pyjsclear 0.1.0__tar.gz → 0.1.2__tar.gz

pyjsclear-0.1.2/PKG-INFO

@@ -0,0 +1,126 @@
+Metadata-Version: 2.4
+Name: pyjsclear
+Version: 0.1.2
+Summary: Pure Python JavaScript deobfuscator
+Author-email: Intezer Labs <info@intezer.com>
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/intezer/PyJSClear
+Project-URL: Repository, https://github.com/intezer/PyJSClear
+Project-URL: Issues, https://github.com/intezer/PyJSClear/issues
+Keywords: javascript,deobfuscator,deobfuscation,security,malware-analysis,ast
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE
+Requires-Dist: esprima2>=5.0.1
+Dynamic: license-file
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/intezer/PyJSClear/main/PyJSClear.png" alt="PyJSClear" width="200">
+</p>
+
+# PyJSClear
+
+Pure Python JavaScript deobfuscator.
+
+## Installation
+
+```bash
+pip install pyjsclear
+```
+
+For development:
+
+```bash
+git clone https://github.com/intezer/PyJSClear.git
+cd PyJSClear
+pip install -e .
+pip install pytest
+```
+
+## Usage
+
+### Python API
+
+```python
+from pyjsclear import deobfuscate, deobfuscate_file
+
+# From a string
+cleaned = deobfuscate(obfuscated_code)
+
+# From a file
+deobfuscate_file("input.js", "output.js")
+
+# Or get the result as a string
+cleaned = deobfuscate_file("input.js")
+```
+
+### Command line
+
+```bash
+# File to stdout
+pyjsclear input.js
+
+# File to file
+pyjsclear input.js -o output.js
+
+# Stdin to stdout
+cat input.js | pyjsclear -
+
+# With custom iteration limit
+pyjsclear input.js --max-iterations 20
+```
+
+## What it does
+
+PyJSClear applies ~40 transforms in a multi-pass loop until the code
+stabilises (default limit: 50 iterations). A final one-shot pass renames
+variables and converts var/let to const.
+
+**Capabilities:**
+- String array decoding (obfuscator.io basic/base64/RC4, XOR, class-based)
+- Constant propagation & reassignment elimination
+- Dead code / dead branch / unreachable code removal
+- Control-flow unflattening (switch-dispatch recovery)
+- Proxy function & proxy object inlining
+- Expression simplification & modern syntax recovery (?., ??)
+- Anti-tamper / anti-debug removal
+- Variable renaming (_0x… → readable names)
+
+Large files (>500 KB / >50 K AST nodes) automatically use a lite mode
+that skips expensive transforms.
+
+## Testing
+
+```bash
+pytest tests/                           # all tests
+pytest tests/test_regression.py         # regression suite (62 tests across 25 samples)
+pytest tests/ -n auto                   # parallel execution (requires pytest-xdist)
+```
+
+## Limitations
+
+- **Optimised for obfuscator.io output.** Other obfuscation tools may only partially deobfuscate.
+- **Large files get reduced treatment.** Files >500 KB or ASTs >50 K nodes skip expensive transforms; files >2 MB use a minimal lite mode.
+- **No minification reversal.** Minified-but-not-obfuscated code won't be reformatted or beautified.
+- **Recursive AST traversal** may hit Python's default recursion limit (~1 000 frames) on extremely deep nesting.
+
+## License
+
+Apache License 2.0 — see [LICENSE](LICENSE).
+
+This project is a derivative work based on
+[obfuscator-io-deobfuscator](https://github.com/ben-sb/obfuscator-io-deobfuscator)
+(Apache 2.0) and
+[javascript-deobfuscator](https://github.com/ben-sb/javascript-deobfuscator)
+(Apache 2.0). See [THIRD_PARTY_LICENSES.md](THIRD_PARTY_LICENSES.md) and
+[NOTICE](NOTICE) for full attribution.

