JavaScript Control Flow Deobfuscator

Control flow deobfuscation is the process of reversingcontrol-flow flattening, an advanced obfuscation technique that transforms a program's natural branching structure (if/else statements, loops, conditional returns) into a state-machine dispatcher. Instead of readable conditional logic, the code uses a state variable and a dispatcher loop (typically while(true) wrapping a switch statement) to control execution flow. Each block of code becomes a case in the switch, and transitions between blocks are controlled by changing the state variable. Our control flow deobfuscator detects these patterns, maps the state transitions, and helps reconstruct the original branching logic - making the code much easier to understand and analyze.

1. 1. Paste Flattened JavaScript Code: Paste obfuscated JavaScript code that uses control-flow flattening into the input panel. The tool scans for dispatcher patterns including while(true) andfor loops containing switch statements with a state variable. Click "Load example flattened code" to try it with a realistic sample that demonstrates all common flattening patterns.
2. 2. Click Analyze Control Flow: The deobfuscator identifies the dispatcher pattern, extracts the state variable name, finds all case labels, and maps state assignments. It generates a completestate-to-block mapping showing each state value, the code block it controls, and all transitions to other states. A transition diagram is automatically generated showing the flow between states.
3. 3. Review State Transition Analysis: The analysis panel shows the transition diagram and statistics including dispatcher type, state count, and number of state assignments. The interactive state mapping table provides detailed information about each state: its value, the code block summary, and all destination states - helping you understand the reconstructed branching logic.

• While-True Dispatcher: The most common pattern useswhile(true) { switch(state) { ... } }. The loop never terminates naturally; instead, state transitions control which case executes next. This is the pattern used by popular obfuscators like JavaScript Obfuscator and Jscrambler.
• For-Loop Dispatcher: Some obfuscators use a for loop as the dispatcher instead of while(true), sometimes with a loop counter that doubles as the state variable. The deobfuscator detects these alternative dispatcher patterns as well.
• Loop Wrapper Variations: Other loop types like do...whileand nested loop structures wrapping switch statements are also detected. The tool identifies the state variable and maps all case blocks regardless of the outer loop structure.
• State Assignments & Transitions: Each state block's transitions are tracked by finding all assignments to the state variable within each case block. The transition diagram shows the complete flow graph from entry to terminal states.

The control flow deobfuscator is 100% free withno signup required. All code analysis is performedlocally in your browser using pattern matching - your obfuscated code and analysis results never leave your device. There areno file size limits or usage caps. Note that this tool performspattern-based detection, not full semantic reconstruction. Complex obfuscation with multiple layers or runtime-generated state values may require additional analysis passes. For complete deobfuscation, combine with other tools like the JavaScript Deobfuscator/Unpacker for hex string decoding and the Variable Name Deobfuscator for identifier restoration. Always keep your original, readable source code backed up in version control.