pyjsclear 0.1.2__tar.gz → 0.1.4__tar.gz

pyjsclear-0.1.4/NOTICE

@@ -0,0 +1,28 @@
+PyJSClear
+Copyright 2026 Intezer Labs
+
+This product is a derivative work based on the following projects:
+
+1. obfuscator-io-deobfuscator (v1.0.6)
+   Copyright Ben (ben-sb)
+   Licensed under the Apache License, Version 2.0
+   https://github.com/ben-sb/obfuscator-io-deobfuscator
+
+2. javascript-deobfuscator
+   Copyright Ben (ben-sb)
+   Licensed under the Apache License, Version 2.0
+   https://github.com/ben-sb/javascript-deobfuscator
+
+3. webcrack (v2.14.1)
+   Copyright (c) 2023 j4k0xb
+   Licensed under the MIT License
+   https://github.com/j4k0xb/webcrack
+
+This Python library re-implements the deobfuscation algorithms and transform
+logic from the above projects in pure Python. No source code was directly
+copied; the implementations were written from scratch following the same
+algorithmic approaches.
+
+Test dataset: obfuscated JavaScript samples from the JSIMPLIFIER dataset
+(https://zenodo.org/records/17531662) are included in tests/resources/ for
+evaluation purposes only. They are not part of the distributed package.

{pyjsclear-0.1.2/pyjsclear.egg-info → pyjsclear-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyjsclear
-Version: 0.1.2
+Version: 0.1.4
 Summary: Pure Python JavaScript deobfuscator
 Author-email: Intezer Labs <info@intezer.com>
 License-Expression: Apache-2.0
@@ -82,11 +82,12 @@ pyjsclear input.js --max-iterations 20
 
 ## What it does
 
-PyJSClear applies ~40 transforms in a multi-pass loop until the code
-stabilises (default limit: 50 iterations). A final one-shot pass renames
+PyJSClear applies transforms in a multi-pass loop until the code
+stabilizes (default limit: 50 iterations). A final one-shot pass renames
 variables and converts var/let to const.
 
 **Capabilities:**
+- Whole-file encoding detection: JSFuck, JJEncode, AAEncode, eval-packing
 - String array decoding (obfuscator.io basic/base64/RC4, XOR, class-based)
 - Constant propagation & reassignment elimination
 - Dead code / dead branch / unreachable code removal
@@ -99,20 +100,11 @@ variables and converts var/let to const.
 Large files (>500 KB / >50 K AST nodes) automatically use a lite mode
 that skips expensive transforms.
 
-## Testing
-
-```bash
-pytest tests/                           # all tests
-pytest tests/test_regression.py         # regression suite (62 tests across 25 samples)
-pytest tests/ -n auto                   # parallel execution (requires pytest-xdist)
-```
-
 ## Limitations
 
-- **Optimised for obfuscator.io output.** Other obfuscation tools may only partially deobfuscate.
+- **Best results on obfuscator.io output.** JSFuck, JJEncode, AAEncode, and eval-packed code are fully decoded; other obfuscation tools may only partially deobfuscate.
 - **Large files get reduced treatment.** Files >500 KB or ASTs >50 K nodes skip expensive transforms; files >2 MB use a minimal lite mode.
-- **No minification reversal.** Minified-but-not-obfuscated code won't be reformatted or beautified.
-- **Recursive AST traversal** may hit Python's default recursion limit (~1 000 frames) on extremely deep nesting.
+- **Recursive AST traversal** may hit Python's default recursion limit (~1 000 frames) on extremely deep nesting; the deobfuscator catches this and returns the best partial result.
 
 ## License
 
@@ -120,7 +112,13 @@ Apache License 2.0 — see [LICENSE](LICENSE).
 