pyjsclear-0.1.2/README.md

@@ -0,0 +1,100 @@
+<p align="center">
+  <img src="https://raw.githubusercontent.com/intezer/PyJSClear/main/PyJSClear.png" alt="PyJSClear" width="200">
+</p>
+
+# PyJSClear
+
+Pure Python JavaScript deobfuscator.
+
+## Installation
+
+```bash
+pip install pyjsclear
+```
+
+For development:
+
+```bash
+git clone https://github.com/intezer/PyJSClear.git
+cd PyJSClear
+pip install -e .
+pip install pytest
+```
+
+## Usage
+
+### Python API
+
+```python
+from pyjsclear import deobfuscate, deobfuscate_file
+
+# From a string
+cleaned = deobfuscate(obfuscated_code)
+
+# From a file
+deobfuscate_file("input.js", "output.js")
+
+# Or get the result as a string
+cleaned = deobfuscate_file("input.js")
+```
+
+### Command line
+
+```bash
+# File to stdout
+pyjsclear input.js
+
+# File to file
+pyjsclear input.js -o output.js
+
+# Stdin to stdout
+cat input.js | pyjsclear -
+
+# With custom iteration limit
+pyjsclear input.js --max-iterations 20
+```
+
+## What it does
+
+PyJSClear applies ~40 transforms in a multi-pass loop until the code
+stabilises (default limit: 50 iterations). A final one-shot pass renames
+variables and converts var/let to const.
+
+**Capabilities:**
+- String array decoding (obfuscator.io basic/base64/RC4, XOR, class-based)
+- Constant propagation & reassignment elimination
+- Dead code / dead branch / unreachable code removal
+- Control-flow unflattening (switch-dispatch recovery)
+- Proxy function & proxy object inlining
+- Expression simplification & modern syntax recovery (?., ??)
+- Anti-tamper / anti-debug removal
+- Variable renaming (_0x… → readable names)
+
+Large files (>500 KB / >50 K AST nodes) automatically use a lite mode
+that skips expensive transforms.
+
+## Testing
+
+```bash
+pytest tests/                           # all tests
+pytest tests/test_regression.py         # regression suite (62 tests across 25 samples)
+pytest tests/ -n auto                   # parallel execution (requires pytest-xdist)
+```
+
+## Limitations
+
+- **Optimised for obfuscator.io output.** Other obfuscation tools may only partially deobfuscate.
+- **Large files get reduced treatment.** Files >500 KB or ASTs >50 K nodes skip expensive transforms; files >2 MB use a minimal lite mode.
+- **No minification reversal.** Minified-but-not-obfuscated code won't be reformatted or beautified.
+- **Recursive AST traversal** may hit Python's default recursion limit (~1 000 frames) on extremely deep nesting.
+
+## License
+
+Apache License 2.0 — see [LICENSE](LICENSE).
+
+This project is a derivative work based on
+[obfuscator-io-deobfuscator](https://github.com/ben-sb/obfuscator-io-deobfuscator)
+(Apache 2.0) and
+[javascript-deobfuscator](https://github.com/ben-sb/javascript-deobfuscator)
+(Apache 2.0). See [THIRD_PARTY_LICENSES.md](THIRD_PARTY_LICENSES.md) and
+[NOTICE](NOTICE) for full attribution.

{pyjsclear-0.1.0 → pyjsclear-0.1.2}/pyjsclear/__init__.py

@@ -2,13 +2,13 @@
 
 Combines functionality from obfuscator-io-deobfuscator (13 AST transforms)
 and javascript-deobfuscator (3 surface-cleanup modules) into a single
-Python package with no Node.js dependency.
+Python package.
 """
 
 from .deobfuscator import Deobfuscator
 
 
-__version__ = '0.1.0'
+__version__ = '0.1.2'
 
 
 def deobfuscate(code, max_iterations=50):

