@dacely/toildefender 0.1.4 → 0.1.6

package/esutils.js

@@ -32,12 +32,22 @@ module.exports = function (logger) {
         });
     };
 
+    this.canInsertIntoScope = function (scope) {
+        if (!scope || !scope.block) {
+            return false;
+        }
+        if (scope.block.body && (scope.block.body.type == "Program" || scope.block.body.type == "BlockStatement")) {
+            return true;
+        }
+        return scope.block.type == "Program" || scope.block.type == "BlockStatement";
+    };
+
     this.insertIntoScope = function (scope, node, idx) {
         assert.ok(estest.isNode(node));
         
         idx = idx || 0;
 
-        if (scope.block.body.type == "Program" || scope.block.body.type == "BlockStatement") {
+        if (scope.block.body && (scope.block.body.type == "Program" || scope.block.body.type == "BlockStatement")) {
             scope.block.body.body.splice(idx, 0, node);
             
             Object.defineProperty(node, "veilmark$parent", {

package/obfuscator.js

@@ -6,14 +6,15 @@ var fs = require("fs");
 var assert = require("assert");
 
 var _ = require("lodash");
-var legacyBabel = require("babel-core");
-var modernBabel = (() => {
+function requireOptional(name) {
     try {
-        return require("@babel/core");
+        return require(name);
     } catch (e) {
         return null;
     }
-})();
+}
+
+var modernParser = requireOptional("@babel/parser");
 var escodegen = require("escodegen");
 var escope = require("escope");
 var esprima = require("esprima");
@@ -39,8 +40,11 @@ var prNumericVm         = require("./processors/numericVm");
 var prHealth            = require("./processors/health");
 
 var defaultOptions = {
-    babel: true,
+    babel: false,
     babelTarget: "ie 11",
+    babelPreserveAsync: true,
+    runtimeHelpers: true,
+    simplify: true,
     features: {
         dead_code: true,
         scope: true,
@@ -163,7 +167,8 @@ exports.features = _.fromPairs(
  * @param {Object} options - Configuration.
  * @param {string} options.code - Code of entry point file to be obfuscated.
  * @param {Object.<string, string>} options.modulesCode - Code of all of options.code's depedencies.
- * @param {boolean} [options.babel = true] - Whether to run babel with ES2015 preset before obfuscating.
+ * @param {boolean} [options.babel = false] - Whether to run the optional Babel transform before obfuscating.
+ * @param {boolean} [options.babelPreserveAsync = true] - Whether Babel should leave async/generator syntax for async-aware flattening instead of emitting regenerator helpers.
  * @param {Object.<string, boolean>} [options.features = All enabled] - Feature configuration.
  * @param {logAdapterCallback} [options.logAdapter = Console] - Logging adapter.
  * @param {string} [options.logLevel = "warn"] - Minimum level of shown log messages.
@@ -248,7 +253,26 @@ exports.do = function (options) {
     }
 
     function transformModernSyntax(code, label) {
+        var modernBabel = requireOptional("@babel/core");
         if (modernBabel) {
+            var presetEnvPath;
+            try {
+                presetEnvPath = require.resolve("@babel/preset-env");
+            } catch (e) {
+                throw new Error("Babel transform requested, but @babel/preset-env is not installed");
+            }
+
+            var presetOptions = {
+                modules: "commonjs",
+                targets: options.babelTarget,
+                useBuiltIns: false
+            };
+            if (options.babelPreserveAsync !== false) {
+                presetOptions.exclude = [
+                    "@babel/plugin-transform-async-to-generator",
+                    "@babel/plugin-transform-regenerator"
+                ];
+            }
             var result = modernBabel.transformSync(code, {
                 babelrc: false,
                 comments: false,
@@ -257,18 +281,19 @@ exports.do = function (options) {
                 sourceType: "unambiguous",
                 presets: [
                     [
-                        require.resolve("@babel/preset-env"),
-                        {
-                            modules: "commonjs",
-                            targets: options.babelTarget,
-                            useBuiltIns: false
-                        }
+                        presetEnvPath,
+                        presetOptions
                     ]
                 ]
             });
             return result && result.code || code;
         }
 
