pyjsclear 0.1.1__tar.gz → 0.1.3__tar.gz

pyjsclear-0.1.3/NOTICE

@@ -0,0 +1,28 @@
+PyJSClear
+Copyright 2026 Intezer Labs
+
+This product is a derivative work based on the following projects:
+
+1. obfuscator-io-deobfuscator (v1.0.6)
+   Copyright Ben (ben-sb)
+   Licensed under the Apache License, Version 2.0
+   https://github.com/ben-sb/obfuscator-io-deobfuscator
+
+2. javascript-deobfuscator
+   Copyright Ben (ben-sb)
+   Licensed under the Apache License, Version 2.0
+   https://github.com/ben-sb/javascript-deobfuscator
+
+3. webcrack (v2.14.1)
+   Copyright (c) 2023 j4k0xb
+   Licensed under the MIT License
+   https://github.com/j4k0xb/webcrack
+
+This Python library re-implements the deobfuscation algorithms and transform
+logic from the above projects in pure Python. No source code was directly
+copied; the implementations were written from scratch following the same
+algorithmic approaches.
+
+Test dataset: obfuscated JavaScript samples from the JSIMPLIFIER dataset
+(https://zenodo.org/records/17531662) are included in tests/resources/ for
+evaluation purposes only. They are not part of the distributed package.

pyjsclear-0.1.3/PKG-INFO

@@ -0,0 +1,124 @@
+Metadata-Version: 2.4
+Name: pyjsclear
+Version: 0.1.3
+Summary: Pure Python JavaScript deobfuscator
+Author-email: Intezer Labs <info@intezer.com>
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/intezer/PyJSClear
+Project-URL: Repository, https://github.com/intezer/PyJSClear
+Project-URL: Issues, https://github.com/intezer/PyJSClear/issues
+Keywords: javascript,deobfuscator,deobfuscation,security,malware-analysis,ast
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE
+Requires-Dist: esprima2>=5.0.1
+Dynamic: license-file
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/intezer/PyJSClear/main/PyJSClear.png" alt="PyJSClear" width="200">
+</p>
+
+# PyJSClear
+
+Pure Python JavaScript deobfuscator.
+
+## Installation
+
+```bash
+pip install pyjsclear
+```
+
+For development:
+
+```bash
+git clone https://github.com/intezer/PyJSClear.git
+cd PyJSClear
+pip install -e .
+pip install pytest
+```
+
+## Usage
+
+### Python API
+
+```python
+from pyjsclear import deobfuscate, deobfuscate_file
+
+# From a string
+cleaned = deobfuscate(obfuscated_code)
+
+# From a file
+deobfuscate_file("input.js", "output.js")
+
+# Or get the result as a string
+cleaned = deobfuscate_file("input.js")
+```
+
+### Command line
+
+```bash
+# File to stdout
+pyjsclear input.js
+
+# File to file
+pyjsclear input.js -o output.js
+
+# Stdin to stdout
+cat input.js | pyjsclear -
+
+# With custom iteration limit
+pyjsclear input.js --max-iterations 20
+```
+
+## What it does
+
+PyJSClear applies transforms in a multi-pass loop until the code
+stabilizes (default limit: 50 iterations). A final one-shot pass renames
+variables and converts var/let to const.
+
+**Capabilities:**
+- Whole-file encoding detection: JSFuck, JJEncode, AAEncode, eval-packing
+- String array decoding (obfuscator.io basic/base64/RC4, XOR, class-based)
+- Constant propagation & reassignment elimination
+- Dead code / dead branch / unreachable code removal
+- Control-flow unflattening (switch-dispatch recovery)
+- Proxy function & proxy object inlining
+- Expression simplification & modern syntax recovery (?., ??)
+- Anti-tamper / anti-debug removal
+- Variable renaming (_0x… → readable names)
+
+Large files (>500 KB / >50 K AST nodes) automatically use a lite mode
+that skips expensive transforms.
+
+## Limitations
+
+- **Best results on obfuscator.io output.** JSFuck, JJEncode, AAEncode, and eval-packed code are fully decoded; other obfuscation tools may only partially deobfuscate.
+- **Large files get reduced treatment.** Files >500 KB or ASTs >50 K nodes skip expensive transforms; files >2 MB use a minimal lite mode.
+- **Recursive AST traversal** may hit Python's default recursion limit (~1 000 frames) on extremely deep nesting; the deobfuscator catches this and returns the best partial result.
+
+## License
+
+Apache License 2.0 — see [LICENSE](LICENSE).
+
+This project is a derivative work based on
+[obfuscator-io-deobfuscator](https://github.com/ben-sb/obfuscator-io-deobfuscator)
+(Apache 2.0),
+[javascript-deobfuscator](https://github.com/ben-sb/javascript-deobfuscator)
+(Apache 2.0), and
+[webcrack](https://github.com/j4k0xb/webcrack) (MIT).
+See [THIRD_PARTY_LICENSES.md](THIRD_PARTY_LICENSES.md) and
+[NOTICE](NOTICE) for full attribution.
+
+Test samples include obfuscated JavaScript from the
+[JSIMPLIFIER dataset](https://zenodo.org/records/17531662) (GPL-3.0),
+used solely for evaluation purposes.

