pyjsclear 0.1.2__tar.gz → 0.1.3__tar.gz

pyjsclear-0.1.3/NOTICE

@@ -0,0 +1,28 @@
+PyJSClear
+Copyright 2026 Intezer Labs
+
+This product is a derivative work based on the following projects:
+
+1. obfuscator-io-deobfuscator (v1.0.6)
+   Copyright Ben (ben-sb)
+   Licensed under the Apache License, Version 2.0
+   https://github.com/ben-sb/obfuscator-io-deobfuscator
+
+2. javascript-deobfuscator
+   Copyright Ben (ben-sb)
+   Licensed under the Apache License, Version 2.0
+   https://github.com/ben-sb/javascript-deobfuscator
+
+3. webcrack (v2.14.1)
+   Copyright (c) 2023 j4k0xb
+   Licensed under the MIT License
+   https://github.com/j4k0xb/webcrack
+
+This Python library re-implements the deobfuscation algorithms and transform
+logic from the above projects in pure Python. No source code was directly
+copied; the implementations were written from scratch following the same
+algorithmic approaches.
+
+Test dataset: obfuscated JavaScript samples from the JSIMPLIFIER dataset
+(https://zenodo.org/records/17531662) are included in tests/resources/ for
+evaluation purposes only. They are not part of the distributed package.

{pyjsclear-0.1.2/pyjsclear.egg-info → pyjsclear-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyjsclear
-Version: 0.1.2
+Version: 0.1.3
 Summary: Pure Python JavaScript deobfuscator
 Author-email: Intezer Labs <info@intezer.com>
 License-Expression: Apache-2.0
@@ -82,11 +82,12 @@ pyjsclear input.js --max-iterations 20
 
 ## What it does
 
-PyJSClear applies ~40 transforms in a multi-pass loop until the code
-stabilises (default limit: 50 iterations). A final one-shot pass renames
+PyJSClear applies transforms in a multi-pass loop until the code
+stabilizes (default limit: 50 iterations). A final one-shot pass renames
 variables and converts var/let to const.
 
 **Capabilities:**
+- Whole-file encoding detection: JSFuck, JJEncode, AAEncode, eval-packing
 - String array decoding (obfuscator.io basic/base64/RC4, XOR, class-based)
 - Constant propagation & reassignment elimination
 - Dead code / dead branch / unreachable code removal
@@ -99,20 +100,11 @@ variables and converts var/let to const.
 Large files (>500 KB / >50 K AST nodes) automatically use a lite mode
 that skips expensive transforms.
 
-## Testing
-
-```bash
-pytest tests/                           # all tests
-pytest tests/test_regression.py         # regression suite (62 tests across 25 samples)
-pytest tests/ -n auto                   # parallel execution (requires pytest-xdist)
-```
-
 ## Limitations
 
-- **Optimised for obfuscator.io output.** Other obfuscation tools may only partially deobfuscate.
+- **Best results on obfuscator.io output.** JSFuck, JJEncode, AAEncode, and eval-packed code are fully decoded; other obfuscation tools may only partially deobfuscate.
 - **Large files get reduced treatment.** Files >500 KB or ASTs >50 K nodes skip expensive transforms; files >2 MB use a minimal lite mode.
-- **No minification reversal.** Minified-but-not-obfuscated code won't be reformatted or beautified.
-- **Recursive AST traversal** may hit Python's default recursion limit (~1 000 frames) on extremely deep nesting.
+- **Recursive AST traversal** may hit Python's default recursion limit (~1 000 frames) on extremely deep nesting; the deobfuscator catches this and returns the best partial result.
 
 ## License
 
@@ -120,7 +112,13 @@ Apache License 2.0 — see [LICENSE](LICENSE).
 
 This project is a derivative work based on
 [obfuscator-io-deobfuscator](https://github.com/ben-sb/obfuscator-io-deobfuscator)
-(Apache 2.0) and
+(Apache 2.0),
 [javascript-deobfuscator](https://github.com/ben-sb/javascript-deobfuscator)
-(Apache 2.0). See [THIRD_PARTY_LICENSES.md](THIRD_PARTY_LICENSES.md) and
+(Apache 2.0), and
+[webcrack](https://github.com/j4k0xb/webcrack) (MIT).
+See [THIRD_PARTY_LICENSES.md](THIRD_PARTY_LICENSES.md) and
 [NOTICE](NOTICE) for full attribution.
+
+Test samples include obfuscated JavaScript from the
+[JSIMPLIFIER dataset](https://zenodo.org/records/17531662) (GPL-3.0),
+used solely for evaluation purposes.

