jsconfuser: new plugin

src/main.js

@@ -2,6 +2,7 @@ import fs from 'fs'
 import { parseArgs } from 'node:util'
 import PluginCommon from './plugin/common.js'
 import PluginJjencode from './plugin/jjencode.js'
+import PluginJsconfuser from './plugin/jsconfuser.js'
 import PluginSojson from './plugin/sojson.js'
 import PluginSojsonV7 from './plugin/sojsonv7.js'
 import PluginObfuscator from './plugin/obfuscator.js'
@@ -25,6 +26,7 @@ console.log(`Output: ${decodeFile}`)
 const plugins = {
   common: PluginCommon,
   jjencode: PluginJjencode,
+  jsconfuser: PluginJsconfuser,
   sojson: PluginSojson,
   sojsonv7: PluginSojsonV7,
   obfuscator: PluginObfuscator,

src/plugin/jsconfuser.js

@@ -0,0 +1,187 @@
+import { parse } from '@babel/parser'
+import generator from '@babel/generator'
+import traverse from '@babel/traverse'
+
+import calculateConstantExp from '../visitor/calculate-constant-exp.js'
+import deleteExtra from '../visitor/delete-extra.js'
+import pruneIfBranch from '../visitor/prune-if-branch.js'
+import splitVarDeclaration from '../visitor/split-variable-declaration.js'
+import jcAntiTooling from '../visitor/jsconfuser/anti-tooling.js'
+import jcAstScramblerInit from '../visitor/jsconfuser/ast-scrambler.js'
+import jcCalculatorInit from '../visitor/jsconfuser/calculator.js'
+import jcControlFlow from '../visitor/jsconfuser/control-flow.js'
+import jcControlFlowGraph from '../visitor/jsconfuser/control-flow-graph.js'
+import jcDeadCodeInit from '../visitor/jsconfuser/dead-code.js'
+import jcDispatcherInit from '../visitor/jsconfuser/dispatcher.js'
+import jcDuplicateLiteralInit from '../visitor/jsconfuser/duplicate-literal.js'
+import jcFlatten from '../visitor/jsconfuser/flatten.js'
+import jcFuncLengthInit from '../visitor/jsconfuser/function-length.js'
+import jcGlobalConcealingInit from '../visitor/jsconfuser/global-concealing.js'
+import jcIntegrityInit from '../visitor/jsconfuser/integrity.js'
+import jcLockInit from '../visitor/jsconfuser/lock.js'
+import jcMovedDeclarationsInit from '../visitor/jsconfuser/moved-declarations.js'
+import jcOpaquePredicates from '../visitor/jsconfuser/opaque-predicates.js'
+import jcPack from '../visitor/jsconfuser/pack.js'
+import jcRgf from '../visitor/jsconfuser/rgf.js'
+import jcStringCompression from '../visitor/jsconfuser/string-compression.js'
+import jcStringConceal from '../visitor/jsconfuser/string-concealing.js'
+import jcVariableMasking from '../visitor/jsconfuser/variable-masking.js'
+
+export default function (code) {
+  let ast
+  try {
+    ast = parse(code, { errorRecovery: true })
+  } catch (e) {
+    console.error(`Cannot parse code: ${e.reasonCode}`)
+    return null
+  }
+  // Pack
+  ast = jcPack(ast)
+  // Integrity (must decode before anything reshapes the hashed functions further -
+  // Integrity is the encoder's last stage, so this is its least-processed form)
+  traverse(ast, jcIntegrityInit())
+  // AntiTooling
+  traverse(ast, jcAntiTooling)
+  // AstScrambler (must run before every other structural decoder below -
+  // AstScrambler is one of the last encoder stages (order 29) and merges
+  // whatever ExpressionStatements are still standalone at that point into a
+  // single no-op call's argument list, including ones other transforms'
+  // decoders pattern-match as standalone statements, e.g. ControlFlowFlattening's
+  // state assignments and Lock's inserted checks - undo it first so those
+  // patterns are whole again)
+  traverse(ast, jcAstScramblerInit())
+  // Minify (no dedicated decode step: literal shortenings (!0/!1, void 0, 1/0)
+  // and merged `var` declarations are already undone below by the generic
+  // calculateConstantExp/splitVarDeclaration passes; everything else Minify
+  // does is either cosmetic reformatting that reads fine as-is or dead-code
+  // elimination with nothing left to recover - see minify.md)
+  // MovedDeclarations (two separate rewrites: the generic splitVarDeclaration pass