{pyjsclear-0.1.0 → pyjsclear-0.1.2}/pyjsclear/deobfuscator.py

@@ -5,28 +5,47 @@ from .parser import parse
 from .transforms.aa_decode import aa_decode
 from .transforms.aa_decode import is_aa_encoded
 from .transforms.anti_tamper import AntiTamperRemover
+from .transforms.class_static_resolver import ClassStaticResolver
+from .transforms.class_string_decoder import ClassStringDecoder
+from .transforms.cleanup import EmptyIfRemover
+from .transforms.cleanup import LetToConst
+from .transforms.cleanup import OptionalCatchBinding
+from .transforms.cleanup import ReturnUndefinedCleanup
+from .transforms.cleanup import TrailingReturnRemover
+from .transforms.cleanup import VarToConst
 from .transforms.constant_prop import ConstantProp
 from .transforms.control_flow import ControlFlowRecoverer
 from .transforms.dead_branch import DeadBranchRemover
+from .transforms.dead_class_props import DeadClassPropRemover
+from .transforms.dead_expressions import DeadExpressionRemover
+from .transforms.dead_object_props import DeadObjectPropRemover
+from .transforms.else_if_flatten import ElseIfFlattener
+from .transforms.enum_resolver import EnumResolver
 from .transforms.eval_unpack import eval_unpack
 from .transforms.eval_unpack import is_eval_packed
 from .transforms.expression_simplifier import ExpressionSimplifier
+from .transforms.global_alias import GlobalAliasInliner
 from .transforms.hex_escapes import HexEscapes
 from .transforms.hex_escapes import decode_hex_escapes_source
-from .transforms.jj_decode import is_jj_encoded
-from .transforms.jj_decode import jj_decode
-from .transforms.jj_decode import jj_decode_via_eval
-from .transforms.jsfuck_decode import is_jsfuck
-from .transforms.jsfuck_decode import jsfuck_decode
+from .transforms.hex_numerics import HexNumerics
 from .transforms.logical_to_if import LogicalToIf
+from .transforms.member_chain_resolver import MemberChainResolver
+from .transforms.noop_calls import NoopCallRemover
+from .transforms.nullish_coalescing import NullishCoalescing
 from .transforms.object_packer import ObjectPacker
 from .transforms.object_simplifier import ObjectSimplifier
+from .transforms.optional_chaining import OptionalChaining
 from .transforms.property_simplifier import PropertySimplifier
 from .transforms.proxy_functions import ProxyFunctionInliner
 from .transforms.reassignment import ReassignmentRemover
+from .transforms.require_inliner import RequireInliner
 from .transforms.sequence_splitter import SequenceSplitter
+from .transforms.single_use_vars import SingleUseVarInliner
 from .transforms.string_revealer import StringRevealer
+from .transforms.unreachable_code import UnreachableCodeRemover
 from .transforms.unused_vars import UnusedVariableRemover
+from .transforms.variable_renamer import VariableRenamer
+from .transforms.xor_string_decode import XorStringDecoder
 from .traverser import simple_traverse
 
 
@@ -36,15 +55,36 @@ from .traverser import simple_traverse
 TRANSFORM_CLASSES = [
     StringRevealer,
     HexEscapes,
+    HexNumerics,
+    ClassStringDecoder,
+    XorStringDecoder,
+    MemberChainResolver,
+    DeadClassPropRemover,
+    ClassStaticResolver,
+    EnumResolver,
+    RequireInliner,
+    GlobalAliasInliner,
     UnusedVariableRemover,
     ConstantProp,
     ReassignmentRemover,
+    SingleUseVarInliner,
     DeadBranchRemover,
+    UnreachableCodeRemover,
+    NoopCallRemover,
+    EmptyIfRemover,
+    DeadObjectPropRemover,
     ObjectPacker,
     ProxyFunctionInliner,
     SequenceSplitter,
+    DeadExpressionRemover,
     ExpressionSimplifier,
+    NullishCoalescing,
+    OptionalChaining,
     LogicalToIf,
+    ElseIfFlattener,
+    OptionalCatchBinding,
+    ReturnUndefinedCleanup,
+    TrailingReturnRemover,
     ControlFlowRecoverer,
     PropertySimplifier,
     AntiTamperRemover,
@@ -87,24 +127,12 @@ class Deobfuscator:
         Returns decoded code if an encoding/packing was detected and decoded,
         or None to continue with the normal AST pipeline.
         """
-        # JSFUCK check (must be first — these are whole-file encodings)
-        if is_jsfuck(code):
-            decoded = jsfuck_decode(code)
-            if decoded:
-                return decoded
-
         # AAEncode check
         if is_aa_encoded(code):
             decoded = aa_decode(code)
             if decoded:
                 return decoded
 
-        # JJEncode check
-        if is_jj_encoded(code):
-            decoded = jj_decode(code) or jj_decode_via_eval(code)
-            if decoded:
-                return decoded
-
         # Eval packer check
         if is_eval_packed(code):
             decoded = eval_unpack(code)
@@ -182,6 +210,14 @@ class Deobfuscator:
             if not modified:
                 break
 
+        # Post-passes: cosmetic transforms that run once after convergence
+        for post_transform in [VariableRenamer, VarToConst, LetToConst]:
+            try:
+                if post_transform(ast).execute():
+                    any_transform_changed = True
+            except Exception:
+                pass
+
         if not any_transform_changed:
             return self.original_code
 

{pyjsclear-0.1.0 → pyjsclear-0.1.2}/pyjsclear/generator.py

@@ -363,9 +363,12 @@ def _gen_member(node, indent):
         object_code = f'({object_code})'
 
     property_code = generate(node['property'], indent)
+    dot = '?.' if node.get('optional') else '.'
     if computed:
+        if node.get('optional'):
+            return f'{object_code}?.[{property_code}]'
         return f'{object_code}[{property_code}]'
-    return f'{object_code}.{property_code}'
+    return f'{object_code}{dot}{property_code}'
 
 
 def _gen_call(node, indent):
@@ -374,6 +377,8 @@ def _gen_call(node, indent):
     if callee_type in ('FunctionExpression', 'ArrowFunctionExpression', 'SequenceExpression'):
         callee = f'({callee})'
     args = ', '.join(generate(a, indent) for a in node.get('arguments', []))
+    if node.get('optional'):
+        return f'{callee}?.({args})'
     return f'{callee}({args})'
 
