jsunveil.
jsunveil targets string-array obfuscation by structure rather than by sample. It extracts only the table and decoder, evaluates them inside a sealed Node.js sandbox, then uses Babel to inline recovered values and strip common decoys.
Architecture
Small boundaries. Explicit behavior.
Structural matching identifies stable obfuscation shapes.
A restricted evaluator reconstructs the plaintext string map.
Babel traversals replace literal decoder calls deterministically.
A final cleanup pass emits readable, formatted JavaScript.
Implementation
The important path, in code.
A representative excerpt showing the project's approach. The complete implementation and history remain available in the public repository.
const sandbox = {};vm.createContext(sandbox);vm.runInContext(decoderSource, sandbox, { timeout: 1000 });const strings = new Map();for (let i = 0; i < sandbox.__arr.length; i += 1) { strings.set(i, sandbox.__decode(i));}return inlineDecoderCalls(ast, strings);Capabilities
Locates randomized string tables and decoder functions
Executes only the minimum code inside an isolated VM
Inlines decoder calls through an AST transformation
Removes dead branches and common self-defending wrappers