AwesomeREA.org

Tool

JStillery

Minded Security's JavaScript deobfuscator, which Stefano Di Paola forked from esdeobfuscate in 2015, simplifies scripts by partial evaluation on an esprima AST. It folds constant and string expressions, propagates known values through variables and pure function calls, evaluates calls to built-in String, Array and Number methods and atob/btoa, and parses string arguments passed to eval back into code. It runs as a command-line tool on a file or stdin, as an Express server with a web UI and a REST endpoint, or as a browserified library.

Targets
Website
Category
Website analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • The newest commit on master dates from 2019-04-22, and there are no releases or tags. The 2015 Minded Security blog post that the README links describes JStillery as an internal tool used, among other things, to analyze JavaScript malware samples and normalize scripts for classification. The README also links a hosted REPL at mindedsecurity.github.io/jstillery, which responded at review; only the repository was reviewed.
  • Needs Node.js and npm install; package.json declares no Node.js version and leaves esprima, escodegen and esmangle unpinned, and no lockfile is committed, so each install takes their latest releases. The CLI prints the original and the deobfuscated code. npm run build_server copies the web UI and browserifies the library, and npm run start_server then serves the UI and a /deobfuscate endpoint on port 3001, with server_config.json allowing any origin by default.
  • Partial evaluation is on by default (the USE_PARTIAL environment variable turns it off only when set to an empty string) and passes selected expressions from the input to Node's vm.runInNewContext. Node's documentation says the vm module is not a security mechanism, so analyze untrusted samples in an isolated environment.
  • JStillery predates the newer deobfuscators curated here, such as webcrack, javascript-deobfuscator and the Obfuscator.io Deobfuscator, and its documentation does not mention bundle unpacking, string-array decoding or control-flow unflattening. The mocha suite in tests/ compares output for samples including JSFuck, aaencode, jjencode and Dean Edwards' packer with stored expected results, some of which remain only partly simplified.
  • LICENSE and the README state GPL-3.0, while both package.json files declare ISC; src/jstiller.js keeps the BSD-style notice of esdeobfuscate. The web UI vendors jQuery, Bootstrap, CodeMirror, Font Awesome and js-beautify. The reviewed sources mention no AI or REA use, and no scripts were deobfuscated for this record.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · mindedsecurity/JStillery · Revision 512e9af
  2. package.json GitHub · mindedsecurity/JStillery · Revision 512e9af
  3. jstillery_cli.js GitHub · mindedsecurity/JStillery · Revision 512e9af
  4. src/jstiller.js GitHub · mindedsecurity/JStillery · Revision 512e9af
  5. server/server.js GitHub · mindedsecurity/JStillery · Revision 512e9af
  6. server/server_config.json GitHub · mindedsecurity/JStillery · Revision 512e9af
  7. tests/tests.js GitHub · mindedsecurity/JStillery · Revision 512e9af
  8. tests/tests_OK GitHub · mindedsecurity/JStillery · Revision 512e9af
  9. LICENSE GitHub · mindedsecurity/JStillery · Revision 512e9af
  10. https://blog.mindedsecurity.com/2015/10/advanced-js-deobfuscation-via-ast-and.html
  11. https://nodejs.org/api/vm.html

More in Websites

All 48 entries in Websites