# minusone

> Airbus CERT's Rust deobfuscation engine for scripts: it parses PowerShell or JavaScript with tree-sitter, applies rules that infer the values of syntax-tree nodes and prints a simplified script. The PowerShell rules fold arithmetic, string operations, casts, -join, -replace and format operators, Base64 and UTF decoding, predictable variables and loops, and also resolve Gzip or Deflate streams and AES decryption when the data and key are in the script; the newer JavaScript rules cover literals, operators, string and array built-ins, atob and btoa, Buffer calls, predictable function calls and JSFuck constructs. The CLI can list, select or skip rules and export every rewrite step as HTML or JSON, and Python and WebAssembly bindings embed the engine, including in an online version linked from the README.

- Type: Tool
- Targets: Website
- Category: Website analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-20
- Added to the catalog: 2026-11-02
- Original resource: <https://github.com/airbus-cert/minusone>
- Primary source: <https://github.com/airbus-cert/minusone/blob/48d85ed29a293359c5a990569de70561dd2c312c/README.md>
- Catalog page: <https://awesomerea.org/resources/minusone-script-deobfuscator/>
- Record JSON: <https://awesomerea.org/resources/minusone-script-deobfuscator/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/minusone-script-deobfuscator/index.md)

## Requirements & limits

- No prebuilt CLI binaries: the latest GitHub release, v0.4.2 from 2025-10-01, has no attached files, and the published packages are minusone 0.4.1 on crates.io, pyminusone 0.4.1 on PyPI with Linux x86_64 and Windows wheels, and minusonejs 0.5.0 on npm. The reviewed main commit is 538 commits past v0.4.2 and declares the core library 0.5.0 and minusone-cli 0.6.1.
- Build with Cargo; the crates use Rust edition 2024, Cargo.lock is not committed, and the PowerShell grammar comes from an unpinned Git dependency on a tree-sitter-powershell fork. The CLI needs --lang powershell or --lang javascript. The project's devenv/Nix environment uses nightly Rust, the Python bindings build with maturin, and the WebAssembly module targets wasm32-wasip2 and is transpiled to JavaScript with jco.
- The README still lists only PowerShell as supported, names basic JavaScript support as a roadmap item and links rule files at older src/ paths; the JavaScript backend dates from March 2026, after the crates.io and PyPI packages and the v0.4.2 release. Rules rewrite the script statically from values they can infer, and the analyst supplies the scripts; the samples folder holds only small JSFuck test files next to their plain sources.
- CI runs devenv test, which runs cargo test and the Python binding test script; the core has unit tests for both languages. MIT license; Cargo metadata names Airbus CERT as author, and the LICENSE copyright line names Sylvain Peyrefitte.

## Primary sources

1. <https://github.com/airbus-cert/minusone/blob/48d85ed29a293359c5a990569de70561dd2c312c/README.md>
2. <https://github.com/airbus-cert/minusone/blob/48d85ed29a293359c5a990569de70561dd2c312c/core/src/ps/mod.rs>
3. <https://github.com/airbus-cert/minusone/blob/48d85ed29a293359c5a990569de70561dd2c312c/core/src/js/mod.rs>
4. <https://github.com/airbus-cert/minusone/blob/48d85ed29a293359c5a990569de70561dd2c312c/core/src/ps/compression.rs>
5. <https://github.com/airbus-cert/minusone/blob/48d85ed29a293359c5a990569de70561dd2c312c/core/src/ps/crypto.rs>
6. <https://github.com/airbus-cert/minusone/blob/48d85ed29a293359c5a990569de70561dd2c312c/crates/minusone-cli/src/cli.rs>
7. <https://github.com/airbus-cert/minusone/blob/48d85ed29a293359c5a990569de70561dd2c312c/core/Cargo.toml>
8. <https://github.com/airbus-cert/minusone/blob/48d85ed29a293359c5a990569de70561dd2c312c/crates/minusone-cli/Cargo.toml>
9. <https://github.com/airbus-cert/minusone/blob/48d85ed29a293359c5a990569de70561dd2c312c/crates/minusonejs/justfile>
10. <https://github.com/airbus-cert/minusone/blob/48d85ed29a293359c5a990569de70561dd2c312c/devenv.nix>
11. <https://github.com/airbus-cert/minusone/blob/48d85ed29a293359c5a990569de70561dd2c312c/.github/workflows/cargo_test.yml>
12. <https://github.com/airbus-cert/minusone/tree/48d85ed29a293359c5a990569de70561dd2c312c/samples>
13. <https://github.com/airbus-cert/minusone/blob/48d85ed29a293359c5a990569de70561dd2c312c/LICENSE>
14. <https://github.com/airbus-cert/minusone/releases/tag/v0.4.2>
15. <https://crates.io/crates/minusone/0.4.1>
16. <https://pypi.org/project/pyminusone/0.4.1/>
17. <https://www.npmjs.com/package/minusonejs/v/0.5.0>

## More in Websites

- [JS-Deobfuscator (0x1Avram)](https://awesomerea.org/resources/0x1avram-js-deobfuscator/index.md) · Tool
- [HTTP Toolkit](https://awesomerea.org/resources/http-toolkit/index.md) · Tool
- [Javascript Deobfuscator](https://awesomerea.org/resources/willnode-deobfuscator/index.md) · Tool
- [go-fAST](https://awesomerea.org/resources/go-fast-js-ast/index.md) · Tool
- [Hetty](https://awesomerea.org/resources/hetty/index.md) · Tool
- [debundle](https://awesomerea.org/resources/debundle/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.