{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials/blob/37092955c2ad361364a2162149df9119045de3d0/package.json",
    "https://github.com/SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials/blob/37092955c2ad361364a2162149df9119045de3d0/package-lock.json",
    "https://github.com/SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials/tree/37092955c2ad361364a2162149df9119045de3d0/String%20Concealing",
    "https://github.com/SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials/tree/37092955c2ad361364a2162149df9119045de3d0/Proxy%20Functions",
    "https://github.com/SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials/blob/37092955c2ad361364a2162149df9119045de3d0/String%20Concealing/String%20Encryption/deobber.js",
    "https://github.com/SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials/blob/37092955c2ad361364a2162149df9119045de3d0/LICENSE",
    "https://steakenthusiast.github.io/2022/05/21/Deobfuscating-Javascript-via-AST-An-Introduction-to-Babel/",
    "https://steakenthusiast.github.io/2023/10/11/CVE-2023-45133-Finding-an-Arbitrary-Code-Execution-Vulnerability-In-Babel/",
    "https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92",
    "https://nodejs.org/api/vm.html"
  ],
  "category": "learning",
  "description_en": "Companion code for the ReverseJS blog's 2022 series on deobfuscating JavaScript by manipulating abstract syntax trees with Babel. Each folder pairs a small obfuscated sample with a deobfuscator script and its output, covering string concealing (escape sequences, concatenation, string arrays and string encryption), constant folding including JSFuck-style code, substitution of constant variables, bracket-to-dot property access, dead-code removal, proxy functions and sequence expressions. The README presents them as short learning examples rather than a production deobfuscator.",
  "description_zh": "ReverseJS 博客 2022 年系列文章的配套代码，该系列讲解如何借助 Babel 操作抽象语法树来反混淆 JavaScript。每个目录都包含一个小型混淆样例、对应的反混淆脚本及其输出，主题涵盖字符串隐藏（转义序列、字符串拼接、字符串数组和字符串加密）、常量折叠（含 JSFuck 风格代码）、常量变量替换、方括号属性访问改为点号访问、死代码删除、代理函数以及逗号序列表达式。README 将其定位为简短的学习示例，而非可用于生产的反混淆工具。",
  "entry_url": "https://awesomerea.org/resources/reversejs-ast-deobfuscation-materials/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/reversejs-ast-deobfuscation-materials/",
  "evidence_url": "https://github.com/SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials/blob/37092955c2ad361364a2162149df9119045de3d0/README.md",
  "group": "learn",
  "id": "reversejs-ast-deobfuscation-materials",
  "json_url": "https://awesomerea.org/resources/reversejs-ast-deobfuscation-materials/record.json",
  "kind": "learning-resource",
  "markdown_url": "https://awesomerea.org/resources/reversejs-ast-deobfuscation-materials/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/reversejs-ast-deobfuscation-materials/index.md",
  "name": "Supplementary AST-Based Deobfuscation Materials",
  "name_zh": "ReverseJS AST 反混淆配套资料",
  "record_type": "resource",
  "relationship": "learning",
  "requirements": [
    "Reviewed at the 2023-10-20 master commit, whose last change bumped @babel/traverse to 7.23.2. The blog lists seven posts in the series from May and June 2022, and folders such as Proxy Functions and Sequence Expressions have no matching post; the README warns that code not published on the blog is outdated and experimental, may be inaccurate or buggy, will likely not be updated and should not be used in a production deobfuscator.",
    "Needs Node.js and npm install: package.json declares @babel/core and js-beautify, and the lockfile resolves @babel/parser, @babel/traverse and @babel/generator 7.23.x. Each script is run with node from its folder against the bundled sample. The String Encryption example also imports chrome-remote-interface-extra, which package.json does not list.",
    "The samples are short, author-written obfuscations, so applying the techniques to other code needs the analyst's own inputs and checking. The VM-evaluation proxy-function example and the String Encryption example run code from the sample through Node's vm module, which Node.js documents as not a security mechanism. The author's later blog post reports CVE-2023-45133, an arbitrary-code-execution flaw in @babel/traverse before 7.23.2; the reviewed lockfile already resolves 7.23.2.",
    "There are no tests or CI (the npm test script is a placeholder); expected outputs are committed beside each sample.",
    "MIT (LICENSE), although package.json keeps npm's default ISC field."
  ],
  "requirements_zh": [
    "审阅对象为 2023-10-20 的 master 提交，其最后一项改动是将 @babel/traverse 升级到 7.23.2。博客列出该系列在 2022 年 5 月和 6 月发表的七篇文章，而代理函数（Proxy Functions）和序列表达式（Sequence Expressions）等目录没有对应文章；README 提醒，未在博客发表的代码已过时且属实验性质，可能不准确或有缺陷，作者大概率不会再更新，不建议用于生产环境的反混淆工具。",
    "需要 Node.js 并执行 npm install：package.json 声明 @babel/core 和 js-beautify，锁文件解析出的 @babel/parser、@babel/traverse 和 @babel/generator 为 7.23.x。每个脚本需在其所在目录中用 node 对附带样例运行。String Encryption 示例还导入了 package.json 未列出的 chrome-remote-interface-extra。",
    "样例都是作者自己编写的简短混淆代码，将这些技术用于其他代码时，需要分析者自备输入并自行核对结果。基于 VM 求值的代理函数示例和 String Encryption 示例会通过 Node 的 vm 模块执行样例中的代码，而 Node.js 文档明确说明该模块不是安全机制。作者后来的博客文章报告了 CVE-2023-45133，即 7.23.2 之前的 @babel/traverse 中存在任意代码执行漏洞；所审阅的锁文件已解析为 7.23.2。",
    "仓库没有测试或 CI（npm test 脚本只是占位）；各样例旁附有预期输出。",
    "采用 MIT 许可（见 LICENSE），但 package.json 仍保留 npm 默认的 ISC 字段。"
  ],
  "targets": [
    "website"
  ],
  "url": "https://github.com/SteakEnthusiast/Supplementary-AST-Based-Deobfuscation-Materials",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}