{pyjsclear-0.1.2 → pyjsclear-0.1.3}/README.md

@@ -56,11 +56,12 @@ pyjsclear input.js --max-iterations 20
 
 ## What it does
 
-PyJSClear applies ~40 transforms in a multi-pass loop until the code
-stabilises (default limit: 50 iterations). A final one-shot pass renames
+PyJSClear applies transforms in a multi-pass loop until the code
+stabilizes (default limit: 50 iterations). A final one-shot pass renames
 variables and converts var/let to const.
 
 **Capabilities:**
+- Whole-file encoding detection: JSFuck, JJEncode, AAEncode, eval-packing
 - String array decoding (obfuscator.io basic/base64/RC4, XOR, class-based)
 - Constant propagation & reassignment elimination
 - Dead code / dead branch / unreachable code removal
@@ -73,20 +74,11 @@ variables and converts var/let to const.
 Large files (>500 KB / >50 K AST nodes) automatically use a lite mode
 that skips expensive transforms.
 
-## Testing
-
-```bash
-pytest tests/                           # all tests
-pytest tests/test_regression.py         # regression suite (62 tests across 25 samples)
-pytest tests/ -n auto                   # parallel execution (requires pytest-xdist)
-```
-
 ## Limitations
 
-- **Optimised for obfuscator.io output.** Other obfuscation tools may only partially deobfuscate.
+- **Best results on obfuscator.io output.** JSFuck, JJEncode, AAEncode, and eval-packed code are fully decoded; other obfuscation tools may only partially deobfuscate.
 - **Large files get reduced treatment.** Files >500 KB or ASTs >50 K nodes skip expensive transforms; files >2 MB use a minimal lite mode.
-- **No minification reversal.** Minified-but-not-obfuscated code won't be reformatted or beautified.
-- **Recursive AST traversal** may hit Python's default recursion limit (~1 000 frames) on extremely deep nesting.
+- **Recursive AST traversal** may hit Python's default recursion limit (~1 000 frames) on extremely deep nesting; the deobfuscator catches this and returns the best partial result.
 
 ## License
 
@@ -94,7 +86,13 @@ Apache License 2.0 — see [LICENSE](LICENSE).
 
 This project is a derivative work based on
 [obfuscator-io-deobfuscator](https://github.com/ben-sb/obfuscator-io-deobfuscator)
-(Apache 2.0) and
+(Apache 2.0),
 [javascript-deobfuscator](https://github.com/ben-sb/javascript-deobfuscator)
-(Apache 2.0). See [THIRD_PARTY_LICENSES.md](THIRD_PARTY_LICENSES.md) and
+(Apache 2.0), and
+[webcrack](https://github.com/j4k0xb/webcrack) (MIT).
+See [THIRD_PARTY_LICENSES.md](THIRD_PARTY_LICENSES.md) and
 [NOTICE](NOTICE) for full attribution.
+
+Test samples include obfuscated JavaScript from the
+[JSIMPLIFIER dataset](https://zenodo.org/records/17531662) (GPL-3.0),
+used solely for evaluation purposes.

{pyjsclear-0.1.2 → pyjsclear-0.1.3}/THIRD_PARTY_LICENSES.md

@@ -237,3 +237,30 @@ https://github.com/ben-sb/javascript-deobfuscator/blob/master/LICENSE).
 **Features derived from this project:** hex escape decoding (`--he`),
 static array unpacking (`--su`), property access transformation (`--tp`).
 
+---
+
+## webcrack
+
+- **Version:** 2.14.1
+- **Author:** j4k0xb
+- **Repository:** https://github.com/j4k0xb/webcrack
+- **License:** MIT
+
+See [licenses/LICENSE-webcrack](licenses/LICENSE-webcrack) for the full license text.
+
+**Features derived from this project:** general deobfuscation transform
+patterns and architecture reference.
+
+---
+
+## Test dataset
+
+- **JSIMPLIFIER dataset**
+- **Author:** Dongchao Zhou
+- **Source:** https://zenodo.org/records/17531662
+- **License:** GPL-3.0
+
+Obfuscated JavaScript samples from this dataset are included in
+`tests/resources/` for evaluation purposes only. They are not part of the
+distributed package and no code from JSIMPLIFIER is incorporated into
+PyJSClear.