+        var legacyBabel = requireOptional("babel-core");
+        if (!legacyBabel) {
+            throw new Error("Babel transform requested, but neither @babel/core nor babel-core is installed");
+        }
+
         var babelOptions = {
             "plugins": [
                 "babel-plugin-transform-es2015-arrow-functions",
@@ -294,6 +319,67 @@ exports.do = function (options) {
         };
         return legacyBabel.transform(code, babelOptions).code;
     }
+
+    function parseSource(code, options) {
+        try {
+            return esprima.parse(code, options);
+        } catch (esprimaError) {
+            if (!modernParser) {
+                throw esprimaError;
+            }
+
+            var parsed = modernParser.parse(code, {
+                sourceType: "unambiguous",
+                plugins: [
+                    "estree",
+                    "classProperties",
+                    "classPrivateProperties",
+                    "classPrivateMethods",
+                    "optionalChaining",
+                    "nullishCoalescingOperator",
+                    "objectRestSpread"
+                ]
+            });
+            return {
+                type: "Program",
+                body: parsed.program.body,
+                sourceType: parsed.program.sourceType
+            };
+        }
+    }
+
+    function containsNodeType(root, names) {
+        var found = false;
+        var lookup = {};
+        names.forEach(name => {
+            lookup[name] = true;
+        });
+        traverser.traverseEx(root, [], function (node) {
+            if (lookup[node.type]) {
+                found = true;
+                this.abort();
+            }
+            return node;
+        });
+        return found;
+    }
+
+    function hasMangleUnsupportedSyntax(root) {
+        return containsNodeType(root, [ "Super" ]);
+    }
+
+    function dispatcherForMethod(method) {
+        if (method.async === true && method.generator === true) {
+            return "main$asyncGenerator";
+        }
+        if (method.async === true) {
+            return "main$async";
+        }
+        if (method.generator === true) {
+            return "main$generator";
+        }
+        return "main";
+    }
     
     options = _.merge({}, defaultOptions, options); // first argument gets mutated
     if (options.protections.virtualMachine.enabled) {
@@ -328,6 +414,7 @@ exports.do = function (options) {
     };
     
     var logger = new Logger(options.logAdapter);
+    var customBindAdded = false;
 
     var start = Date.now();
 
@@ -349,9 +436,17 @@ exports.do = function (options) {
     
     // Parse code
     var ast, modulesAST;
+    function addCustomBindOnce() {
+        if (!customBindAdded) {
+            var methods = new prMethods(logger);
+            methods.addCustomBind(ast);
+            customBindAdded = true;
+        }
+    }
+
     doTask("parse", true, () => {
-        modulesAST = _.mapValues(options.modulesCode, (code, key) => tryTag(key, () => esprima.parse(code, parseOptions)));
-        modulesAST.app = tryTag("app", () => esprima.parse(options.code, parseOptions));
+        modulesAST = _.mapValues(options.modulesCode, (code, key) => tryTag(key, () => parseSource(code, parseOptions)));
+        modulesAST.app = tryTag("app", () => parseSource(options.code, parseOptions));
     });
     
     // Merge depedencies into main modules
@@ -367,7 +462,7 @@ exports.do = function (options) {
     });
     
     // Simplify graph
-    doTask("simplify", true, () => {
+    doTask("simplify", options.simplify !== false, () => {
         var normalizer = new prNormalizer(logger);
         ast = normalizer.simplify(ast);
     });
@@ -438,6 +533,11 @@ exports.do = function (options) {
                 methods.removeFirstArguments(method, refers ? method.params.filter(x => x.name.indexOf("$$scope") == 0).length : 0);
                 return methods.replaceArgumentReferences(method, true);
             });
+            fns.forEach(method => {
+                if (method && method.id && methodEntryPoints[method.id.name]) {
+                    methodEntryPoints[method.id.name].dispatcher = dispatcherForMethod(method);
+                }
+            });
             if (options.features.control_flow) {
                 methods.replaceFunctionCalls(ast, methodEntryPoints);
                 fns.forEach(method => {
@@ -446,25 +546,88 @@ exports.do = function (options) {
             }
         });
         