 This project is a derivative work based on
 [obfuscator-io-deobfuscator](https://github.com/ben-sb/obfuscator-io-deobfuscator)
-(Apache 2.0) and
+(Apache 2.0),
 [javascript-deobfuscator](https://github.com/ben-sb/javascript-deobfuscator)
-(Apache 2.0). See [THIRD_PARTY_LICENSES.md](THIRD_PARTY_LICENSES.md) and
+(Apache 2.0), and
+[webcrack](https://github.com/j4k0xb/webcrack) (MIT).
+See [THIRD_PARTY_LICENSES.md](THIRD_PARTY_LICENSES.md) and
 [NOTICE](NOTICE) for full attribution.
+
+Test samples include obfuscated JavaScript from the
+[JSIMPLIFIER dataset](https://zenodo.org/records/17531662) (GPL-3.0),
+used solely for evaluation purposes.

{pyjsclear-0.1.2 → pyjsclear-0.1.4}/README.md

@@ -56,11 +56,12 @@ pyjsclear input.js --max-iterations 20
 
 ## What it does
 
-PyJSClear applies ~40 transforms in a multi-pass loop until the code
-stabilises (default limit: 50 iterations). A final one-shot pass renames
+PyJSClear applies transforms in a multi-pass loop until the code
+stabilizes (default limit: 50 iterations). A final one-shot pass renames
 variables and converts var/let to const.
 
 **Capabilities:**
+- Whole-file encoding detection: JSFuck, JJEncode, AAEncode, eval-packing
 - String array decoding (obfuscator.io basic/base64/RC4, XOR, class-based)
 - Constant propagation & reassignment elimination
 - Dead code / dead branch / unreachable code removal
@@ -73,20 +74,11 @@ variables and converts var/let to const.
 Large files (>500 KB / >50 K AST nodes) automatically use a lite mode
 that skips expensive transforms.
 
-## Testing
-
-```bash
-pytest tests/                           # all tests
-pytest tests/test_regression.py         # regression suite (62 tests across 25 samples)
-pytest tests/ -n auto                   # parallel execution (requires pytest-xdist)
-```
-
 ## Limitations
 
-- **Optimised for obfuscator.io output.** Other obfuscation tools may only partially deobfuscate.
+- **Best results on obfuscator.io output.** JSFuck, JJEncode, AAEncode, and eval-packed code are fully decoded; other obfuscation tools may only partially deobfuscate.
 - **Large files get reduced treatment.** Files >500 KB or ASTs >50 K nodes skip expensive transforms; files >2 MB use a minimal lite mode.
-- **No minification reversal.** Minified-but-not-obfuscated code won't be reformatted or beautified.
-- **Recursive AST traversal** may hit Python's default recursion limit (~1 000 frames) on extremely deep nesting.
+- **Recursive AST traversal** may hit Python's default recursion limit (~1 000 frames) on extremely deep nesting; the deobfuscator catches this and returns the best partial result.
 
 ## License
 
@@ -94,7 +86,13 @@ Apache License 2.0 — see [LICENSE](LICENSE).
 
 This project is a derivative work based on
 [obfuscator-io-deobfuscator](https://github.com/ben-sb/obfuscator-io-deobfuscator)
-(Apache 2.0) and
+(Apache 2.0),
 [javascript-deobfuscator](https://github.com/ben-sb/javascript-deobfuscator)
-(Apache 2.0). See [THIRD_PARTY_LICENSES.md](THIRD_PARTY_LICENSES.md) and
+(Apache 2.0), and
+[webcrack](https://github.com/j4k0xb/webcrack) (MIT).
+See [THIRD_PARTY_LICENSES.md](THIRD_PARTY_LICENSES.md) and
 [NOTICE](NOTICE) for full attribution.
+
+Test samples include obfuscated JavaScript from the
+[JSIMPLIFIER dataset](https://zenodo.org/records/17531662) (GPL-3.0),
+used solely for evaluation purposes.

{pyjsclear-0.1.2 → pyjsclear-0.1.4}/THIRD_PARTY_LICENSES.md

@@ -237,3 +237,30 @@ https://github.com/ben-sb/javascript-deobfuscator/blob/master/LICENSE).
 **Features derived from this project:** hex escape decoding (`--he`),
 static array unpacking (`--su`), property access transformation (`--tp`).
 
