AwesomeREA.org

Tool

minusone

Airbus CERT's Rust deobfuscation engine for scripts: it parses PowerShell or JavaScript with tree-sitter, applies rules that infer the values of syntax-tree nodes and prints a simplified script. The PowerShell rules fold arithmetic, string operations, casts, -join, -replace and format operators, Base64 and UTF decoding, predictable variables and loops, and also resolve Gzip or Deflate streams and AES decryption when the data and key are in the script; the newer JavaScript rules cover literals, operators, string and array built-ins, atob and btoa, Buffer calls, predictable function calls and JSFuck constructs. The CLI can list, select or skip rules and export every rewrite step as HTML or JSON, and Python and WebAssembly bindings embed the engine, including in an online version linked from the README.

Targets
Website
Category
Website analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • No prebuilt CLI binaries: the latest GitHub release, v0.4.2 from 2025-10-01, has no attached files, and the published packages are minusone 0.4.1 on crates.io, pyminusone 0.4.1 on PyPI with Linux x86_64 and Windows wheels, and minusonejs 0.5.0 on npm. The reviewed main commit is 538 commits past v0.4.2 and declares the core library 0.5.0 and minusone-cli 0.6.1.
  • Build with Cargo; the crates use Rust edition 2024, Cargo.lock is not committed, and the PowerShell grammar comes from an unpinned Git dependency on a tree-sitter-powershell fork. The CLI needs --lang powershell or --lang javascript. The project's devenv/Nix environment uses nightly Rust, the Python bindings build with maturin, and the WebAssembly module targets wasm32-wasip2 and is transpiled to JavaScript with jco.
  • The README still lists only PowerShell as supported, names basic JavaScript support as a roadmap item and links rule files at older src/ paths; the JavaScript backend dates from March 2026, after the crates.io and PyPI packages and the v0.4.2 release. Rules rewrite the script statically from values they can infer, and the analyst supplies the scripts; the samples folder holds only small JSFuck test files next to their plain sources.
  • CI runs devenv test, which runs cargo test and the Python binding test script; the core has unit tests for both languages. MIT license; Cargo metadata names Airbus CERT as author, and the LICENSE copyright line names Sylvain Peyrefitte. Nothing was built or run.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · airbus-cert/minusone · Revision 48d85ed
  2. core/src/ps/mod.rs GitHub · airbus-cert/minusone · Revision 48d85ed
  3. core/src/js/mod.rs GitHub · airbus-cert/minusone · Revision 48d85ed
  4. core/src/ps/compression.rs GitHub · airbus-cert/minusone · Revision 48d85ed
  5. core/src/ps/crypto.rs GitHub · airbus-cert/minusone · Revision 48d85ed
  6. crates/minusone-cli/src/cli.rs GitHub · airbus-cert/minusone · Revision 48d85ed
  7. core/Cargo.toml GitHub · airbus-cert/minusone · Revision 48d85ed
  8. crates/minusone-cli/Cargo.toml GitHub · airbus-cert/minusone · Revision 48d85ed
  9. crates/minusonejs/justfile GitHub · airbus-cert/minusone · Revision 48d85ed
  10. devenv.nix GitHub · airbus-cert/minusone · Revision 48d85ed
  11. .github/workflows/cargo_test.yml GitHub · airbus-cert/minusone · Revision 48d85ed
  12. samples GitHub · airbus-cert/minusone · Revision 48d85ed
  13. LICENSE GitHub · airbus-cert/minusone · Revision 48d85ed
  14. https://github.com/airbus-cert/minusone/releases/tag/v0.4.2
  15. https://crates.io/crates/minusone/0.4.1
  16. https://pypi.org/project/pyminusone/0.4.1/
  17. https://www.npmjs.com/package/minusonejs/v/0.5.0

More in Websites

All 40 entries in Websites