{pyjsclear-0.1.2 → pyjsclear-0.1.3}/pyjsclear/__init__.py

@@ -8,7 +8,7 @@ Python package.
 from .deobfuscator import Deobfuscator
 
 
-__version__ = '0.1.2'
+__version__ = '0.1.3'
 
 
 def deobfuscate(code, max_iterations=50):

{pyjsclear-0.1.2 → pyjsclear-0.1.3}/pyjsclear/deobfuscator.py

@@ -2,8 +2,6 @@
 
 from .generator import generate
 from .parser import parse
-from .transforms.aa_decode import aa_decode
-from .transforms.aa_decode import is_aa_encoded
 from .transforms.anti_tamper import AntiTamperRemover
 from .transforms.class_static_resolver import ClassStaticResolver
 from .transforms.class_string_decoder import ClassStringDecoder
@@ -28,6 +26,12 @@ from .transforms.global_alias import GlobalAliasInliner
 from .transforms.hex_escapes import HexEscapes
 from .transforms.hex_escapes import decode_hex_escapes_source
 from .transforms.hex_numerics import HexNumerics
+from .transforms.aa_decode import aa_decode
+from .transforms.aa_decode import is_aa_encoded
+from .transforms.jj_decode import is_jj_encoded
+from .transforms.jj_decode import jj_decode
+from .transforms.jsfuck_decode import is_jsfuck
+from .transforms.jsfuck_decode import jsfuck_decode
 from .transforms.logical_to_if import LogicalToIf
 from .transforms.member_chain_resolver import MemberChainResolver
 from .transforms.noop_calls import NoopCallRemover
@@ -127,12 +131,24 @@ class Deobfuscator:
         Returns decoded code if an encoding/packing was detected and decoded,
         or None to continue with the normal AST pipeline.
         """
+        # JSFuck check (must be first — these are whole-file encodings)
+        if is_jsfuck(code):
+            decoded = jsfuck_decode(code)
+            if decoded:
+                return decoded
+
         # AAEncode check
         if is_aa_encoded(code):
             decoded = aa_decode(code)
             if decoded:
                 return decoded
 
+        # JJEncode check
+        if is_jj_encoded(code):
+            decoded = jj_decode(code)
+            if decoded:
+                return decoded
+
         # Eval packer check
         if is_eval_packed(code):
             decoded = eval_unpack(code)
@@ -141,6 +157,9 @@ class Deobfuscator:
 
         return None
 
+    # Maximum number of outer re-parse cycles (generate → re-parse → re-transform)
+    _MAX_OUTER_CYCLES = 5
+
     def execute(self):
         """Run all transforms and return cleaned source."""
         code = self.original_code
@@ -162,25 +181,79 @@ class Deobfuscator:
                 return decoded
             return self.original_code
 
-        # Determine optimization mode based on code size
-        code_size = len(code)
+        # Outer loop: run AST transforms until generate→re-parse converges.
+        # Post-passes (VariableRenamer, VarToConst, LetToConst) only run on
+        # the final cycle to avoid interfering with subsequent transform rounds.
+        previous_code = code
+        last_changed_ast = None
+        try:
+            for _cycle in range(self._MAX_OUTER_CYCLES):
+                changed = self._run_ast_transforms(
+                    ast,
+                    code_size=len(previous_code),
+                )
+
+                if not changed:
+                    break
+
+                last_changed_ast = ast
+
+                try:
+                    generated = generate(ast)
+                except Exception:
+                    break
+
+                if generated == previous_code:
+                    break
+
+                previous_code = generated
+
+                # Re-parse for the next cycle
+                try:
+                    ast = parse(generated)
+                except SyntaxError:
+                    break
+
+            # Run post-passes on the final AST (always — they're cheap and handle
+            # cosmetic transforms like var→const even when no main transforms fired)
+            any_post_changed = False
+            for post_transform in [VariableRenamer, VarToConst, LetToConst]:
+                try:
+                    if post_transform(ast).execute():
+                        any_post_changed = True
+                except Exception:
+                    pass
+
+            if last_changed_ast is None and not any_post_changed:
+                return self.original_code
+
+            try:
+                return generate(ast)
+            except Exception:
+                return previous_code
+        except RecursionError:
+            # Safety net: esprima's parser is purely recursive with no depth
+            # limit, so deeply nested JS hits Python's recursion limit during
+            # parsing or re-parsing.  Our AST walkers are cheaper per level
+            # but also recursive.  Return best result so far.
+            return previous_code
+
+    def _run_ast_transforms(self, ast, code_size=0):
+        """Run all AST transform passes. Returns True if any transform changed the AST."""
+        node_count = _count_nodes(ast) if code_size > _LARGE_FILE_SIZE else 0
+
         lite_mode = code_size > _MAX_CODE_SIZE
         max_iterations = self.max_iterations
         if code_size > _LARGE_FILE_SIZE:
             max_iterations = min(max_iterations, _LITE_MAX_ITERATIONS)
 
