This repository contains the core PostCSS library, a programmatic CSS transformation tool. It functions as a parser, an AST manipulator, and a stringifier. Its primary production use is as a library dependency in web development build pipelines (e.g., integrated via webpack, Gulp, or used directly by tools like Autoprefixer and Stylelint) to automate CSS transformations such as adding vendor prefixes, linting, or transpiling future CSS syntax. The architecture is a classic pipeline: CSS text is tokenized and parsed into a tree of Node objects (Root, Rule, Declaration, etc.). A Processor runs an ordered list of plugins, each of which can traverse and modify the tree using a visitor pattern. The modified tree is then stringified back to CSS, with optional source map generation. The core processing engine in `lib/lazy-result.js` is a sophisticated implementation of the visitor pattern, handling synchronous and asynchronous plugins, event filtering, and safe tree mutation. The codebase is well-structured with clear separation of concerns. Several components, such as the input handler (`lib/input.js`), error reporter (`lib/css-syntax-error.js`), value splitter (`lib/list.js`), and source map handler (`lib/previous-map.js`), are isolated, well-crafted, and reusable in other projects. The library is actively maintained, has a comprehensive test suite with fuzzing, and a formal security model. The primary technical debt is the tight coupling between the parser and the specific AST node classes, which makes extracting the parser alone difficult, and the transitional state of supporting both CommonJS and ES modules.
go-instrument is a CLI tool that automatically instruments Go source files with OpenTelemetry trace spans. It parses Go AST, identifies functions that accept a `context.Context` parameter, and inserts span creation, defer, and optional error recording statements. It handles various edge cases: anonymous functions, build constraints (ignore/exclude), generated files, custom context/error parameter names, already-instrumented functions, and preserves original line numbers for panic stack traces via compiler directives. The tool is implemented as a reusable library with a clear separation between the generic AST processing engine (`processor` package) and the specific instrumentation strategy (`instrument` package), allowing custom instrumenters. The CLI frontend is minimal; the core logic is in the `processor` and `instrument` packages and is cleanly abstracted via an `Instrumenter` interface. The codebase is well-tested, includes fuzz testing, and uses current Go tooling.
C2Rust is a compiler toolchain that translates C99 code into unsafe Rust, then applies static analysis and refactoring to produce safer, more idiomatic Rust. The pipeline consists of four main stages: transpilation (c2rust-transpile) using a Clang-based AST exporter to produce initial Rust code; static analysis (c2rust-analyze) that infers pointer permissions and rewrites raw pointers to safe references using a Polonius-based borrow checker; refactoring (c2rust-refactor) which applies dozens of AST transformations (e.g., ownership splitting, macro collapsing, control flow reconstruction) to improve code quality; and postprocessing (c2rust-postprocess) that leverages large language models to transfer C comments and align definitions. The project also includes a cross-checking framework that instruments both C and Rust code to compare runtime behavior via hashing, a program dependence graph (PDG) builder for memory safety analysis, and dynamic instrumentation for event logging. It is primarily a CLI tool (c2rust) that orchestrates these components, with extensive integration tests on real-world C projects (nginx, curl, sqlite, ruby, python2, libxml2, zstd, lua). The codebase is substantial and actively maintained, but relies heavily on unstable rustc internal APIs and LLVM/Clang, introducing maintenance risk. Several components exhibit high craftsmanship and are reusable in isolation.
de4py is a comprehensive Python deobfuscation and reverse engineering tool designed primarily for Windows environments. It combines a native PySide6 GUI with a CLI interface to analyze, unpack, and clean obfuscated Python scripts and PyInstaller executables. The core functionality relies on a modular engine architecture that supports multiple deobfuscation strategies, including legacy regex-based detection and the newer 'Onyx' engine which utilizes AST manipulation and local LLM integration for semantic recovery. It also features native C++ components for process injection and behavior monitoring, allowing users to hook into running Python processes for dynamic analysis. The architecture is split between high-level Python logic for AST transformation and low-level C++ code for system interaction. The Python side manages the deobfuscation pipeline, UI rendering, and plugin management, while the C++ side handles DLL injection, API hooking via Detours, and named pipe communication. This hybrid approach provides powerful capabilities but introduces significant platform coupling and dependency on specific Windows APIs and Python versions. The tool is licensed under CC BY-NC-4.0, restricting commercial use. While the codebase demonstrates sophisticated engineering in areas like VM lifting and AST optimization, it carries risks associated with external API dependencies (telemetry, updates), brittle regex signatures for obfuscation detection, and heavy reliance on Windows-specific system calls. It is best suited for security researchers and malware analysts working in Windows environments who require a unified static and dynamic analysis platform.
This repository is a specialized tool for automated C code permutation to match a target compiled binary, primarily used in video game decompilation projects (e.g., Nintendo 64). The core loop reads a C source file and a target object file, then repeatedly mutates the C code using a set of predefined random transformations, compiles it, disassembles the output, and scores the resulting assembly against the target. The goal is to produce a C source that compiles to identical or nearly identical assembly, reducing manual effort in reverse engineering. The architecture is a Python CLI application with support for multi-threading and distributed computing. The main entry points are `permuter.py` (local mode), `import.py` (project setup), and `pah.py` (network client for distributed 'permuter@home'). The system relies on a vendored fork of pycparser for C parsing and AST manipulation, and it integrates with external tools: a C compiler (GCC, IDO, or MWCC), `objdump` for disassembly, and optionally Docker for sandboxed remote evaluation. A Rust server (`src/net/controller`) manages the distributed network, and a Go systray helper provides a system tray icon for the network client. Data flows are iterative: the tool seeds a candidate, applies one or more random permutations (e.g., introducing temporaries, reordering declarations, transforming expressions), compiles the result, extracts assembly, scores it using a diff-based algorithm, and keeps the best candidate. The process repeats until a perfect match is found or the user stops it. The project demonstrates high craftsmanship in its modular design, with clean abstractions for permutations, scoring, AST utilities, and networking. The vendored pycparser is heavily patched for GNU C extensions, and the custom stubs ensure type safety.