Reproduce “CASCADE: LLM-Powered JavaScript Deobfuscator at Google” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Shan Jiang, Pranoy Kovuri, David Tao, Zhixun Tan
Google's CASCADE system leverages a hybrid approach combining the Gemini LLM with a JavaScript Intermediate Representation (JSIR) to deobfuscate JavaScript, specifically targeting string and API obfuscation by Obfuscator.IO. The system accurately detects obfuscation prelude functions in 99.56% of cases and successfully recovers an average of 945 string literals per file across various obfuscation levels with a 98.93% success rate.
Key insights
- Combining LLMs with deterministic compiler IRs effectively mitigates LLM hallucination risks while leveraging their strengths in high-level pattern recognition for precise software engineering tasks.
- Delegating specific, limited tasks like prelude detection to LLMs significantly reduces the maintenance burden associated with brittle, hard-coded pattern-matching rules in deobfuscators.
- The hybrid approach enhances observability, explainability, and verifiability of the deobfuscation process, which are critical for trust and debugging in complex automated code analysis systems.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.