pyjsclear 0.1.0__py3-none-any.whl

pyjsclear/__init__.py

@@ -0,0 +1,47 @@
+"""Pure Python JavaScript deobfuscation library.
+
+Combines functionality from obfuscator-io-deobfuscator (13 AST transforms)
+and javascript-deobfuscator (3 surface-cleanup modules) into a single
+Python package with no Node.js dependency.
+"""
+
+from .deobfuscator import Deobfuscator
+
+
+__version__ = '0.1.0'
+
+
+def deobfuscate(code, max_iterations=50):
+    """Deobfuscate JavaScript code. Returns cleaned source.
+
+    Args:
+        code: JavaScript source code string.
+        max_iterations: Maximum transform passes (default 50).
+
+    Returns:
+        Deobfuscated JavaScript source code.
+    """
+    return Deobfuscator(code, max_iterations=max_iterations).execute()
+
+
+def deobfuscate_file(input_path, output_path=None, max_iterations=50):
+    """Deobfuscate a JavaScript file.
+
+    Args:
+        input_path: Path to input JS file.
+        output_path: Path to write output (if None, returns string).
+        max_iterations: Maximum transform passes.
+
+    Returns:
+        True if content changed (when output_path given), or the deobfuscated string.
+    """
+    with open(input_path, 'r', errors='replace') as f:
+        code = f.read()
+
+    result = deobfuscate(code, max_iterations=max_iterations)
+
+    if output_path:
+        with open(output_path, 'w') as f:
+            f.write(result)
+        return result != code
+    return result

pyjsclear/__main__.py

@@ -0,0 +1,37 @@
+"""CLI entry point: python -m pyjsclear input.js [-o output.js]"""
+
+import argparse
+import sys
+
+from . import deobfuscate
+
+
+def main():
+    parser = argparse.ArgumentParser(description='Deobfuscate JavaScript files.')
+    parser.add_argument('input', help='Input JS file (use - for stdin)')
+    parser.add_argument('-o', '--output', help='Output file (default: stdout)')
+    parser.add_argument(
+        '--max-iterations',
+        type=int,
+        default=50,
+        help='Maximum transform passes (default: 50)',
+    )
+    args = parser.parse_args()
+
+    if args.input == '-':
+        code = sys.stdin.read()
+    else:
+        with open(args.input, 'r', errors='replace') as input_file:
+            code = input_file.read()
+
+    result = deobfuscate(code, max_iterations=args.max_iterations)
+
+    if args.output:
+        with open(args.output, 'w') as output_file:
+            output_file.write(result)
+    else:
+        sys.stdout.write(result)
+
+
+if __name__ == '__main__':
+    main()