 

{pyjsclear-0.1.0 → pyjsclear-0.1.2}/pyjsclear/scope.py

@@ -70,19 +70,17 @@ def _is_non_reference_identifier(parent, parent_key):
     """Return True if this Identifier usage is not a variable reference."""
     if not parent:
         return False
-    parent_type = parent.get('type')
-    # Property names in member expressions (non-computed)
-    if parent_type == 'MemberExpression' and parent_key == 'property' and not parent.get('computed'):
-        return True
-    # Property keys in object literals (non-computed)
-    if parent_type == 'Property' and parent_key == 'key' and not parent.get('computed'):
-        return True
-    # Function/class names at declaration site
-    if parent_type in ('FunctionDeclaration', 'FunctionExpression', 'ClassDeclaration') and parent_key == 'id':
-        return True
-    # VariableDeclarator id
-    if parent_type == 'VariableDeclarator' and parent_key == 'id':
-        return True
+    match parent.get('type'):
+        case 'MemberExpression' if parent_key == 'property' and not parent.get('computed'):
+            return True
+        case 'Property' if parent_key == 'key' and not parent.get('computed'):
+            return True
+        case 'FunctionDeclaration' | 'FunctionExpression' | 'ClassDeclaration' | 'ClassExpression' if (
+            parent_key == 'id'
+        ):
+            return True
+        case 'VariableDeclarator' if parent_key == 'id':
+            return True
     return False
 
 
@@ -132,76 +130,104 @@ def build_scope_tree(ast):
         if node_type is None:
             return
 