-        doTask("add_custom_bind", true, () => {
-            methods.addCustomBind(ast);
-        });
-    
         doTask("control_flow", options.features.control_flow, () => {
             // Apply control flow flattening and merge methods
             var flattener = new prFlattener(logger, rng);
             var entry = rng.get(), exit = rng.get();
-            flattener.addMethod(ast, entry, exit);
+            var dispatcherGroups = {
+                "main$async": {
+                    async: true,
+                    fns: []
+                },
+                "main$generator": {
+                    generator: true,
+                    fns: []
+                },
+                "main$asyncGenerator": {
+                    async: true,
+                    generator: true,
+                    fns: []
+                }
+            };
+            var syncFns = [];
+
             fns.forEach(method => {
+                var dispatcher = dispatcherForMethod(method);
+                if (dispatcher == "main") {
+                    syncFns.push(method);
+                } else {
+                    dispatcherGroups[dispatcher].fns.push(method);
+                }
+            });
+
+            flattener.addMethod(ast, entry, exit);
+            syncFns.forEach(method => {
                 methods.bumpArgumentsIndices(method, 1);
 
                 var entry = methodEntryPoints[method.id.name].entry;
                 flattener.addMethod(method.body, entry, exit);
             });
             
-            ast = flattener.getProgram(entry, exit);
-            
-            ast = flattener.unifyPrefixStatements(ast);
+            var syncAst = flattener.getProgram(entry, exit, {
+                name: "main",
+                invoke: true
+            });
+
+            syncAst = flattener.unifyPrefixStatements(syncAst);
+
+            var asyncPrograms = [];
+            Object.keys(dispatcherGroups).forEach(name => {
+                var group = dispatcherGroups[name];
+                if (group.fns.length == 0) {
+                    return;
+                }
+
+                var groupFlattener = new prFlattener(logger, rng);
+                var groupEntry = methodEntryPoints[group.fns[0].id.name].entry;
+                var groupExit = rng.get();
+
+                group.fns.forEach(method => {
+                    methods.bumpArgumentsIndices(method, 1);
+
+                    var entry = methodEntryPoints[method.id.name].entry;
+                    groupFlattener.addMethod(method.body, entry, groupExit);
+                });
+
+                var groupAst = groupFlattener.getProgram(groupEntry, groupExit, {
+                    name: name,
+                    async: group.async === true,
+                    generator: group.generator === true,
+                    invoke: false
+                });
+
+                groupAst = groupFlattener.unifyPrefixStatements(groupAst);
+                asyncPrograms.push(groupAst);
+            });
+
+            if (asyncPrograms.length > 0) {
+                ast = {
+                    type: "Program",
+                    body: Array.prototype.concat.apply([], asyncPrograms.map(program => program.body)).concat(syncAst.body)
+                };
+            } else {
+                ast = syncAst;
+            }
         })
         .otherwise(() => {
             if (ast.type == "Program") {
@@ -476,6 +639,10 @@ exports.do = function (options) {
             };
         });
     });
+
+    doTask("add_runtime_helpers", options.runtimeHelpers !== false && (options.features.scope || options.features.object_packing || options.features.literals || options.babel === false), () => {
+        addCustomBindOnce();
+    });
     
     // Postprocessing
     doTask("postprocessing", true, () => {
@@ -489,6 +656,10 @@ exports.do = function (options) {
     });
     
     doTask("mangle", options.features.mangle, () => {
+        if (hasMangleUnsupportedSyntax(ast)) {
+            logger.warn("Skipping mangle because native modern syntax is not supported by the legacy mangler");
+            return;
+        }
         var uglifier = new prUglifier(logger);
         if (ast.type == "Program") {
             ast.type = "BlockStatement";