+  // undoes the merged `var` declarations its block-hoisting produces, and
+  // deMovedDeclarations undoes its function-parameter packing. Both must run before
+  // any pass that identifies structure by looking for a FunctionDeclaration or a
+  // declaration-shaped statement - most importantly the ControlFlowFlattening decode
+  // below, whose whole application fails closed on a packed `_main`.)
+  traverse(ast, splitVarDeclaration)
+  traverse(ast, jcMovedDeclarationsInit())
+  // DuplicateLiteralsRemoval (must run before anything that matches literal
+  // shapes directly - Calculator's operator keys, StringConcealing's slice
+  // args, GlobalConcealing's switch keys, etc. - since DuplicateLiteralsRemoval
+  // runs after all of them on the encode side and can fold any of their own
+  // repeated literals into this array too)
+  traverse(ast, jcDuplicateLiteralInit())
+  // VariableMasking + the shared FunctionLength helper (preserveFunctionLength
+  // can be emitted by Dispatcher/RGF/Flatten/VariableMasking alike)
+  traverse(ast, jcFuncLengthInit())
+  traverse(ast, jcVariableMasking)
+  // StringCompression
+  traverse(ast, jcStringCompression)
+  // StringConcealing
+  traverse(ast, jcStringConceal.deStringConcealingInit())
+  traverse(ast, jcStringConceal.deStringConcealingPlace)
+  // Calculator (unwraps the {ph}_calc(operator, a, b) dispatch call back to a
+  // plain BinaryExpression; the fold to a literal happens in the generic
+  // calculate-constant-exp.js pass right below)
+  traverse(ast, jcCalculatorInit())
+  // StringSplitting
+  traverse(ast, calculateConstantExp)
+  // VariableMasking (run again)
+  traverse(ast, jcVariableMasking)
+  // OpaquePredicates
+  traverse(ast, jcOpaquePredicates.deOpaquePredicates)
+  traverse(ast, jcOpaquePredicates.dePredicateGenInit())
+  traverse(ast, calculateConstantExp)
+  traverse(ast, pruneIfBranch)
+  // DeadCode (matches and removes the whole guard as one self-contained unit -
+  // must run after OpaquePredicates above, since OpaquePredicates' own IfStatement
+  // wrapping fires generically on every if, including ones DeadCode already
+  // inserted - `if(!(x1 in dummy1) && (x2 in dummy2))`, needing OpaquePredicates'
+  // own fold to unwrap first before DeadCode's guard is bare again)
+  traverse(ast, jcDeadCodeInit())
+  // GlobalConcealing
+  traverse(ast, jcGlobalConcealingInit())
+  // ControlFlowFlattening (the main state-vector/transition-graph mechanism - run before
+  // deControlFlowFlatteningStateless below, which targets a separate, minor sub-case
+  // unrelated to this one and can still run on whatever this pass doesn't match)
+  traverse(ast, jcControlFlowGraph.deControlFlowFlatteningGraphInit())
+  traverse(ast, jcControlFlow.deControlFlowFlatteningStateless)
+  traverse(ast, calculateConstantExp)
+  // DuplicateLiteralsRemoval (again). ControlFlowFlattening is encoder Order 24 and
+  // DuplicateLiteralsRemoval Order 22, so CFF runs *after* it and rewrites part of its
+  // reference sites into indexes through the CFF state array -
+  // `literals[state[0x45] + 0x377]`. Those are unreadable to the early pass above and only
+  // become plain numeric literals once the CFF decode and the folding above have run, so
+  // the array needs a second visit here. The early pass still has to stay where it is:
+  // Calculator, StringConcealing and GlobalConcealing all match literal shapes and run
+  // before this point.
+  traverse(ast, jcDuplicateLiteralInit())
+  // VariableMasking (a third time). VariableMasking is encoder Order 20 and
+  // DuplicateLiteralsRemoval Order 22, so the array pass above can be holding this
+  // transform's own mask keys - a slot spelled `stk[literals[4]]` rather than
+  // `stk["length"]`. Both passes above run before the array resolves, and every such key
+  // reads as unmatchable there, so the whole enclosing function is left masked. This pass
+  // sees plain keys and is what actually decodes those functions.
