms, walltime since start of marking 2490 ms) (average mu = 0.
FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----

 1: 0x103119aec node::OOMErrorHandler(char const*, v8::OOMDetails const&) [~/.nodenv/versions/24.15.0/bin/node]
 2: 0x10336c314 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [~/.nodenv/versions/24.15.0/bin/node]
 3: 0x1035cb700 v8::internal::Heap::stack() [~/.nodenv/versions/24.15.0/bin/node]
 4: 0x1035cead4 v8::internal::Heap::HasLowYoungGenerationAllocationRate() [~/.nodenv/versions/24.15.0/bin/node]
 5: 0x1035dfcc8 v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags)::$_1::operator()() const [~/.nodenv/versions/24.15.0/bin/node]

..snip..

time: command terminated abnormally
       83.75 real       199.29 user        11.23 sys
          8981184512  maximum resident set size
                   0  average shared memory size
                   0  average unshared data size
                   0  average unshared stack size
              772650  page reclaims
                 191  page faults
                   0  swaps
                   0  block input operations
                   0  block output operations
                  22  messages sent
                  44  messages received
                   1  signals received
                   5  voluntary context switches
              220157  involuntary context switches
          2639372842  instructions retired
          1042624567  cycles elapsed
            61234184  peak memory footprint
zsh: abort      NODE_OPTIONS="--max-old-space-size=8192" /usr/bin/time -l npx webcrack@latest

• maximum resident set size: 8981184512 / 1024 / 1024 ~= 8565.13 MiB
• peak memory footprint: 61234184 / 1024 / 1024 ~= 58.40 MiB

Webcrack with ~16GB heap size + --no-unpack --no-unminify = [Deobfuscate: Success, Unminify: Skipped, Unpack: Skipped] in ~116.40sec

Increasing the heap size again to ~16GB (NODE_OPTIONS="--max-old-space-size=16384"), we try again, and see that this time it completes successfully in ~116.40sec (~1min 56.4sec):

⇒ NODE_OPTIONS="--max-old-space-size=16384" /usr/bin/time -l npx webcrack@latest --no-unpack --no-unminify malvoapoc-js-deobfuscator-demo.js > malvoapoc-js-deobfuscator-demo-deobfuscated.js
  webcrack:transforms prepare: started +0ms
  webcrack:transforms prepare: finished with 22429 changes +16s
  webcrack:transforms deobfuscate: started +1ms
  webcrack:deobfuscate String Array: a0_0x28ef, length 287696 +0ms
  webcrack:deobfuscate String Array Rotate: yes +1ms
  webcrack:deobfuscate String Array Decoders: a0_0x5754 +6ms
  webcrack:transforms inline-object-props: started +21s
  webcrack:transforms inline-object-props: finished with 12397 changes +7s
  webcrack:transforms inline-decoder-wrappers: started +0ms
  webcrack:transforms inline-decoder-wrappers: finished with 563819 changes +48s
  webcrack:transforms inline-decoded-strings: started +35ms
  webcrack:transforms inline-decoded-strings: finished with 541115 changes +12s
  webcrack:transforms merge-strings, dead-code, control-flow-object, control-flow-switch: started +0ms
  webcrack:transforms merge-strings: started +6ms
  webcrack:transforms merge-strings: finished with 0 changes +0ms

  ..snip.. (skipping another ~547 calls to merge-strings)

  webcrack:transforms merge-strings: started +0ms
  webcrack:transforms merge-strings: finished with 0 changes +0ms
  webcrack:transforms merge-strings, dead-code, control-flow-object, control-flow-switch: finished with 455790 changes +0ms
  webcrack:transforms deobfuscate: finished with 1573124 changes +0ms
  webcrack:transforms self-defending, debug-protection, jsx, jsx-new: started +0ms
  webcrack:transforms self-defending, debug-protection, jsx, jsx-new: finished with 8 changes +436ms
  webcrack:transforms merge-object-assignments, evaluate-globals: started +0ms
  webcrack:transforms merge-object-assignments, evaluate-globals: finished with 17374 changes +4s
      116.40 real       142.30 user        13.14 sys
         10955522048  maximum resident set size
                   0  average shared memory size
                   0  average unshared data size
                   0  average unshared stack size
              976499  page reclaims
                 306  page faults
                   0  swaps
                   0  block input operations
                   0  block output operations
                  22  messages sent
                  44  messages received
                   0  signals received
                1688  voluntary context switches
              235837  involuntary context switches
          2781538554  instructions retired
          1142179074  cycles elapsed
            61070488  peak memory footprint