pyjsclear-0.1.3/README.md

@@ -0,0 +1,98 @@
+<p align="center">
+  <img src="https://raw.githubusercontent.com/intezer/PyJSClear/main/PyJSClear.png" alt="PyJSClear" width="200">
+</p>
+
+# PyJSClear
+
+Pure Python JavaScript deobfuscator.
+
+## Installation
+
+```bash
+pip install pyjsclear
+```
+
+For development:
+
+```bash
+git clone https://github.com/intezer/PyJSClear.git
+cd PyJSClear
+pip install -e .
+pip install pytest
+```
+
+## Usage
+
+### Python API
+
+```python
+from pyjsclear import deobfuscate, deobfuscate_file
+
+# From a string
+cleaned = deobfuscate(obfuscated_code)
+
+# From a file
+deobfuscate_file("input.js", "output.js")
+
+# Or get the result as a string
+cleaned = deobfuscate_file("input.js")
+```
+
+### Command line
+
+```bash
+# File to stdout
+pyjsclear input.js
+
+# File to file
+pyjsclear input.js -o output.js
+
+# Stdin to stdout
+cat input.js | pyjsclear -
+
+# With custom iteration limit
+pyjsclear input.js --max-iterations 20
+```
+
+## What it does
+
+PyJSClear applies transforms in a multi-pass loop until the code
+stabilizes (default limit: 50 iterations). A final one-shot pass renames
+variables and converts var/let to const.
+
+**Capabilities:**
+- Whole-file encoding detection: JSFuck, JJEncode, AAEncode, eval-packing
+- String array decoding (obfuscator.io basic/base64/RC4, XOR, class-based)
+- Constant propagation & reassignment elimination
+- Dead code / dead branch / unreachable code removal
+- Control-flow unflattening (switch-dispatch recovery)
+- Proxy function & proxy object inlining
+- Expression simplification & modern syntax recovery (?., ??)
+- Anti-tamper / anti-debug removal
+- Variable renaming (_0x… → readable names)
+
+Large files (>500 KB / >50 K AST nodes) automatically use a lite mode
+that skips expensive transforms.
+
+## Limitations
+
+- **Best results on obfuscator.io output.** JSFuck, JJEncode, AAEncode, and eval-packed code are fully decoded; other obfuscation tools may only partially deobfuscate.
+- **Large files get reduced treatment.** Files >500 KB or ASTs >50 K nodes skip expensive transforms; files >2 MB use a minimal lite mode.
+- **Recursive AST traversal** may hit Python's default recursion limit (~1 000 frames) on extremely deep nesting; the deobfuscator catches this and returns the best partial result.
+
+## License
+
+Apache License 2.0 — see [LICENSE](LICENSE).
+
+This project is a derivative work based on
+[obfuscator-io-deobfuscator](https://github.com/ben-sb/obfuscator-io-deobfuscator)
+(Apache 2.0),
+[javascript-deobfuscator](https://github.com/ben-sb/javascript-deobfuscator)
+(Apache 2.0), and
+[webcrack](https://github.com/j4k0xb/webcrack) (MIT).
+See [THIRD_PARTY_LICENSES.md](THIRD_PARTY_LICENSES.md) and
+[NOTICE](NOTICE) for full attribution.
+
+Test samples include obfuscated JavaScript from the
+[JSIMPLIFIER dataset](https://zenodo.org/records/17531662) (GPL-3.0),
+used solely for evaluation purposes.