+---
+
+## webcrack
+
+- **Version:** 2.14.1
+- **Author:** j4k0xb
+- **Repository:** https://github.com/j4k0xb/webcrack
+- **License:** MIT
+
+See [licenses/LICENSE-webcrack](licenses/LICENSE-webcrack) for the full license text.
+
+**Features derived from this project:** general deobfuscation transform
+patterns and architecture reference.
+
+---
+
+## Test dataset
+
+- **JSIMPLIFIER dataset**
+- **Author:** Dongchao Zhou
+- **Source:** https://zenodo.org/records/17531662
+- **License:** GPL-3.0
+
+Obfuscated JavaScript samples from this dataset are included in
+`tests/resources/` for evaluation purposes only. They are not part of the
+distributed package and no code from JSIMPLIFIER is incorporated into
+PyJSClear.

{pyjsclear-0.1.2 → pyjsclear-0.1.4}/pyjsclear/__init__.py

@@ -8,10 +8,10 @@ Python package.
 from .deobfuscator import Deobfuscator
 
 
-__version__ = '0.1.2'
+__version__ = '0.1.4'
 
 
-def deobfuscate(code, max_iterations=50):
+def deobfuscate(code: str, max_iterations: int = 50) -> str:
     """Deobfuscate JavaScript code. Returns cleaned source.
 
     Args:
@@ -24,7 +24,7 @@ def deobfuscate(code, max_iterations=50):
     return Deobfuscator(code, max_iterations=max_iterations).execute()
 
 
-def deobfuscate_file(input_path, output_path=None, max_iterations=50):
+def deobfuscate_file(input_path: str, output_path: str | None = None, max_iterations: int = 50) -> str | bool:
     """Deobfuscate a JavaScript file.
 
     Args:
@@ -35,13 +35,13 @@ def deobfuscate_file(input_path, output_path=None, max_iterations=50):
     Returns:
         True if content changed (when output_path given), or the deobfuscated string.
     """
-    with open(input_path, 'r', errors='replace') as f:
-        code = f.read()
+    with open(input_path, 'r', errors='replace') as input_file:
+        code = input_file.read()
 
     result = deobfuscate(code, max_iterations=max_iterations)
 
     if output_path:
-        with open(output_path, 'w') as f:
-            f.write(result)
+        with open(output_path, 'w') as output_file:
+            output_file.write(result)
         return result != code
     return result

{pyjsclear-0.1.2 → pyjsclear-0.1.4}/pyjsclear/__main__.py

@@ -6,7 +6,7 @@ import sys
 from . import deobfuscate
 
 
-def main():
+def main() -> None:
     parser = argparse.ArgumentParser(description='Deobfuscate JavaScript files.')
     parser.add_argument('input', help='Input JS file (use - for stdin)')
     parser.add_argument('-o', '--output', help='Output file (default: stdout)')
@@ -29,8 +29,9 @@ def main():
     if args.output:
         with open(args.output, 'w') as output_file:
             output_file.write(result)
-    else:
-        sys.stdout.write(result)
+        return
+
+    sys.stdout.write(result)
 
 
 if __name__ == '__main__':

{pyjsclear-0.1.2 → pyjsclear-0.1.4}/pyjsclear/deobfuscator.py

@@ -2,6 +2,7 @@
 
 from .generator import generate
 from .parser import parse
+from .scope import build_scope_tree
 from .transforms.aa_decode import aa_decode
 from .transforms.aa_decode import is_aa_encoded
 from .transforms.anti_tamper import AntiTamperRemover
@@ -28,6 +29,10 @@ from .transforms.global_alias import GlobalAliasInliner
 from .transforms.hex_escapes import HexEscapes
 from .transforms.hex_escapes import decode_hex_escapes_source
 from .transforms.hex_numerics import HexNumerics
+from .transforms.jj_decode import is_jj_encoded
+from .transforms.jj_decode import jj_decode
+from .transforms.jsfuck_decode import is_jsfuck
+from .transforms.jsfuck_decode import jsfuck_decode
 from .transforms.logical_to_if import LogicalToIf
 from .transforms.member_chain_resolver import MemberChainResolver
 from .transforms.noop_calls import NoopCallRemover
@@ -49,6 +54,22 @@ from .transforms.xor_string_decode import XorStringDecoder
 from .traverser import simple_traverse
 
