# Deobfuscate JavaScript with SpiderMonkey
> Execute obfuscated JS safely using SpiderMonkey with API simulation

**Tools:** [[tools/js-beautify|js-beautify]], [[tools/spidermonkey|spidermonkey]]
**FOR610 Lab:** 3.6, 3.7

## Commands
```bash
# Beautify compressed JavaScript
js-beautify <malicious.js> > readable.js
# Execute with objects.js to simulate browser/WScript APIs
js -f /usr/share/remnux/objects.js -f <malicious.js> > decoded.js
# If script expects location.href, edit objects.js first:
cp /usr/share/remnux/objects.js .
# Edit objects.js to set: location = { href: 'http://expected-url' }
js -f objects.js -f <malicious.js> > decoded.js
```

#recipe #js-beautify #spidermonkey