+  traverse(ast, jcVariableMasking)
+  // StringCompression + StringConcealing (again). Same reason DuplicateLiteralsRemoval and
+  // VariableMasking above need a second visit, applied to the string layer: on a `high`
+  // sample the whole program is still inside the ControlFlowFlattening interpreter when the
+  // early string passes run, so no `{ph}_STR_N(start, length)` wrapper exists for them to
+  // match yet and they decode nothing at all. The wrappers only become distinct functions
+  // once the CFF decode above has run. The early passes still have to stay where they are -
+  // deStringConcealingPlace does fire there, on shapes that are already plain assignments.
+  //
+  // This has to sit *before* Lock/RGF/Dispatcher/Flatten below rather than at the end of the
+  // pipeline: Dispatcher in particular reads its four secret flag/key strings out of the
+  // matched dispatcher body and needs them as StringLiterals, which is exactly what these
+  // passes produce.
+  traverse(ast, jcStringCompression)
+  traverse(ast, jcStringConceal.deStringConcealingInit())
+  traverse(ast, jcStringConceal.deStringConcealingPlace)
+  traverse(ast, calculateConstantExp)
+  // OpaquePredicates + DeadCode (again). Same reason as the passes above, and the same
+  // remedy: on a `high` sample both transforms' guards sit inside the ControlFlowFlattening
+  // interpreter when the early passes run, so there is no `if ("randomProp" in dummyFn)`
+  // statement in the tree for them to visit yet and they remove nothing. The guards only
+  // become ordinary statements once the CFF decode above has unwound the interpreter. The
+  // early passes still have to stay where they are - they do fire on whatever is already at
+  // Program level, and DeadCode's own comment above explains why it must follow
+  // OpaquePredicates' fold either way.
+  //
+  // This sits before Dispatcher below for the ordering reason that motivated it: DeadCode is
+  // encoder Order 8 and OpaquePredicates 13, both *later* than Dispatcher's Order 6, so
+  // until their guards are gone the dispatcher matcher is reading a body they have padded -
+  // every such guard is an extra statement in it, which is exactly what its body-shape check
+  // rejects on.
+  traverse(ast, jcOpaquePredicates.dePredicateGenInit())
+  traverse(ast, calculateConstantExp)
+  traverse(ast, pruneIfBranch)
+  traverse(ast, jcDeadCodeInit())
+  // Lock (all six sub-features: antiDebug, selfDefending, dateLock, domainLock,
+  // tamperProtection, and invokeCountermeasures cleanup - run this late, mirroring
+  // Flatten below, since Lock runs early on the encode side and its inserted code
+  // is reshaped by nearly every later transform)
+  traverse(ast, jcLockInit())
+  // RGF (recursively decodes each eval-wrapped sub-program with this same
+  // pipeline - must run after the index-literal folding above so the array
+  // index reads as a plain NumericLiteral)
+  traverse(ast, jcRgf)
+  // Dispatcher (needs VariableMasking, above, to have already unmasked the
+  // dispatcher function's own params if VariableMasking also applies to it)
+  traverse(ast, jcDispatcherInit())
+  // Dispatcher-closure residue from CFF+Dispatcher stacking (checkpoint gap #2 N4.2) -
+  // must run after the Dispatcher pass above normalizes the dispatch object/keys, so a
+  // call site's key matches the impl object property it selects.
+  traverse(ast, jcControlFlowGraph.deDispatcherClosureInit())
+  // Flatten
+  traverse(ast, jcFlatten)
+  // Finalizer (hexadecimalNumbers/stringEncoding: both just re-escape a
+  // literal's raw source text - the parsed VALUE is already identical, but
+  // Babel's generator prefers node.extra.raw over the value when present, so
+  // it would otherwise print the escaped/hex form back out unchanged)
+  traverse(ast, deleteExtra)
+  // ExpressionObfuscation
+  code = generator(ast, {
+    comments: false,
+    jsescOption: { minimal: true },
+  }).code
+  return code
+}