 
+# Transforms that use build_scope_tree and benefit from cached scope
+_SCOPE_TRANSFORMS = frozenset(
+    {
+        ConstantProp,
+        SingleUseVarInliner,
+        ReassignmentRemover,
+        ProxyFunctionInliner,
+        UnusedVariableRemover,
+        ObjectSimplifier,
+        StringRevealer,
+        VariableRenamer,
+        VarToConst,
+        LetToConst,
+    }
+)
+
 # StringRevealer runs first to handle string arrays before other transforms
 # modify the wrapper function structure.
 # Remaining transforms follow obfuscator-io-deobfuscator order.
@@ -102,37 +123,49 @@ _LITE_MAX_ITERATIONS = 10
 _NODE_COUNT_LIMIT = 50_000  # Skip ControlFlowRecoverer above this
 
 
-def _count_nodes(ast):
+def _count_nodes(ast: dict) -> int:
     """Count total AST nodes."""
     count = 0
 
-    def cb(node, parent):
+    def increment_count(node: dict, parent: dict | None) -> None:
         nonlocal count
         count += 1
 
-    simple_traverse(ast, cb)
+    simple_traverse(ast, increment_count)
     return count
 
 
 class Deobfuscator:
     """Multi-pass JavaScript deobfuscator."""
 
-    def __init__(self, code, max_iterations=50):
+    def __init__(self, code: str, max_iterations: int = 50) -> None:
         self.original_code = code
         self.max_iterations = max_iterations
 
-    def _run_pre_passes(self, code):
+    def _run_pre_passes(self, code: str) -> str | None:
         """Run encoding detection and eval unpacking pre-passes.
 
         Returns decoded code if an encoding/packing was detected and decoded,
         or None to continue with the normal AST pipeline.
         """
+        # JSFuck check (must be first — these are whole-file encodings)
+        if is_jsfuck(code):
+            decoded = jsfuck_decode(code)
+            if decoded:
+                return decoded
+
         # AAEncode check
         if is_aa_encoded(code):
             decoded = aa_decode(code)
             if decoded:
                 return decoded
 
+        # JJEncode check
+        if is_jj_encoded(code):
+            decoded = jj_decode(code)
+            if decoded:
+                return decoded
+
         # Eval packer check
         if is_eval_packed(code):
             decoded = eval_unpack(code)
@@ -141,7 +174,10 @@ class Deobfuscator:
 
         return None
 
-    def execute(self):
+    # Maximum number of outer re-parse cycles (generate → re-parse → re-transform)
+    _MAX_OUTER_CYCLES = 5
+
+    def execute(self) -> str:
         """Run all transforms and return cleaned source."""
         code = self.original_code
 
@@ -162,66 +198,120 @@ class Deobfuscator:
                 return decoded
             return self.original_code
 