{pyjsclear-0.1.1 → pyjsclear-0.1.3}/THIRD_PARTY_LICENSES.md

@@ -237,3 +237,30 @@ https://github.com/ben-sb/javascript-deobfuscator/blob/master/LICENSE).
 **Features derived from this project:** hex escape decoding (`--he`),
 static array unpacking (`--su`), property access transformation (`--tp`).
 
+---
+
+## webcrack
+
+- **Version:** 2.14.1
+- **Author:** j4k0xb
+- **Repository:** https://github.com/j4k0xb/webcrack
+- **License:** MIT
+
+See [licenses/LICENSE-webcrack](licenses/LICENSE-webcrack) for the full license text.
+
+**Features derived from this project:** general deobfuscation transform
+patterns and architecture reference.
+
+---
+
+## Test dataset
+
+- **JSIMPLIFIER dataset**
+- **Author:** Dongchao Zhou
+- **Source:** https://zenodo.org/records/17531662
+- **License:** GPL-3.0
+
+Obfuscated JavaScript samples from this dataset are included in
+`tests/resources/` for evaluation purposes only. They are not part of the
+distributed package and no code from JSIMPLIFIER is incorporated into
+PyJSClear.

{pyjsclear-0.1.1 → pyjsclear-0.1.3}/pyjsclear/__init__.py

@@ -2,13 +2,13 @@
 
 Combines functionality from obfuscator-io-deobfuscator (13 AST transforms)
 and javascript-deobfuscator (3 surface-cleanup modules) into a single
-Python package with no Node.js dependency.
+Python package.
 """
 
 from .deobfuscator import Deobfuscator
 
 
-__version__ = '0.1.1'
+__version__ = '0.1.3'
 
 
 def deobfuscate(code, max_iterations=50):

{pyjsclear-0.1.1 → pyjsclear-0.1.3}/pyjsclear/deobfuscator.py

@@ -2,31 +2,54 @@
 
 from .generator import generate
 from .parser import parse
-from .transforms.aa_decode import aa_decode
-from .transforms.aa_decode import is_aa_encoded
 from .transforms.anti_tamper import AntiTamperRemover
+from .transforms.class_static_resolver import ClassStaticResolver
+from .transforms.class_string_decoder import ClassStringDecoder
+from .transforms.cleanup import EmptyIfRemover
+from .transforms.cleanup import LetToConst
+from .transforms.cleanup import OptionalCatchBinding
+from .transforms.cleanup import ReturnUndefinedCleanup
+from .transforms.cleanup import TrailingReturnRemover
+from .transforms.cleanup import VarToConst
 from .transforms.constant_prop import ConstantProp
 from .transforms.control_flow import ControlFlowRecoverer
 from .transforms.dead_branch import DeadBranchRemover
+from .transforms.dead_class_props import DeadClassPropRemover
+from .transforms.dead_expressions import DeadExpressionRemover
+from .transforms.dead_object_props import DeadObjectPropRemover
+from .transforms.else_if_flatten import ElseIfFlattener
+from .transforms.enum_resolver import EnumResolver
 from .transforms.eval_unpack import eval_unpack
 from .transforms.eval_unpack import is_eval_packed
 from .transforms.expression_simplifier import ExpressionSimplifier
+from .transforms.global_alias import GlobalAliasInliner
 from .transforms.hex_escapes import HexEscapes
 from .transforms.hex_escapes import decode_hex_escapes_source
+from .transforms.hex_numerics import HexNumerics
+from .transforms.aa_decode import aa_decode
+from .transforms.aa_decode import is_aa_encoded
 from .transforms.jj_decode import is_jj_encoded
 from .transforms.jj_decode import jj_decode
-from .transforms.jj_decode import jj_decode_via_eval
 from .transforms.jsfuck_decode import is_jsfuck
 from .transforms.jsfuck_decode import jsfuck_decode
 from .transforms.logical_to_if import LogicalToIf
+from .transforms.member_chain_resolver import MemberChainResolver
+from .transforms.noop_calls import NoopCallRemover
+from .transforms.nullish_coalescing import NullishCoalescing
 from .transforms.object_packer import ObjectPacker
 from .transforms.object_simplifier import ObjectSimplifier
+from .transforms.optional_chaining import OptionalChaining
 from .transforms.property_simplifier import PropertySimplifier
 from .transforms.proxy_functions import ProxyFunctionInliner
 from .transforms.reassignment import ReassignmentRemover
+from .transforms.require_inliner import RequireInliner
 from .transforms.sequence_splitter import SequenceSplitter
+from .transforms.single_use_vars import SingleUseVarInliner
 from .transforms.string_revealer import StringRevealer
+from .transforms.unreachable_code import UnreachableCodeRemover
 from .transforms.unused_vars import UnusedVariableRemover
+from .transforms.variable_renamer import VariableRenamer
+from .transforms.xor_string_decode import XorStringDecoder
 from .traverser import simple_traverse
 