pyjsclear/deobfuscator.py

@@ -0,0 +1,191 @@
+"""Multi-pass deobfuscation orchestrator."""
+
+from .generator import generate
+from .parser import parse
+from .transforms.aa_decode import aa_decode
+from .transforms.aa_decode import is_aa_encoded
+from .transforms.anti_tamper import AntiTamperRemover
+from .transforms.constant_prop import ConstantProp
+from .transforms.control_flow import ControlFlowRecoverer
+from .transforms.dead_branch import DeadBranchRemover
+from .transforms.eval_unpack import eval_unpack
+from .transforms.eval_unpack import is_eval_packed
+from .transforms.expression_simplifier import ExpressionSimplifier
+from .transforms.hex_escapes import HexEscapes
+from .transforms.hex_escapes import decode_hex_escapes_source
+from .transforms.jj_decode import is_jj_encoded
+from .transforms.jj_decode import jj_decode
+from .transforms.jj_decode import jj_decode_via_eval
+from .transforms.jsfuck_decode import is_jsfuck
+from .transforms.jsfuck_decode import jsfuck_decode
+from .transforms.logical_to_if import LogicalToIf
+from .transforms.object_packer import ObjectPacker
+from .transforms.object_simplifier import ObjectSimplifier
+from .transforms.property_simplifier import PropertySimplifier
+from .transforms.proxy_functions import ProxyFunctionInliner
+from .transforms.reassignment import ReassignmentRemover
+from .transforms.sequence_splitter import SequenceSplitter
+from .transforms.string_revealer import StringRevealer
+from .transforms.unused_vars import UnusedVariableRemover
+from .traverser import simple_traverse
+
+
+# StringRevealer runs first to handle string arrays before other transforms
+# modify the wrapper function structure.
+# Remaining transforms follow obfuscator-io-deobfuscator order.
+TRANSFORM_CLASSES = [
+    StringRevealer,
+    HexEscapes,
+    UnusedVariableRemover,
+    ConstantProp,
+    ReassignmentRemover,
+    DeadBranchRemover,
+    ObjectPacker,
+    ProxyFunctionInliner,
+    SequenceSplitter,
+    ExpressionSimplifier,
+    LogicalToIf,
+    ControlFlowRecoverer,
+    PropertySimplifier,
+    AntiTamperRemover,
+    ObjectSimplifier,
+    StringRevealer,
+]
+
+# Expensive transforms to skip in lite mode (large files)
+_EXPENSIVE_TRANSFORMS = {ControlFlowRecoverer, ProxyFunctionInliner, ObjectPacker}
+
+# Large file thresholds
+_LARGE_FILE_SIZE = 500_000  # 500KB - reduce iterations
+_MAX_CODE_SIZE = 2_000_000  # 2MB - use lite mode
+_LITE_MAX_ITERATIONS = 10
+_NODE_COUNT_LIMIT = 50_000  # Skip ControlFlowRecoverer above this
+
+
+def _count_nodes(ast):
+    """Count total AST nodes."""
+    count = 0
+
+    def cb(node, parent):
+        nonlocal count
+        count += 1
+
+    simple_traverse(ast, cb)
+    return count
+
+
+class Deobfuscator:
+    """Multi-pass JavaScript deobfuscator."""
+
+    def __init__(self, code, max_iterations=50):
+        self.original_code = code
+        self.max_iterations = max_iterations
+
+    def _run_pre_passes(self, code):
+        """Run encoding detection and eval unpacking pre-passes.
+
+        Returns decoded code if an encoding/packing was detected and decoded,
+        or None to continue with the normal AST pipeline.
+        """
+        # JSFUCK check (must be first — these are whole-file encodings)
+        if is_jsfuck(code):
+            decoded = jsfuck_decode(code)
+            if decoded:
+                return decoded
+
+        # AAEncode check
+        if is_aa_encoded(code):
+            decoded = aa_decode(code)
+            if decoded:
+                return decoded
+
+        # JJEncode check
+        if is_jj_encoded(code):
+            decoded = jj_decode(code) or jj_decode_via_eval(code)
+            if decoded:
+                return decoded
+
+        # Eval packer check
+        if is_eval_packed(code):
+            decoded = eval_unpack(code)
+            if decoded:
+                return decoded
+
+        return None
+
+    def execute(self):
+        """Run all transforms and return cleaned source."""
+        code = self.original_code
+
+        # Pre-pass: encoding detection and eval unpacking
+        decoded = self._run_pre_passes(code)
+        if decoded:
+            # Feed decoded result back through the full pipeline for further cleanup
+            sub = Deobfuscator(decoded, max_iterations=self.max_iterations)
+            return sub.execute()
+
+        # Try to parse; if it fails, apply source-level hex decoding as fallback
+        try:
+            ast = parse(code)
+        except SyntaxError:
+            # Source-level hex decode for unparseable files (e.g. ES modules)
+            decoded = decode_hex_escapes_source(code)
+            if decoded != code:
+                return decoded
+            return self.original_code
+
+        # Determine optimization mode based on code size
+        code_size = len(code)
+        lite_mode = code_size > _MAX_CODE_SIZE
+        max_iterations = self.max_iterations
+        if code_size > _LARGE_FILE_SIZE:
+            max_iterations = min(max_iterations, _LITE_MAX_ITERATIONS)
+
+        # Check node count for expensive transform gating
+        node_count = _count_nodes(ast) if code_size > _LARGE_FILE_SIZE else 0
+
+        # For very large ASTs, further reduce iterations
+        if node_count > 100_000:
+            max_iterations = min(max_iterations, 3)
+
+        # Build transform list based on mode
+        transform_classes = TRANSFORM_CLASSES
+        if lite_mode:
+            transform_classes = [t for t in TRANSFORM_CLASSES if t not in _EXPENSIVE_TRANSFORMS]
+        elif node_count > _NODE_COUNT_LIMIT:
+            transform_classes = [t for t in TRANSFORM_CLASSES if t not in _EXPENSIVE_TRANSFORMS]
+
+        # Track which transforms are no longer productive
+        skip_transforms = set()
+
+        # Multi-pass transform loop
+        any_transform_changed = False
+        for i in range(max_iterations):
+            modified = False
+            for transform_class in transform_classes:
+                if transform_class in skip_transforms:
+                    continue
+                try:
+                    transform = transform_class(ast)
+                    result = transform.execute()
+                except Exception:
+                    continue
+                if result:
+                    modified = True
+                    any_transform_changed = True
+                else:
+                    # If a transform didn't change anything after the first pass,
+                    # skip it in subsequent iterations
+                    if i > 0:
+                        skip_transforms.add(transform_class)
+
+            if not modified:
+                break
+
+        if not any_transform_changed:
+            return self.original_code
+
+        try:
+            return generate(ast)
+        except Exception:
+            return self.original_code