google/jsir

What it solves

JSIR provides a way to analyze and transform JavaScript code that balances high-level source representation with low-level dataflow analysis. This allows developers to perform complex tasks like decompiling bytecode back into readable JavaScript or removing obfuscation from code.

How it works

It uses an MLIR-based (Multi-Level Intermediate Representation) high-level intermediate representation. This design uses MLIR regions to model control flow structures, ensuring the representation is high-level enough to be converted back to an Abstract Syntax Tree (AST) for source-to-source transformation, yet low-level enough to support technical analyses like constant propagation and taint analysis.

Who it’s for

Security researchers and developers focused on code analysis, decompilation, and deobfuscation of JavaScript.

Highlights

• Lossless Conversion: Supports converting code back to source without losing information.
• MLIR Integration: Leverages the MLIR framework for advanced analysis.
• Deobfuscation Capabilities: Can be combined with LLMs (like Gemini) to clean up obfuscated code.
• Bytecode Decompilation: Capable of lifting Hermes bytecode back into JavaScript source code.