 
@@ -36,15 +59,36 @@ from .traverser import simple_traverse
 TRANSFORM_CLASSES = [
     StringRevealer,
     HexEscapes,
+    HexNumerics,
+    ClassStringDecoder,
+    XorStringDecoder,
+    MemberChainResolver,
+    DeadClassPropRemover,
+    ClassStaticResolver,
+    EnumResolver,
+    RequireInliner,
+    GlobalAliasInliner,
     UnusedVariableRemover,
     ConstantProp,
     ReassignmentRemover,
+    SingleUseVarInliner,
     DeadBranchRemover,
+    UnreachableCodeRemover,
+    NoopCallRemover,
+    EmptyIfRemover,
+    DeadObjectPropRemover,
     ObjectPacker,
     ProxyFunctionInliner,
     SequenceSplitter,
+    DeadExpressionRemover,
     ExpressionSimplifier,
+    NullishCoalescing,
+    OptionalChaining,
     LogicalToIf,
+    ElseIfFlattener,
+    OptionalCatchBinding,
+    ReturnUndefinedCleanup,
+    TrailingReturnRemover,
     ControlFlowRecoverer,
     PropertySimplifier,
     AntiTamperRemover,
@@ -87,7 +131,7 @@ class Deobfuscator:
         Returns decoded code if an encoding/packing was detected and decoded,
         or None to continue with the normal AST pipeline.
         """
-        # JSFUCK check (must be first — these are whole-file encodings)
+        # JSFuck check (must be first — these are whole-file encodings)
         if is_jsfuck(code):
             decoded = jsfuck_decode(code)
             if decoded:
@@ -101,7 +145,7 @@ class Deobfuscator:
 
         # JJEncode check
         if is_jj_encoded(code):
-            decoded = jj_decode(code) or jj_decode_via_eval(code)
+            decoded = jj_decode(code)
             if decoded:
                 return decoded
 
@@ -113,6 +157,9 @@ class Deobfuscator:
 
         return None
 
+    # Maximum number of outer re-parse cycles (generate → re-parse → re-transform)
+    _MAX_OUTER_CYCLES = 5
+
     def execute(self):
         """Run all transforms and return cleaned source."""
         code = self.original_code
@@ -134,25 +181,79 @@ class Deobfuscator:
                 return decoded
             return self.original_code
 