-        # Create new scope for functions
-        if node_type in (
-            'FunctionDeclaration',
-            'FunctionExpression',
-            'ArrowFunctionExpression',
-        ):
-            new_scope = Scope(scope, node, is_function=True)
-            node_scope[id(node)] = new_scope
-            all_scopes.append(new_scope)
-
-            # Function name goes in outer scope (for declarations) or inner (for expressions)
-            if node_type == 'FunctionDeclaration' and node.get('id'):
-                scope.add_binding(node['id']['name'], node, 'function')
-            elif node_type == 'FunctionExpression' and node.get('id'):
-                new_scope.add_binding(node['id']['name'], node, 'function')
-
-            # Params go in function scope
-            for param in node.get('params', []):
-                if param.get('type') == 'Identifier':
-                    new_scope.add_binding(param['name'], param, 'param')
-                elif param.get('type') == 'AssignmentPattern' and param.get('left', {}).get('type') == 'Identifier':
-                    new_scope.add_binding(param['left']['name'], param, 'param')
-
-            # Body - use the new scope
-            body = node.get('body')
-            if not body:
-                return
-            if isinstance(body, dict) and body.get('type') == 'BlockStatement':
-                node_scope[id(body)] = new_scope
-                for statement in body.get('body', []):
+        match node_type:
+            case 'FunctionDeclaration' | 'FunctionExpression' | 'ArrowFunctionExpression':
+                new_scope = Scope(scope, node, is_function=True)
+                node_scope[id(node)] = new_scope
+                all_scopes.append(new_scope)
+
+                # Function name goes in outer scope (for declarations) or inner (for expressions)
+                if node_type == 'FunctionDeclaration' and node.get('id'):
+                    scope.add_binding(node['id']['name'], node, 'function')
+                elif node_type == 'FunctionExpression' and node.get('id'):
+                    new_scope.add_binding(node['id']['name'], node, 'function')
+
+                # Params go in function scope
+                for param in node.get('params', []):
+                    match param.get('type'):
+                        case 'Identifier':
+                            new_scope.add_binding(param['name'], param, 'param')
+                        case 'AssignmentPattern' if param.get('left', {}).get('type') == 'Identifier':
+                            new_scope.add_binding(param['left']['name'], param, 'param')
+                        case 'RestElement':
+                            arg = param.get('argument')
+                            if arg and arg.get('type') == 'Identifier':
+                                new_scope.add_binding(arg['name'], param, 'param')
+
+                # Body - use the new scope
+                body = node.get('body')
+                if not body:
+                    return
+                if isinstance(body, dict) and body.get('type') == 'BlockStatement':
+                    node_scope[id(body)] = new_scope
+                    for statement in body.get('body', []):
+                        _collect_declarations(statement, new_scope)
+                else:
+                    _collect_declarations(body, new_scope)
+
+            case 'ClassExpression' | 'ClassDeclaration':
+                class_id = node.get('id')
+                inner_scope = scope
+                if class_id and class_id.get('type') == 'Identifier':
+                    name = class_id['name']
+                    if node_type == 'ClassDeclaration':
+                        scope.add_binding(name, node, 'function')
+                    else:
+                        inner_scope = Scope(scope, node)
+                        node_scope[id(node)] = inner_scope
+                        all_scopes.append(inner_scope)
+                        inner_scope.add_binding(name, node, 'function')
+                body = node.get('body')
+                if body:
+                    _collect_declarations(body, inner_scope)
+                superclass = node.get('superClass')
+                if superclass:
+                    _collect_declarations(superclass, scope)
+
+            case 'VariableDeclaration':
+                kind = node.get('kind', 'var')
+                target_scope = (_nearest_function_scope(scope) or scope) if kind == 'var' else scope
+                for declaration in node.get('declarations', []):
+                    declaration_id = declaration.get('id')
+                    if declaration_id and declaration_id.get('type') == 'Identifier':
+                        target_scope.add_binding(declaration_id['name'], declaration, kind)
+                    _collect_pattern_names(declaration_id, target_scope, kind, declaration)
+                    init = declaration.get('init')
+                    if init:
+                        _collect_declarations(init, scope)
+
+            case 'BlockStatement' if id(node) not in node_scope:
+                new_scope = Scope(scope, node)
+                node_scope[id(node)] = new_scope
+                all_scopes.append(new_scope)
+                for statement in node.get('body', []):
                     _collect_declarations(statement, new_scope)
-            else:
-                _collect_declarations(body, new_scope)
-            return
-
-        # Variable declarations
-        if node_type == 'VariableDeclaration':
-            kind = node.get('kind', 'var')
-            # var is function-scoped, let/const are block-scoped
-            target_scope = (_nearest_function_scope(scope) or scope) if kind == 'var' else scope
-            for declaration in node.get('declarations', []):
-                declaration_id = declaration.get('id')
-                if declaration_id and declaration_id.get('type') == 'Identifier':
-                    target_scope.add_binding(declaration_id['name'], declaration, kind)
-                # Handle destructuring patterns
-                _collect_pattern_names(declaration_id, target_scope, kind, declaration)
-            return
-
-        # Block scopes (for, if, etc. with block statements)
-        if node_type == 'BlockStatement' and id(node) not in node_scope:
-            # Only create block scope if parent is not a function (handled above)
-            new_scope = Scope(scope, node)
-            node_scope[id(node)] = new_scope
-            all_scopes.append(new_scope)
-            for statement in node.get('body', []):
-                _collect_declarations(statement, new_scope)
-            return
-
-        if node_type == 'ForStatement':
-            new_scope = Scope(scope, node)
-            node_scope[id(node)] = new_scope
-            all_scopes.append(new_scope)
-            if node.get('init'):
-                _collect_declarations(node['init'], new_scope)
-            if node.get('body'):
-                _collect_declarations(node['body'], new_scope)
-            return
 
-        # Recurse into children
-        _recurse_into_children(node, _child_keys_map, lambda child_node: _collect_declarations(child_node, scope))
+            case 'ForStatement':
+                new_scope = Scope(scope, node)
+                node_scope[id(node)] = new_scope
+                all_scopes.append(new_scope)
+                if node.get('init'):
+                    _collect_declarations(node['init'], new_scope)
+                if node.get('body'):
+                    _collect_declarations(node['body'], new_scope)
+
+            case 'CatchClause':
+                catch_body = node.get('body')
+                if catch_body and catch_body.get('type') == 'BlockStatement':
+                    catch_scope = Scope(scope, catch_body)
+                    node_scope[id(catch_body)] = catch_scope
+                    all_scopes.append(catch_scope)
+                    param = node.get('param')
+                    if param and param.get('type') == 'Identifier':
+                        catch_scope.add_binding(param['name'], param, 'param')
+                    for statement in catch_body.get('body', []):
+                        _collect_declarations(statement, catch_scope)
+
+            case _:
+                _recurse_into_children(
+                    node, _child_keys_map, lambda child_node: _collect_declarations(child_node, scope)
+                )
 
     def _collect_pattern_names(pattern, scope, kind, declaration):
         """Collect binding names from destructuring patterns."""