用大模型+编译器技术自动还原混淆的JavaScript代码。
CASCADE: LLM-Powered JavaScript Deobfuscator at Google
- 结合大模型识关键函数，用编译器中间表示做确定性转换。
- 无需上千条规则即可还原原始字符串和接口名，效果稳定可靠。
- 已落地谷歌生产环境，显著提升反混淆效率，适合安全分析者使用。
软件混淆在JavaScript中尤为普遍，严重阻碍代码理解与分析，给软件测试、静态分析和恶意软件检测带来挑战。本文提出CASCADE，一种新型混合方法，融合了Gemini的大规模编码能力与编译器中间表示（JSIR）的确定性转换能力。通过Gemini识别关键前导函数——即主流混淆技术的基础组件，并利用JSIR进行后续代码变换，CASCADE有效恢复原始字符串、API名称等语义元素，并揭示程序原始行为。该方法克服了传统静态与动态去混淆技术的局限，无需数百至数千条硬编码规则，同时保证可靠性与灵活性。CASCADE已部署于谷歌生产环境，显著提升JavaScript去混淆效率，大幅减少逆向工程工作量。
原文摘要 · Abstract (English)
Software obfuscation, particularly prevalent in JavaScript, hinders code comprehension and analysis, posing significant challenges to software testing, static analysis, and malware detection. This paper introduces CASCADE, a novel hybrid approach that integrates the advanced coding capabilities of Gemini with the deterministic transformation capabilities of a compiler Intermediate Representation (IR), specifically JavaScript IR (JSIR). By employing Gemini to identify critical prelude functions, the foundational components underlying the most prevalent obfuscation techniques, and leveraging JSIR for subsequent code transformations, CASCADE effectively recovers semantic elements like original strings and API names, and reveals original program behaviors. This method overcomes limitations of existing static and dynamic deobfuscation techniques, eliminating hundreds to thousands of hardcoded rules while achieving reliability and flexibility. CASCADE is already deployed in Google's production environment, demonstrating substantial improvements in JavaScript deobfuscation efficiency and reducing reverse engineering efforts.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。