• maximum resident set size: 10955522048 / 1024 / 1024 ~= 10,448 MiB
• peak memory footprint: 61070488 / 1024 / 1024 ~= 58.24 MiB

Looking at the "maximum resident set size", it looks like we probably only needed ~10.5GB heap size to run this; and gives us this output file:

⇒ du -sh malvoapoc-js-deobfuscator-demo-deobfuscated.js
5.4M  malvoapoc-js-deobfuscator-demo-deobfuscated.js

Webcrack with ~16GB heap size + --no-unminify = [Deobfuscate: Success, Unminify: Skipped, Unpack: Fail] in ~110.05sec

So now that we know we can run it with --no-unpack --no-unminify with ~16GB heap size in ~1min 56sec; lets see if unpack works with it (while still using --no-unminify for now), which it technically does (in ~110.05sec / ~1min 50.05sec), but doesn't seem to detect a bundle to split, so the output is basically the same as before:

⇒ NODE_OPTIONS="--max-old-space-size=16384" /usr/bin/time -l npx webcrack@latest --no-unminify malvoapoc-js-deobfuscator-demo.js -o out-webcrack-no-unminify            
  webcrack:transforms prepare: started +0ms
  webcrack:transforms prepare: finished with 22429 changes +16s
  webcrack:transforms deobfuscate: started +0ms
  webcrack:deobfuscate String Array: a0_0x28ef, length 287696 +0ms
  webcrack:deobfuscate String Array Rotate: yes +2ms
  webcrack:deobfuscate String Array Decoders: a0_0x5754 +5ms
  webcrack:transforms inline-object-props: started +20s
  webcrack:transforms inline-object-props: finished with 12397 changes +7s
  webcrack:transforms inline-decoder-wrappers: started +0ms
  webcrack:transforms inline-decoder-wrappers: finished with 563819 changes +48s
  webcrack:transforms inline-decoded-strings: started +49ms
  webcrack:transforms inline-decoded-strings: finished with 541115 changes +6s
  webcrack:transforms merge-strings, dead-code, control-flow-object, control-flow-switch: started +0ms
  webcrack:transforms merge-strings: started +7ms
  webcrack:transforms merge-strings: finished with 0 changes +0ms

  ..snip..
  
  webcrack:transforms merge-strings: started +0ms
  webcrack:transforms merge-strings: finished with 0 changes +0ms
  webcrack:transforms merge-strings, dead-code, control-flow-object, control-flow-switch: finished with 455790 changes +1ms
  webcrack:transforms deobfuscate: finished with 1573124 changes +0ms
  webcrack:transforms self-defending, debug-protection, jsx, jsx-new: started +0ms
  webcrack:transforms self-defending, debug-protection, jsx, jsx-new: finished with 8 changes +425ms
  webcrack:transforms merge-object-assignments, evaluate-globals: started +0ms
  webcrack:transforms merge-object-assignments, evaluate-globals: finished with 17374 changes +4s
      110.05 real       141.15 user        12.14 sys
         11071094784  maximum resident set size
                   0  average shared memory size
                   0  average unshared data size
                   0  average unshared stack size
              805509  page reclaims
                 296  page faults
                   0  swaps
                   0  block input operations
                   0  block output operations
                  22  messages sent
                  44  messages received
                   0  signals received
                1861  voluntary context switches
              197413  involuntary context switches
          2791622476  instructions retired
          1117930482  cycles elapsed
            60824632  peak memory footprint

• maximum resident set size: 11071094784 / 1024 / 1024 ~= 10,558.22 MiB
• peak memory footprint: 60824632 / 1024 / 1024 ~= 58.01 MiB

⇒ du -sh out-webcrack-no-unminify/*
5.4M  out-webcrack-no-unminify/deobfuscated.js

Though there does seem to be at least some minor differences between the two output files:

 ⇒ wc -l malvoapoc-js-deobfuscator-demo-deobfuscated.js out-webcrack-no-unminify/deobfuscated.js 
   98929 malvoapoc-js-deobfuscator-demo-deobfuscated.js
   98928 out-webcrack-no-unminify/deobfuscated.js
  197857 total

⇒ sha256sum malvoapoc-js-deobfuscator-demo-deobfuscated.js out-webcrack-no-unminify/deobfuscated.js 
dba05a68aba8819caf25c6c7ba2eab82f80f1b0533dcdcf4ebc69e9b214a0a16  malvoapoc-js-deobfuscator-demo-deobfuscated.js
45b9db5925b38db0cff1757cfa9ab11ad3dc04099c90a487b106b2b3c4230717  out-webcrack-no-unminify/deobfuscated.js

Which turned out to be a newline at the end of one of the files:

⇒ diff -u \
  malvoapoc-js-deobfuscator-demo-deobfuscated.js \
  out-webcrack-no-unminify/deobfuscated.js
--- malvoapoc-js-deobfuscator-demo-deobfuscated.js  2026-06-02 16:38:36
+++ out-webcrack-no-unminify/deobfuscated.js  2026-06-02 16:46:47
@@ -98926,4 +98926,4 @@
     _0x4e44fc = window;
   }
   _0x4e44fc["setInterval"](_0x7dd4b, -0x2 * 0xbda + -0x168 * 0xa + 0x95 * 0x84);
-})();
+})();
\ No newline at end of file

Looking closer at the deobfuscated code, it looks like it is probably a Webpack 5 bundle, wrapped in a UMD library wrapper, so I would have expected webcrack should be able to unpack it:

!function (_0x2fd67b, _0x59f64d) {
  if ("object" == typeof exports && "object" == typeof module) {
    module["exports"] = _0x59f64d();
  } else {
    if ("function" == typeof define && define["amd"]) {
      define([], _0x59f64d);
    } else {
      var _0x402612 = _0x59f64d();
      for (var _0x477fb8 in _0x402612) {
        ("object" == typeof exports ? exports : _0x2fd67b)[_0x477fb8] = _0x402612[_0x477fb8];
      }
    }
  }
}(self, () => (() => {
  'use strict';

  var _0x4f4627;
  var _0x19c793;
  var _0x4bbc02;
  var _0x4e4bce = {
    0x112b(_0x4c82b3, _0x1200af, _0x4dda60) {

Wakaru unpack/unminify already deobfuscated = [..., Unminify: Success, Unpack: Fail] in ~1.19sec

Trying with wakaru (after the deobfuscation) also didn't seem to manage it, running in ~1.19sec, but only outputting a single file:

⇒ npx @wakaru/cli@latest --version                                        
wakaru 1.3.0

⇒ /usr/bin/time -l npx @wakaru/cli@latest malvoapoc-js-deobfuscator-demo-deobfuscated.js --unpack -o out-wakaru
total: 1 module(s)
        1.19 real         0.99 user         0.12 sys
           164790272  maximum resident set size
                   0  average shared memory size
                   0  average unshared data size
                   0  average unshared stack size
               22255  page reclaims
                 182  page faults
                   0  swaps
                   0  block input operations
                   0  block output operations
                  22  messages sent
                  44  messages received
                   0  signals received
                   5  voluntary context switches
                2027  involuntary context switches
          2504530054  instructions retired
           941781152  cycles elapsed
            61201680  peak memory footprint

• maximum resident set size: 164790272 / 1024 / 1024 ~= 157.16 MiB
• peak memory footprint: 61201680 / 1024 / 1024 ~= 58.37 MiB

⇒ du -sh out-wakaru/*
4.9M  out-wakaru/module.js

⇒ wc -l out-wakaru/module.js 
   47727 out-wakaru/module.js

⇒ sha256sum out-wakaru/module.js 
6f89f3fe5262e486b9534d23433e1c5eb86b2cbd460fa152783a3c8903e04044  out-wakaru/module.js

We can see that while it did manage some more transforms to change things a little, the Webpack 5 bundle + UMD library wrapper are still present:

!((_0x2fd67b, _0x59f64d)=>{
    if (typeof exports === "object" && typeof module === "object") {
        module.exports = _0x59f64d();
    } else {
        if (typeof define === "function" && define.amd) {
            define([], _0x59f64d);
        } else {
            const _0x402612 = _0x59f64d();
            for(const _0x477fb8 in _0x402612){
                (typeof exports === "object" ? exports : _0x2fd67b)[_0x477fb8] = _0x402612[_0x477fb8];
            }
        }
    }
})(self, ()=>(()=>{
        var _0x4f4627;
        var _0x19c793;
        var _0x4bbc02;
        var _0x4e4bce = {
            0x112b (_0x4c82b3, _0x1200af, _0x4dda60) {

Webcrack with ~16GB heap size = [Deobfuscate: Success, Unminify: Success, Unpack: Fail] in ~113.68 sec

So now that we know we can run it with both unpack and --no-unminify enabled, with ~16GB heap size in ~1min 50.05sec; lets see if unpack + unminify works, which it technically does (in ~113.68 sec / ~1min 53.68sec), but still doesn't seem to detect a bundle to split, so the output is basically the same as before:

⇒ NODE_OPTIONS="--max-old-space-size=16384" /usr/bin/time -l npx webcrack@latest malvoapoc-js-deobfuscator-demo.js -o out-webcrack            
  webcrack:transforms prepare: started +0ms
  webcrack:transforms prepare: finished with 22429 changes +16s
  webcrack:transforms deobfuscate: started +0ms
  webcrack:deobfuscate String Array: a0_0x28ef, length 287696 +0ms
  webcrack:deobfuscate String Array Rotate: yes +5ms
  webcrack:deobfuscate String Array Decoders: a0_0x5754 +6ms
  webcrack:transforms inline-object-props: started +20s
  webcrack:transforms inline-object-props: finished with 12397 changes +7s
  webcrack:transforms inline-decoder-wrappers: started +0ms
  webcrack:transforms inline-decoder-wrappers: finished with 563819 changes +47s
  webcrack:transforms inline-decoded-strings: started +35ms
  webcrack:transforms inline-decoded-strings: finished with 541115 changes +10s
  webcrack:transforms merge-strings, dead-code, control-flow-object, control-flow-switch: started +0ms
  webcrack:transforms merge-strings: started +8ms
  webcrack:transforms merge-strings: finished with 0 changes +0ms

  ..snip..
  
  webcrack:transforms merge-strings: started +0ms
  webcrack:transforms merge-strings: finished with 0 changes +0ms
  webcrack:transforms merge-strings, dead-code, control-flow-object, control-flow-switch: finished with 455790 changes +0ms
  webcrack:transforms deobfuscate: finished with 1573124 changes +0ms
  webcrack:transforms transpile, unminify: started +0ms
  webcrack:transforms transpile, unminify: finished with 169028 changes +2s
  webcrack:transforms self-defending, debug-protection, jsx, jsx-new: started +0ms
  webcrack:transforms self-defending, debug-protection, jsx, jsx-new: finished with 581 changes +444ms
  webcrack:transforms merge-object-assignments, evaluate-globals: started +0ms
  webcrack:transforms merge-object-assignments, evaluate-globals: finished with 17389 changes +4s
      113.68 real       142.23 user        13.17 sys
         11069980672  maximum resident set size
                   0  average shared memory size
                   0  average unshared data size
                   0  average unshared stack size
              962959  page reclaims
                 227  page faults
                   0  swaps
                   0  block input operations
                   0  block output operations
                  22  messages sent
                  44  messages received
                   0  signals received
                 315  voluntary context switches
              211546  involuntary context switches
          2741954578  instructions retired
          1108516843  cycles elapsed
            62004712  peak memory footprint

• maximum resident set size: 11069980672 / 1024 / 1024 ~= 10,557.16 MiB
• peak memory footprint: 62004712 / 1024 / 1024 ~= 59.13 MiB

⇒ du -sh out-webcrack/*
5.0M  out-webcrack/deobfuscated.js

⇒ wc -l out-webcrack/deobfuscated.js 
   99140 out-webcrack/deobfuscated.js

⇒ sha256sum out-webcrack/deobfuscated.js 
57064b5614907170d2740e718204fc68f7bf8945a496f1cdf6d3358eadf4010d  out-webcrack/deobfuscated.js