-        # Check node count for expensive transform gating
-        node_count = _count_nodes(ast) if code_size > _LARGE_FILE_SIZE else 0
-
         # For very large ASTs, further reduce iterations
         if node_count > 100_000:
             max_iterations = min(max_iterations, 3)
 
         # Build transform list based on mode
         transform_classes = TRANSFORM_CLASSES
-        if lite_mode:
-            transform_classes = [t for t in TRANSFORM_CLASSES if t not in _EXPENSIVE_TRANSFORMS]
-        elif node_count > _NODE_COUNT_LIMIT:
+        if lite_mode or node_count > _NODE_COUNT_LIMIT:
             transform_classes = [t for t in TRANSFORM_CLASSES if t not in _EXPENSIVE_TRANSFORMS]
 
         # Track which transforms are no longer productive
@@ -210,18 +283,4 @@ class Deobfuscator:
             if not modified:
                 break
 
-        # Post-passes: cosmetic transforms that run once after convergence
-        for post_transform in [VariableRenamer, VarToConst, LetToConst]:
-            try:
-                if post_transform(ast).execute():
-                    any_transform_changed = True
-            except Exception:
-                pass
-
-        if not any_transform_changed:
-            return self.original_code
-
-        try:
-            return generate(ast)
-        except Exception:
-            return self.original_code
+        return any_transform_changed