-        # Determine optimization mode based on code size
-        code_size = len(code)
+        # Outer loop: run AST transforms until generate→re-parse converges.
+        # Post-passes (VariableRenamer, VarToConst, LetToConst) only run on
+        # the final cycle to avoid interfering with subsequent transform rounds.
+        previous_code = code
+        last_changed_ast = None
+        try:
+            for _cycle in range(self._MAX_OUTER_CYCLES):
+                changed = self._run_ast_transforms(
+                    ast,
+                    code_size=len(previous_code),
+                )
+
+                if not changed:
+                    break
+
+                last_changed_ast = ast
+
+                try:
+                    generated = generate(ast)
+                except Exception:
+                    break
+
+                if generated == previous_code:
+                    break
+
+                previous_code = generated
+
+                # Re-parse for the next cycle
+                try:
+                    ast = parse(generated)
+                except SyntaxError:
+                    break
+
+            # Run post-passes on the final AST (always — they're cheap and handle
+            # cosmetic transforms like var→const even when no main transforms fired)
+            any_post_changed = False
+            for post_transform in [VariableRenamer, VarToConst, LetToConst]:
+                try:
+                    if post_transform(ast).execute():
+                        any_post_changed = True
+                except Exception:
+                    pass
+
+            if last_changed_ast is None and not any_post_changed:
+                return self.original_code
+
+            try:
+                return generate(ast)
+            except Exception:
+                return previous_code
+        except RecursionError:
+            # Safety net: esprima's parser is purely recursive with no depth
+            # limit, so deeply nested JS hits Python's recursion limit during
+            # parsing or re-parsing.  Our AST walkers are cheaper per level
+            # but also recursive.  Return best result so far.
+            return previous_code
+
+    def _run_ast_transforms(self, ast, code_size=0):
+        """Run all AST transform passes. Returns True if any transform changed the AST."""
+        node_count = _count_nodes(ast) if code_size > _LARGE_FILE_SIZE else 0
+
         lite_mode = code_size > _MAX_CODE_SIZE
         max_iterations = self.max_iterations
         if code_size > _LARGE_FILE_SIZE:
             max_iterations = min(max_iterations, _LITE_MAX_ITERATIONS)
 
-        # Check node count for expensive transform gating
-        node_count = _count_nodes(ast) if code_size > _LARGE_FILE_SIZE else 0
-
         # For very large ASTs, further reduce iterations
         if node_count > 100_000:
             max_iterations = min(max_iterations, 3)
 
         # Build transform list based on mode
         transform_classes = TRANSFORM_CLASSES
-        if lite_mode:
-            transform_classes = [t for t in TRANSFORM_CLASSES if t not in _EXPENSIVE_TRANSFORMS]
-        elif node_count > _NODE_COUNT_LIMIT:
+        if lite_mode or node_count > _NODE_COUNT_LIMIT:
             transform_classes = [t for t in TRANSFORM_CLASSES if t not in _EXPENSIVE_TRANSFORMS]
 
         # Track which transforms are no longer productive
@@ -182,10 +283,4 @@ class Deobfuscator:
             if not modified:
                 break
 
-        if not any_transform_changed:
-            return self.original_code
-
-        try:
-            return generate(ast)
-        except Exception:
-            return self.original_code
+        return any_transform_changed

{pyjsclear-0.1.1 → pyjsclear-0.1.3}/pyjsclear/generator.py

@@ -363,9 +363,12 @@ def _gen_member(node, indent):
         object_code = f'({object_code})'
 
     property_code = generate(node['property'], indent)
+    dot = '?.' if node.get('optional') else '.'
     if computed:
+        if node.get('optional'):
+            return f'{object_code}?.[{property_code}]'
         return f'{object_code}[{property_code}]'
-    return f'{object_code}.{property_code}'
+    return f'{object_code}{dot}{property_code}'
 
 
 def _gen_call(node, indent):
@@ -374,6 +377,8 @@ def _gen_call(node, indent):
     if callee_type in ('FunctionExpression', 'ArrowFunctionExpression', 'SequenceExpression'):
         callee = f'({callee})'
     args = ', '.join(generate(a, indent) for a in node.get('arguments', []))
+    if node.get('optional'):
+        return f'{callee}?.({args})'
     return f'{callee}({args})'