SRI Lab · ETH Zurich

JSNice

Statistical renaming, type inference and deobfuscation for JavaScript.

Minification replaces the names a programmer chose and every type annotation they wrote with shorter, meaningless names. JSNice restores them using a probabilistic model, trained on open-source repositories. The model predicts the names and JSDoc types that best fit the way each variable is actually used.

How JSNice works

Joint predictions: all unknown properties of a program are predicted simultaneously so that the result is likely and internally consistent. Names that cannot be safely changed such as globals, object properties and API names are held fixed, and no two distinct locals in one scope are given the same name.

Minified input

function f(a, b, c){b.open('GET',a,false);b.send(c);}

Predicted names

function f(fileUrl, req, message) {
  req.open('GET', fileUrl, false);
  req.send(message);
}
Example with names.

Input without annotations

function f(a) {
  return a + 1;
}

Inferred JSDoc

/**
 * @param {number} n
 * @return {?}
 */
function f(n) {
  return n + 1;
}
Example with types.

Paper

Predicting Program Properties from “Big Code” (POPL 2015).

  • 63.4%of identifier names reconstructed exactly, against 25.3% for leaving the minified code untouched
  • 81.6%precision on predicted type annotations, at 66.9% recall
  • 30,000+developers used JSNice in the first week after its 2014 release, per the paper

Authors

Get the code

  • Nice2Predict

    “Learning framework for program property prediction.” The language-agnostic structured-prediction core — training and MAP inference — that served as the backend for JSNice. Language-specific parsing and feature extraction are left to a front end.

    C++ · Apache-2.0 · github.com/eth-sri/Nice2Predict

  • UnuglifyJS

    “A simpler open-source version of JavaScript deobfuscator JSNice.” A fork of UglifyJS that parses JavaScript, emits the dependency network, and applies the names Nice2Predict returns. Name prediction only — it does not do type inference. Published on npm as unuglify-js.

    JavaScript · BSD (inherited from UglifyJS) · github.com/eth-sri/UnuglifyJS

  • JSNice artifact

    The artifact published alongside the paper, containing an engine, a trained model and the evaluation dataset. The list of GitHub repositories used for training is published separately.

    sri.inf.ethz.ch/jsnice-artifact

  • debin

    “Machine Learning to Deobfuscate Binaries.” The same idea carried to stripped binaries: recovering names and types as predictions. Built, like DeGuard for Android, on top of Nice2Predict.

    Python · Apache-2.0 · github.com/eth-sri/debin

More resources