Live data from Hacker News

New Statistical De-minifier and De-obfuscator for JavaScript

jsnice.org

11–20 of 34 posts

Re: New Statistical De-minifier and De-obfuscator for JavaScript

#11
Can this approach be extended to for example generating "matching" tests for the code? Like "I see this function processes dates, here are some popular test cases learned from 1000s other projects"?

Could someone point me to good resources about mining code, most data mining and machine learning articles deal with points in multidimensional space and not objects with complex internal structure like programs...

Re: New Statistical De-minifier and De-obfuscator for JavaScript

#12

Can this approach be extended to for example generating "matching" tests for the code? Like "I see this function processes dates, here are some popular test cases learned from 1000s other projects"? Could someone point me to good resources about mining code, most data mining and machine learning articles deal with points in multidimensional space and not objects with complex internal structure like programs...

The complex internal structure of programs could be reduced to graphs, and machine learning has been working with graphs for decades.

Re: New Statistical De-minifier and De-obfuscator for JavaScript

#15

Why was it unable to infer the type of the return value for generateSeries? The function only has one return statement, and it already knows the type of the return variable is {Array}.

It never shows types of return values, unless it is undefined. The reason is that the method may be overridden with a method with other return type.

Re: New Statistical De-minifier and De-obfuscator for JavaScript

#16
post #10

I took the code presented and put it into packer - http://dean.edwards.name/packer/ , and the "nice" output was not very helpful in that it still looked obfuscated. Maybe I'm misunderstanding something. So the input to js nice was the packed generateSeries function: eval(function(p,a,c,k,e,r){e=function(c) {return(c 35? String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/, String)){while(c--)r[e(c)]=k[c]||e(…

Noticed that too, was kind of happy about it. For most projects I use uglify or Google Closure Compiler and the like, which it seems to do a good job with. When I really want something obfuscated to make it as difficult as possible for someone to figure out what's going on behind the scenes though I use packer and am glad this tool couldn't figure out what to do with it.

Re: New Statistical De-minifier and De-obfuscator for JavaScript

#18

I put in some real world JS found on Hulu, and got a slew of errors like this one: Line 1: Parse error. missing ; before statement

Josh,

Thanks for trying it out. I tried few large samples from Hulu and they seemed to work fine, e.g.:

http://static.huluim.com/huluguru/i18n/en-us/translations-9d...

But indeed, sometimes there could be issues if the code does not compile with the compiler of choice.

Re: New Statistical De-minifier and De-obfuscator for JavaScript

#19
Some rather spectacular failures, though of course these things happen with statistical methods:

  /**
   * @param {string} val
   * @return {?}
   */
  var expect = function(val) {
    return "string" == typeof val;
  };
  /**
   * @param {boolean} deepDataAndEvents
   * @return {?}
   */
  var clone = function(deepDataAndEvents) {
    return "boolean" == typeof deepDataAndEvents;
  };
  /**
   * @param {(boolean|number|string)} obj
   * @return {?}
   */
  var isString = function(obj) {
    return "number" == typeof obj;
  };
Still, neat idea. Seems like there's a lot of room to train it, probably a lot of fun to try to improve things :)
Post reply on HN