src/utility/binding-def.js

@@ -0,0 +1,80 @@
+/**
+ * Resolving a binding to what it actually *defines*, rather than to one spelling of its
+ * declaration.
+ *
+ * `binding.path` is only the definition site for the plainest spelling. Two encoder
+ * mechanisms routinely move it elsewhere while leaving the binding intact, and a matcher
+ * written as "a binding whose path is a FunctionDeclaration" - the rename-proof idiom this
+ * decoder uses throughout - fails closed on both:
+ *
+ *   - a declaration split into `var X;` + `X = <value>;`, where `binding.path` is a
+ *     declarator with a null `init` and the value is in the binding's single write;
+ *   - a name hoisted onto the enclosing function's parameter list, where `binding.kind`
+ *     reads 'param', `binding.path` is the parameter's own `Identifier`, and the real
+ *     definition is demoted to a `constantViolations` entry.
+ *
+ * Fail-closed throughout: a binding written more than once has no single definition, so
+ * these return null rather than pick one. "Left alone" is always safe; a guess is not.
+ */
+import * as t from '@babel/types'
+
+/**
+ * The single value a binding holds, as both node and path, or null.
+ */
+function resolveBindingValue(binding) {
+  if (!binding || !binding.path) {
+    return null
+  }
+  const declPath = binding.path
+  if (declPath.isVariableDeclarator() && declPath.node.init) {
+    // A declarator with an initializer defines its value outright; a further write would
+    // mean the name does not hold one single thing.
+    if (binding.constantViolations.length !== 0) {
+      return null
+    }
+    return { node: declPath.node.init, path: declPath.get('init') }
+  }
+  if (binding.constantViolations.length !== 1) {
+    return null
+  }
+  const write = binding.constantViolations[0]
+  if (!write.isAssignmentExpression() || write.node.operator !== '=') {
+    return null
+  }
+  const right = write.get('right')
+  return right.node ? { node: right.node, path: right } : null
+}
+
+/**
+ * The function a binding names, whatever spelling it arrived in: a `FunctionDeclaration`
+ * (whether at `binding.path` or demoted to a constant violation by parameter hoisting), or a
+ * function-valued declarator/assignment. Returns the `Function`'s own NodePath, or null.
+ */
+function resolveBindingFunction(binding) {
+  if (!binding || !binding.path) {
+    return null
+  }
+  if (binding.path.isFunctionDeclaration()) {
+    return binding.path
+  }
+  // A hoisted parameter's declaration survives as a write, and for a packed function
+  // declaration that write is the FunctionDeclaration itself rather than an assignment.
+  if (binding.kind === 'param') {
+    const decls = binding.constantViolations.filter((v) =>
+      v.isFunctionDeclaration(),
+    )
+    if (decls.length === 1) {
+      return decls[0]
+    }
+  }
+  const value = resolveBindingValue(binding)
+  if (!value || !t.isFunction(value.node)) {
+    return null
+  }
+  return value.path
+}
+
+export default {
+  resolveBindingValue,
+  resolveBindingFunction,
+}

src/utility/check-func.js

@@ -0,0 +1,15 @@
+function checkPattern(code, pattern) {
+  let i = 0
+  let j = 0
+  while (i < code.length && j < pattern.length) {
+    if (code[i] == pattern[j]) {
+      ++j
+    }
+    ++i
+  }
+  return j == pattern.length
+}
+
+export default {
+  checkPattern,
+}

src/utility/safe-func.js

@@ -0,0 +1,75 @@
+import * as t from '@babel/types'
+
+function safeDeleteNode(name, path) {
+  let binding
+  if (path.isFunctionDeclaration()) {
+    binding = path.parentPath.scope.getBinding(name)
+  } else {
+    binding = path.scope.getBinding(name)
+  }
+  if (!binding) {
+    return false
+  }
+  binding.scope.crawl()
+  binding = binding.scope.getBinding(name)
+  if (binding.references) {
+    return false
+  }
+  for (const item of binding.constantViolations) {
+    item.remove()
+  }
+  const decl = binding.path
+  if (decl.removed) {
+    return true
+  }
+  if (!decl.isVariableDeclarator() && !decl.isFunctionDeclaration()) {
+    return true
+  }
+  binding.path.remove()
+  return true
+}
+
+function safeGetLiteral(path) {
+  if (path.isUnaryExpression()) {
+    if (path.node.operator === '-' && path.get('argument').isNumericLiteral()) {
+      return -1 * path.get('argument').node.value
+    }
+    return null
+  }
+  if (path.isLiteral()) {
+    return path.node.value
+  }
+  return null
+}
+
+function safeGetName(path) {
+  if (path.isIdentifier()) {
+    return path.node.name
+  }
+  if (path.isLiteral()) {
+    return path.node.value
+  }
+  if (path.isUnaryExpression()) {
+    return safeGetLiteral(path)
+  }
+  return null
+}
+
+function safeReplace(path, value) {
+  if (typeof value === 'string') {
+    path.replaceWith(t.stringLiteral(value))
+    return
+  }
+  if (typeof value === 'number') {
+    path.replaceWith(t.numericLiteral(value))
+    return
+  }
+  path.replaceWithSourceString(value)
+}
+
+export default {
+  safeDeleteNode,
+  safeGetLiteral,
+  safeGetName,
+  safeReplace,
+}