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@dacely/toildefender",
-    "version": "0.1.4",
+    "version": "0.1.6",
     "description": "Modern JavaScript code protection, bytecode virtualization, and obfuscation for the Toil tech stack.",
     "author": "Dacely",
     "contributors": [
@@ -61,30 +61,7 @@
         "docs/all-modes-output.demo.js"
     ],
     "dependencies": {
-        "@babel/core": "^8.0.1",
-        "@babel/preset-env": "^8.0.2",
-        "babel-core": "6.10.4",
-        "babel-plugin-check-es2015-constants": "^6.3.13",
-        "babel-plugin-transform-es2015-arrow-functions": "^6.3.13",
-        "babel-plugin-transform-es2015-block-scoped-functions": "^6.3.13",
-        "babel-plugin-transform-es2015-block-scoping": "^6.9.0",
-        "babel-plugin-transform-es2015-classes": "^6.9.0",
-        "babel-plugin-transform-es2015-computed-properties": "^6.3.13",
-        "babel-plugin-transform-es2015-destructuring": "^6.9.0",
-        "babel-plugin-transform-es2015-duplicate-keys": "^6.6.0",
-        "babel-plugin-transform-es2015-for-of": "^6.6.0",
-        "babel-plugin-transform-es2015-function-name": "^6.9.0",
-        "babel-plugin-transform-es2015-literals": "^6.3.13",
-        "babel-plugin-transform-es2015-modules-commonjs": "^6.6.0",
-        "babel-plugin-transform-es2015-object-super": "^6.3.13",
-        "babel-plugin-transform-es2015-parameters": "^6.9.0",
-        "babel-plugin-transform-es2015-shorthand-properties": "^6.3.13",
-        "babel-plugin-transform-es2015-spread": "^6.3.13",
-        "babel-plugin-transform-es2015-sticky-regex": "^6.3.13",
-        "babel-plugin-transform-es2015-template-literals": "^6.6.0",
-        "babel-plugin-transform-es2015-typeof-symbol": "^6.6.0",
-        "babel-plugin-transform-es2015-unicode-regex": "^6.3.13",
-        "babel-plugin-transform-regenerator": "^6.9.0",
+        "@babel/parser": "^8.0.0",
         "escodegen": "^2.1.0",
         "escope": "3.6.0",
         "esprima": "^4.0.1",
@@ -95,7 +72,7 @@
         "minimist": "1.2.0"
     },
     "engines": {
-        "node": ">=24.0.0",
+        "node": ">=24.11.0",
         "npm": ">=10.0.0"
     },
     "publishConfig": {

package/processors/deadCode.js

@@ -9,6 +9,10 @@ var utils = require("../utils");
 
 const KEYWORDS = ["await","break","case","catch","class","const","continue","debugger","default","delete","do","else","enum","export","extends","finally","for","function","if","implements","import","in","instanceof","interface","let","new","package","private","protected","public","return","static","super","switch","this","throw","try","typeof","var","void","while","with","yield"];
 
+function isClassMethodBody(stack) {
+    return stack.some(frame => frame.node.type == "MethodDefinition" || frame.node.type == "ClassBody");
+}
+
 module.exports = class DeadCode {
 
     constructor (logger) {
@@ -26,7 +30,7 @@ module.exports = class DeadCode {
         var rngAlpha = new utils.UniqueRandomAlpha(3);
 
         return traverser.traverse(ast, [], (node, stack) => {
-            if (node.type == "BlockStatement") {
+            if (node.type == "BlockStatement" && !isClassMethodBody(stack)) {
                 for (var i = 0; i < probability; ++i) {
                     if (probability - i < Math.random()) {
                         continue;

package/processors/flattener.js

@@ -201,45 +201,69 @@ module.exports = class Flattener {
      * Get output switch construct program
      * @param {number} entry Entry point
      * @param {number} exit Exit point
+     * @param {Object} options Program options
      * @returns {Program} Switch construct program
      */
-    getProgram (entry, exit) {
+    getProgram (entry, exit, options) {
         assert.equal(typeof entry, "number");
         assert.equal(typeof exit, "number");
+
+        options = options || {};
+        var name = options.name || "main";
+        var invoke = options.invoke !== false;
         
