AwesomeREA.org

2026 · Conference paper

From Obfuscated to Obvious: A Comprehensive JavaScript Deobfuscation Tool for Security Analysis

Dongchao Zhou; Lingyun Ying; Huajun Chai; Dongbin Wang

JSimplifier recovers readable JavaScript from obfuscated scripts in three stages. A preprocessor normalizes malformed or mixed-encoding input; a deobfuscator combines AST-based static simplification with selective execution of obfuscated call sites in a Node.js vm context, feeding the results back into the AST; and an optional humanizer renames identifiers with an LLM, adapting HumanifyJS, then formats the output with Prettier. The authors catalog 20 obfuscation techniques in four categories and assemble MalJS (23,212 malicious scripts) and BenignJS (21,209 scripts). They report that JSimplifier processes all 44,421 samples and reduces Halstead length by 88.2% on 1,296 multi-technique JsDeObsBench samples.

Scope and limitations

The headline “100% correctness” is syntactic validity on 400 samples (100 BenignJS, 300 MalJS) checked by parser and by hand; behavioral consistency, judged with Joern CFG/DDG comparison and manual review, holds for 83 of 100 samples. The 20-technique capability test applies each technique to one representative snippet, and the static and dynamic stages alone handle 19; identifier renaming needs the LLM stage. Readability gains come from four LLMs (Claude 3.7 Sonnet, Gemini 2.5 Pro, DeepSeek-R1 and GPT-o3) scoring 60 MalJS pairs on a 0–10 scale; a separate check of GPT-4o-mini renaming on 100 samples found 12% hallucinated names, and the user study had 9 participants. The entropy comparison excludes the LLM stage. MalJS was collected with a security company and BenignJS mixes Tranco top-site scripts with 2,000 clean samples obfuscated by the authors. The authors exclude cryptographic packing, custom interpreters and time-dependent decryption, and note that ES6+ syntax may be downgraded and that vm-based execution carries escape risk. The output is readable JavaScript, not a reconstructed website.

Why it fits this collection

Adds an open-source end-to-end JavaScript deobfuscator with a large real-world evaluation set, complementing the JsDeObsBench benchmark and LLM-based deobfuscation work in recovering readable client-side code.

Publication and review details

Venue
NDSS 2026
Status
Conference paper
Publication / posting date
2026 (exact date not verified)
Date source
The Internet Society's Crossref deposit and the official NDSS paper identify publication year 2026. The PDF footer names the 23–27 February 2026 symposium; no finer publication date is asserted from the event dates.
First arXiv submission
December 16, 2025
arXiv
2512.14070
Reviewed arXiv version
v1
DOI
10.14722/ndss.2026.242198

The four-author order follows the PDF, the NDSS paper page and Crossref. The PDF footer gives ISBN 979-8-9919276-8-0 and the DOI; Crossref lists no pages, and no page range was verified. arXiv v1 (2025-12-16) carries the same DOI in its metadata and no venue comment; the reviewed text is the NDSS final PDF. The paper links XingTuLab/JSIMPLIFIER and Zenodo artifact 10.5281/zenodo.17531662, whose DOI identifies the artifact, not the paper. At the reviewed 2025-12-17 commit the repository's LICENSE is GPL-3.0, while package.json still declares MIT; the Zenodo record states GPL-3.0-or-later. The CLI needs Node.js 20 or later, and LLM renaming needs the user's OpenAI or Gemini API key; --model=none runs the AST stages only. Per the artifact appendix, the roughly 3 GB Zenodo archive includes the MalJS malicious samples; it was not downloaded. The paper credits HumanifyJS for its renaming approach. No code was run.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Report an outdated entry Suggest a translation fix

Primary sources

  1. https://www.ndss-symposium.org/ndss-paper/from-obfuscated-to-obvious-a-comprehensive-javascript-deobfuscation-tool-for-security-analysis/
  2. https://www.ndss-symposium.org/wp-content/uploads/2026-f2198-paper.pdf
  3. https://doi.org/10.14722/ndss.2026.242198
  4. https://api.crossref.org/works/10.14722/ndss.2026.242198
  5. https://arxiv.org/abs/2512.14070
  6. README.md GitHub · XingTuLab/JSIMPLIFIER · Revision eaa72ae
  7. LICENSE GitHub · XingTuLab/JSIMPLIFIER · Revision eaa72ae
  8. package.json GitHub · XingTuLab/JSIMPLIFIER · Revision eaa72ae
  9. https://zenodo.org/records/17531662