{
  "added_at": "2026-11-04",
  "additional_evidence_urls": [
    "https://github.com/mindedsecurity/JStillery/blob/512e9af2a54eb4592bf6fa6ac8483ceeb5726b03/package.json",
    "https://github.com/mindedsecurity/JStillery/blob/512e9af2a54eb4592bf6fa6ac8483ceeb5726b03/jstillery_cli.js",
    "https://github.com/mindedsecurity/JStillery/blob/512e9af2a54eb4592bf6fa6ac8483ceeb5726b03/src/jstiller.js",
    "https://github.com/mindedsecurity/JStillery/blob/512e9af2a54eb4592bf6fa6ac8483ceeb5726b03/server/server.js",
    "https://github.com/mindedsecurity/JStillery/blob/512e9af2a54eb4592bf6fa6ac8483ceeb5726b03/server/server_config.json",
    "https://github.com/mindedsecurity/JStillery/blob/512e9af2a54eb4592bf6fa6ac8483ceeb5726b03/tests/tests.js",
    "https://github.com/mindedsecurity/JStillery/tree/512e9af2a54eb4592bf6fa6ac8483ceeb5726b03/tests/tests_OK",
    "https://github.com/mindedsecurity/JStillery/blob/512e9af2a54eb4592bf6fa6ac8483ceeb5726b03/LICENSE",
    "https://blog.mindedsecurity.com/2015/10/advanced-js-deobfuscation-via-ast-and.html",
    "https://nodejs.org/api/vm.html"
  ],
  "category": "web-analysis",
  "description_en": "Minded Security's JavaScript deobfuscator, which Stefano Di Paola forked from esdeobfuscate in 2015, simplifies scripts by partial evaluation on an esprima AST. It folds constant and string expressions, propagates known values through variables and pure function calls, evaluates calls to built-in String, Array and Number methods and atob/btoa, and parses string arguments passed to eval back into code. It runs as a command-line tool on a file or stdin, as an Express server with a web UI and a REST endpoint, or as a browserified library.",
  "description_zh": "Minded Security 的 JavaScript 反混淆工具，由 Stefano Di Paola 于 2015 年从 esdeobfuscate 分支而来，在 esprima 语法树上通过部分求值简化脚本。它会折叠常量和字符串表达式，经由变量和纯函数调用传播已知值，对内置 String、Array、Number 方法以及 atob/btoa 的调用求值，并把传给 eval 的字符串参数重新解析为代码。它可作为命令行工具处理文件或标准输入，也可作为带网页界面和 REST 接口的 Express 服务运行，或作为经 browserify 打包的库使用。",
  "entry_url": "https://awesomerea.org/resources/jstillery/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/jstillery/",
  "evidence_url": "https://github.com/mindedsecurity/JStillery/blob/512e9af2a54eb4592bf6fa6ac8483ceeb5726b03/README.md",
  "group": "tools",
  "id": "jstillery",
  "json_url": "https://awesomerea.org/resources/jstillery/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/jstillery/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/jstillery/index.md",
  "name": "JStillery",
  "name_zh": "JStillery JavaScript 部分求值反混淆工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The newest commit on master dates from 2019-04-22, and there are no releases or tags. The 2015 Minded Security blog post that the README links describes JStillery as an internal tool used, among other things, to analyze JavaScript malware samples and normalize scripts for classification. The README also links a hosted REPL at mindedsecurity.github.io/jstillery.",
    "Needs Node.js and npm install; package.json declares no Node.js version and leaves esprima, escodegen and esmangle unpinned, and no lockfile is committed, so each install takes their latest releases. The CLI prints the original and the deobfuscated code. npm run build_server copies the web UI and browserifies the library, and npm run start_server then serves the UI and a /deobfuscate endpoint on port 3001, with server_config.json allowing any origin by default.",
    "Partial evaluation is on by default (the USE_PARTIAL environment variable turns it off only when set to an empty string) and passes selected expressions from the input to Node's vm.runInNewContext. Node's documentation says the vm module is not a security mechanism, so analyze untrusted samples in an isolated environment.",
    "JStillery predates the newer deobfuscators, such as webcrack, javascript-deobfuscator and the Obfuscator.io Deobfuscator, and its documentation does not mention bundle unpacking, string-array decoding or control-flow unflattening. The mocha suite in tests/ compares output for samples including JSFuck, aaencode, jjencode and Dean Edwards' packer with stored expected results, some of which remain only partly simplified.",
    "LICENSE and the README state GPL-3.0, while both package.json files declare ISC; src/jstiller.js keeps the BSD-style notice of esdeobfuscate. The web UI vendors jQuery, Bootstrap, CodeMirror, Font Awesome and js-beautify."
  ],
  "requirements_zh": [
    "master 分支最新提交为 2019-04-22，仓库没有发布版本或标签。README 链接的 2015 年 Minded Security 博客文章称，JStillery 是一款内部工具，用途之一是分析 JavaScript 恶意软件样本、对脚本做规范化以便分类。README 还链接了托管在 mindedsecurity.github.io/jstillery 的在线 REPL。",
    "需要 Node.js 并执行 npm install；package.json 未声明 Node.js 版本，esprima、escodegen 和 esmangle 也未固定版本，且仓库没有锁文件，因此每次安装都会取它们的最新版本。命令行工具会输出原始代码和反混淆后的代码。npm run build_server 会复制网页界面并用 browserify 打包库，随后 npm run start_server 在 3001 端口提供网页界面和 /deobfuscate 接口；server_config.json 默认允许任意来源跨域访问。",
    "部分求值默认开启（只有把 USE_PARTIAL 环境变量设为空字符串时才会关闭），会把输入中选定的表达式交给 Node 的 vm.runInNewContext 执行。Node 文档说明 vm 模块不是安全机制，因此应在隔离环境中分析不可信样本。",
    "JStillery 早于较新反混淆工具，例如 webcrack、javascript-deobfuscator 和 Obfuscator.io Deobfuscator；其文档未提及解包打包文件、解码字符串数组或还原控制流平坦化。tests/ 中的 mocha 测试把 JSFuck、aaencode、jjencode 和 Dean Edwards packer 等样本的输出与保存的预期结果比对，其中部分预期结果仍只是部分简化。",
    "LICENSE 和 README 均声明 GPL-3.0，而两个 package.json 文件都声明 ISC；src/jstiller.js 保留了 esdeobfuscate 的 BSD 式许可声明。网页界面内置了 jQuery、Bootstrap、CodeMirror、Font Awesome 和 js-beautify。"
  ],
  "targets": [
    "website"
  ],
  "url": "https://github.com/mindedsecurity/JStillery",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}