pyjsclear-0.1.3/pyjsclear/transforms/aa_decode.py

@@ -0,0 +1,150 @@
+"""Pure Python AAEncode decoder.
+
+AAEncode (by Yosuke Hasegawa) encodes JavaScript into Japanese-style
+emoticon characters using fullwidth/halfwidth katakana and special symbols.
+Each source character is represented as an octal or hex escape built from
+emoticon digit expressions, separated by a backslash-like marker.
+
+This decoder performs iterative string replacements to recover the digit
+sequences, then converts octal/hex values back to characters.
+"""
+
+import re
+
+# Characteristic pattern present in all AAEncoded output — the execution call.
+_SIGNATURE = '\uff9f\u0414\uff9f)[\uff9f\u03b5\uff9f]'
+
+# Separator between encoded characters (represents the escape character "\").
+_SEPARATOR = '(\uff9f\u0414\uff9f)[\uff9f\u03b5\uff9f]+'
+
+# Unicode hex marker — when present before a segment, the value is hex (\uXXXX).
+# Note: real AAEncode uses U+FF70 (halfwidth katakana-hiragana prolonged sound mark ｰ),
+# NOT U+30FC (fullwidth ー).
+_UNICODE_MARKER = '(o\uff9f\uff70\uff9fo)'
+
+# Sentinel used to track unicode marker positions after replacement.
+_HEX_SENTINEL = '\x01'
+
+# Replacement rules: longer/more specific patterns first to avoid partial matches.
+# All patterns use U+FF70 (ｰ) to match real AAEncode output.
+_REPLACEMENTS = [
+    ('(o\uff9f\uff70\uff9fo)',                                      _HEX_SENTINEL),
+    ('((\uff9f\uff70\uff9f) + (\uff9f\uff70\uff9f) + (\uff9f\u0398\uff9f))', '5'),
+    ('((\uff9f\uff70\uff9f) + (\uff9f\uff70\uff9f))',              '4'),
+    ('((\uff9f\uff70\uff9f) + (o^_^o))',                            '3'),
+    ('((\uff9f\uff70\uff9f) + (\uff9f\u0398\uff9f))',              '2'),
+    ('((o^_^o) - (\uff9f\u0398\uff9f))',                            '2'),
+    ('((o^_^o) + (o^_^o))',                                          '6'),
+    ('(\uff9f\uff70\uff9f)',                                        '1'),
+    ('(\uff9f\u0398\uff9f)',                                        '1'),
+    ('(c^_^o)',                                                      '0'),
+    ('(o^_^o)',                                                      '3'),
+]
+
+
+def is_aa_encoded(code):
+    """Check if *code* looks like AAEncoded JavaScript.
+
+    Returns True when the characteristic execution pattern is found.
+    """
+    if not isinstance(code, str):
+        return False
+    return _SIGNATURE in code
+
+
+def aa_decode(code):
+    """Decode AAEncoded JavaScript.
+
+    Returns the decoded source string, or ``None`` on any failure.
+    All processing is iterative (no recursion).
+    """
+    if not isinstance(code, str) or not is_aa_encoded(code):
+        return None
+
+    try:
+        return _decode_impl(code)
+    except Exception:
+        return None
+
+
+# ---------------------------------------------------------------------------
+# Internal helpers
+# ---------------------------------------------------------------------------
+
+
+def _decode_impl(code):
+    """Core decoding logic."""
+    # 1. Isolate the data section.
+    #    AAEncode wraps data inside an execution pattern.  The encoded payload
+    #    is the series of segments joined by the separator, ending with a
+    #    final execution call like  (ﾟДﾟ)['_']  or  )('_');
+    #    We look for the *first* separator occurrence and take everything from
+    #    there up to the trailing execution wrapper.
+
+    # Find the data region: everything after the initial variable setup and
+    # before the trailing execution portion.
+    # The data starts at the first separator token.
+    sep_idx = code.find(_SEPARATOR)
+    if sep_idx == -1:
+        return None
+
+    # The trailing execution wrapper varies but typically looks like:
+    #   (ﾟДﾟ)['_'](ﾟΘﾟ)   or   )('_');
+    # We strip from the last occurrence of  (ﾟДﾟ)['_']  onward.
+    tail_patterns = [
+        "(\uff9f\u0414\uff9f)['_']",
+        '(\uff9f\u0414\uff9f)["_"]',
+    ]
+    data = code[sep_idx:]
+    for pat in tail_patterns:
+        tail_pos = data.rfind(pat)
+        if tail_pos != -1:
+            data = data[:tail_pos]
+            break
+
+    # 2. Apply emoticon-to-digit replacements.
+    for old, new in _REPLACEMENTS:
+        data = data.replace(old, new)
+
+    # 3. Split on the separator to get individual character segments.
+    segments = data.split(_SEPARATOR)
+
+    # The first element is the leading separator itself (empty or noise) — skip it.
+    # Actually, since we started data *at* the first separator, the split
+    # produces an empty first element.  Handle gracefully.
+
+    result_chars = []
+    for segment in segments:
+        segment = segment.strip()
+        if not segment:
+            continue
+
+        # Determine hex vs octal mode.
+        is_hex = _HEX_SENTINEL in segment
+
+        # Remove hex sentinel and any remaining operator/whitespace noise.
+        cleaned = segment.replace(_HEX_SENTINEL, '')
+        cleaned = cleaned.replace('+', '').replace(' ', '').strip()
+
+        if not cleaned:
+            continue
+
+        # cleaned should now be a string of digit characters.
+        if not cleaned.isdigit() and not (is_hex and all(c in '0123456789abcdefABCDEF' for c in cleaned)):
+            # If we still have non-digit residue, try harder: keep only digits.
+            cleaned = re.sub(r'[^0-9a-fA-F]', '', cleaned)
+            if not cleaned:
+                continue
+
+        try:
+            if is_hex:
+                result_chars.append(chr(int(cleaned, 16)))
+            else:
+                result_chars.append(chr(int(cleaned, 8)))
+        except (ValueError, OverflowError):
+            continue
+
+    if not result_chars:
+        return None
+
+    return ''.join(result_chars)