{"repo":"airbus-cert/minusone","free":true,"listed":false,"github":"https://github.com/airbus-cert/minusone","clone":"git clone https://github.com/airbus-cert/minusone.git","description":"Powershell/Javascript deobfuscator based on tree-sitter","language":"Rust","stars":101,"topics":["deobfuscation","javascript","powershell","tree-sitter"],"license":"MIT","category":"cli-tools","readme_excerpt":"minusone $$\\textit{obfuscation}^{-1}$$ Reverse operation of script obfuscation 🌐 An online version is available: https://minusone.skyblue.team/ 🌐 Usage MinusOne is written in Rust and can be built, deployed or executed through the Cargo package manager: By default, cargo will build the minusone library and run the minusone-cli binary. Bindings The following bindings are available: - Python, allowing MinusOne to be easily integrated into Jupyter notebooks - JS (WASM), allowing to embeed minusone in web apps like https://minusone.skyblue.team/ To build and publish these packages, use the justfile modules: Project structure - core : minusone core library - src/ps : minusone powershell specific rules - crates - minusone-cli : Simple CLI to use minusone from your terminal - pyminusone : Python bindings for minusone - minusone-cli : JS bindings for minusone, built with WASM Description MinusOne is a deobfuscation engine focused on scripting languages. MinusOne is based on tree-sitter for parsing, and will apply a set of rules to infer node values and simplify expressions. MinusOne supports the following languages: Powershell By taking the following example from Invoke-Obfuscation : It will produce the following output : What is a Rule? A rule will produce a result when visiting a particular node, depending on its children or parent. A rule will be called when entering and leaving a node. Creating a rule for Powershell is as easy as implementing the RuleMut trait : The enter() met","default_branch":null,"files":null,"tree":[],"storefront":"/r/airbus-cert","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/airbus-cert/minusone/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}