-        return {
-            type: "Program",
-            body: [
-                {
-                    type: "FunctionDeclaration",
-                    id: { type: "Identifier", name: "main" },
-                    params: [
-                        { type: "Identifier", name: "state" },
-                        { type: "Identifier", name: "scope" }
-                    ],
-                    body: {
-                        type: "BlockStatement",
-                        body: [
-                            {
-                                type: "WhileStatement",
-                                test: { type: "Literal", value: true },
-                                body: this.getCases(entry, exit)
-                            }
-                        ]
-                    }
+        var body = [
+            {
+                type: "FunctionDeclaration",
+                id: { type: "Identifier", name: name },
+                params: [
+                    { type: "Identifier", name: "state" },
+                    { type: "Identifier", name: "scope" }
+                ],
+                body: {
+                    type: "BlockStatement",
+                    body: [
+                        {
+                            type: "VariableDeclaration",
+                            kind: "var",
+                            declarations: [
+                                {
+                                    type: "VariableDeclarator",
+                                    id: { type: "Identifier", name: "veilmark$tobethrown" },
+                                    init: null
+                                }
+                            ]
+                        },
+                        {
+                            type: "WhileStatement",
+                            test: { type: "Literal", value: true },
+                            body: this.getCases(entry, exit)
+                        }
+                    ]
                 },
-                {
-                    type: "ExpressionStatement",
-                    expression: {
-                        type: "CallExpression",
-                        callee: { type: "Identifier", name: "main" },
-                        arguments: [
-                            { type: "Literal", value: entry },
-                            { type: "ObjectExpression", properties: [] }
-                        ]
-                    }
+                generator: options.generator === true,
+                expression: false,
+                async: options.async === true
+            }
+        ];
+
+        if (invoke) {
+            body.push({
+                type: "ExpressionStatement",
+                expression: {
+                    type: "CallExpression",
+                    callee: { type: "Identifier", name: name },
+                    arguments: [
+                        { type: "Literal", value: entry },
+                        { type: "ObjectExpression", properties: [] }
+                    ]
                 }
-            ]
+            });
+        }
+
+        return {
+            type: "Program",
+            body: body
         };
     }
     

package/processors/identifiers.js

@@ -25,6 +25,10 @@ function objectKey(prop) {
     return prop.key.name || prop.key.value;
 }
 
+function canPackObjectExpression(node) {
+    return node.properties.every(prop => prop.type != "SpreadElement" && prop.key);
+}
+
 function isBigIntLiteral(node) {
     return node.type == "Literal" && typeof node.value == "bigint";
 }
@@ -86,21 +90,10 @@ module.exports = class Identifiers {
         ast = traverser.traverse(ast, [], (node, stack) => {
             if (node.type == "ObjectExpression") {
                 if (options.objectPacking === false) {
-                    var arr = [];
-                    node.properties.forEach(prop => {
-                        arr.push(literal(objectKey(prop)));
-                        arr.push(prop.value);
-                    });
-                    return {
-                        type: "CallExpression",
-                        callee: { type: "Identifier", name: "veilmark$toObject"  },
-                        arguments: [
-                            {
-                                type: "ArrayExpression",
-                                elements: arr
-                            }
-                        ]
-                    };
+                    return node;
+                }
+                if (!canPackObjectExpression(node)) {
+                    return node;
                 }
 
                 var salt = utils.random(1, 65535);
@@ -117,6 +110,7 @@ module.exports = class Identifiers {
                     type: "CallExpression",
                     callee: { type: "Identifier", name: "veilmark$toObject"  },
                     arguments: [
+                        literal(String(utils.hash(schema.join(",")))),
                         {
                             type: "ArrayExpression",
                             elements: schema.map(literal)