-        # Determine optimization mode based on code size
-        code_size = len(code)
+        # Outer loop: run AST transforms until generate→re-parse converges.
+        # Post-passes (VariableRenamer, VarToConst, LetToConst) only run on
+        # the final cycle to avoid interfering with subsequent transform rounds.
+        previous_code = code
+        last_changed_ast = None
+        try:
+            for _cycle in range(self._MAX_OUTER_CYCLES):
+                changed = self._run_ast_transforms(
+                    ast,
+                    code_size=len(previous_code),
+                )
+
+                if not changed:
+                    break
+
+                last_changed_ast = ast
+
+                try:
+                    generated = generate(ast)
+                except Exception:
+                    break
+
+                if generated == previous_code:
+                    break
+
+                previous_code = generated
+
+                # Re-parse for the next cycle
+                try:
+                    ast = parse(generated)
+                except SyntaxError:
+                    break
+
+            # Run post-passes on the final AST (always — they're cheap and handle
+            # cosmetic transforms like var→const even when no main transforms fired)
+            any_post_changed = False
+            for post_transform in [VariableRenamer, VarToConst, LetToConst]:
+                try:
+                    if post_transform(ast).execute():
+                        any_post_changed = True
+                except Exception:
+                    pass
+
+            if last_changed_ast is None and not any_post_changed:
+                return self.original_code
+
+            try:
+                return generate(ast)
+            except Exception:
+                return previous_code
+        except RecursionError:
+            # Safety net: esprima's parser is purely recursive with no depth
+            # limit, so deeply nested JS hits Python's recursion limit during
+            # parsing or re-parsing.  Our AST walkers are cheaper per level
+            # but also recursive.  Return best result so far.
+            return previous_code
+
+    def _run_ast_transforms(self, ast: dict, code_size: int = 0) -> bool:
+        """Run all AST transform passes. Returns True if any transform changed the AST."""
+        node_count = _count_nodes(ast) if code_size > _LARGE_FILE_SIZE else 0
+
         lite_mode = code_size > _MAX_CODE_SIZE
         max_iterations = self.max_iterations
         if code_size > _LARGE_FILE_SIZE:
             max_iterations = min(max_iterations, _LITE_MAX_ITERATIONS)
 
-        # Check node count for expensive transform gating
-        node_count = _count_nodes(ast) if code_size > _LARGE_FILE_SIZE else 0
-
         # For very large ASTs, further reduce iterations
         if node_count > 100_000:
             max_iterations = min(max_iterations, 3)
 
         # Build transform list based on mode
         transform_classes = TRANSFORM_CLASSES
-        if lite_mode:
-            transform_classes = [t for t in TRANSFORM_CLASSES if t not in _EXPENSIVE_TRANSFORMS]
-        elif node_count > _NODE_COUNT_LIMIT:
+        if lite_mode or node_count > _NODE_COUNT_LIMIT:
             transform_classes = [t for t in TRANSFORM_CLASSES if t not in _EXPENSIVE_TRANSFORMS]
 
         # Track which transforms are no longer productive
         skip_transforms = set()
 
+        # Cache scope tree across transforms — only rebuild when a transform
+        # that modifies bindings returns changed=True
+        scope_tree = None
+        node_scope = None
+        scope_dirty = True  # Start dirty to build on first use
+
         # Multi-pass transform loop
         any_transform_changed = False
-        for i in range(max_iterations):
+        for iteration in range(max_iterations):
             modified = False
             for transform_class in transform_classes:
                 if transform_class in skip_transforms:
                     continue
                 try:
-                    transform = transform_class(ast)
+                    # Build scope tree lazily when needed by a scope-using transform
+                    if transform_class in _SCOPE_TRANSFORMS and scope_dirty:
+                        scope_tree, node_scope = build_scope_tree(ast)
+                        scope_dirty = False
+
+                    if transform_class in _SCOPE_TRANSFORMS:
+                        transform = transform_class(ast, scope_tree=scope_tree, node_scope=node_scope)
+                    else:
+                        transform = transform_class(ast)
                     result = transform.execute()
                 except Exception:
                     continue
                 if result:
                     modified = True
                     any_transform_changed = True
-                else:
-                    # If a transform didn't change anything after the first pass,
-                    # skip it in subsequent iterations
-                    if i > 0:
-                        skip_transforms.add(transform_class)
+                    # Any AST change invalidates the cached scope tree
+                    scope_dirty = True
+                elif iteration > 0:
+                    # Skip transforms that haven't changed anything after the first pass
+                    skip_transforms.add(transform_class)
 
             if not modified:
                 break
 
-        # Post-passes: cosmetic transforms that run once after convergence
-        for post_transform in [VariableRenamer, VarToConst, LetToConst]:
-            try:
-                if post_transform(ast).execute():
-                    any_transform_changed = True
-            except Exception:
-                pass
-
-        if not any_transform_changed:
-            return self.original_code
-
-        try:
-            return generate(ast)
-        except Exception:
-            return self.original_code
+        return any_transform_changed