@jshookmcp/jshook 0.1.2

package/dist/modules/deobfuscator/JSVMPDeobfuscator.js

@@ -0,0 +1,300 @@
+import * as parser from '@babel/parser';
+import traverse from '@babel/traverse';
+import generate from '@babel/generator';
+import * as t from '@babel/types';
+import { logger } from '../../utils/logger.js';
+import { JSVMP_DEOBFUSCATE_TIMEOUT_MS, JSVMP_MAX_ITERATIONS } from '../../constants.js';
+import { ExecutionSandbox } from '../security/ExecutionSandbox.js';
+import { restoreCustomVMBasic, restoreJSVMPCode } from '../deobfuscator/JSVMPDeobfuscator.restore.js';
+export class JSVMPDeobfuscator {
+    llm;
+    sandbox = new ExecutionSandbox();
+    constructor(llm) {
+        this.llm = llm;
+    }
+    async deobfuscate(options) {
+        const startTime = Date.now();
+        const { code, aggressive = false, extractInstructions = false, timeout = JSVMP_DEOBFUSCATE_TIMEOUT_MS, maxIterations = JSVMP_MAX_ITERATIONS, } = options;
+        logger.info(' JSVMP...');
+        try {
+            const vmFeatures = this.detectJSVMP(code);
+            if (!vmFeatures) {
+                logger.info('JSVMP');
+                return {
+                    isJSVMP: false,
+                    deobfuscatedCode: code,
+                    confidence: 0,
+                    warnings: ['JSVMP'],
+                };
+            }
+            logger.info(`JSVMP analysis complete, complexity: ${vmFeatures.complexity}`);
+            logger.info(` : ${vmFeatures.instructionCount}`);
+            const vmType = this.identifyVMType(code, vmFeatures);
+            logger.info(` : ${vmType}`);
+            let instructions;
+            if (extractInstructions) {
+                logger.info(' ...');
+                instructions = this.extractInstructions(code, vmFeatures);
+                logger.info(`  ${instructions.length} `);
+            }
+            logger.info(' ...');
+            const deobfuscationResult = await this.restoreCode(code, vmFeatures, vmType, aggressive, timeout, maxIterations);
+            const processingTime = Date.now() - startTime;
+            const result = {
+                isJSVMP: true,
+                vmType,
+                vmFeatures,
+                instructions,
+                deobfuscatedCode: deobfuscationResult.code,
+                confidence: deobfuscationResult.confidence,
+                warnings: deobfuscationResult.warnings,
+                unresolvedParts: deobfuscationResult.unresolvedParts,
+                stats: {
+                    originalSize: code.length,
+                    deobfuscatedSize: deobfuscationResult.code.length,
+                    reductionRate: 1 - deobfuscationResult.code.length / code.length,
+                    processingTime,
+                },
+            };
+            logger.info(`JSVMP deobfuscation complete in ${processingTime}ms`);
+            logger.info(` : ${(result.confidence * 100).toFixed(1)}%`);
+            return result;
+        }
+        catch (error) {
+            logger.error('JSVMP', error);
+            return {
+                isJSVMP: false,
+                deobfuscatedCode: code,
+                confidence: 0,
+                warnings: [`: ${error}`],
+            };
+        }
+    }
+    detectJSVMP(code) {
+        try {
+            const ast = parser.parse(code, {
+                sourceType: 'unambiguous',
+                plugins: ['jsx', 'typescript'],
+                errorRecovery: true,
+            });
+            let hasSwitch = false;
+            let hasInstructionArray = false;
+            let hasProgramCounter = false;
+            let instructionCount = 0;
+            let interpreterLocation = '';
+            let maxSwitchCases = 0;
+            let hasBytecodeArray = false;
+            let hasApplyCall = false;
+            let hasWhileLoop = false;
+            let bytecodePattern = false;
+            traverse(ast, {
+                SwitchStatement(path) {
+                    const caseCount = path.node.cases.length;
+                    if (caseCount > 10) {
+                        hasSwitch = true;
+                        if (caseCount > maxSwitchCases) {
+                            maxSwitchCases = caseCount;
+                            instructionCount = caseCount;
+                            interpreterLocation = `Line ${path.node.loc?.start.line || 0}`;
+                        }
+                    }
+                },
+                ArrayExpression(path) {
+                    if (path.node.elements.length > 50) {
+                        hasInstructionArray = true;
+                    }
+                },
+                UpdateExpression(path) {
+                    if (path.node.operator === '++' || path.node.operator === '--') {
+                        const arg = path.node.argument;
+                        if (t.isIdentifier(arg) && arg.name.length <= 3) {
+                            hasProgramCounter = true;
+                        }
+                    }
+                },
+                CallExpression(path) {
+                    if (t.isIdentifier(path.node.callee, { name: 'parseInt' }) &&
+                        path.node.arguments.length >= 2) {
+                        const firstArg = path.node.arguments[0];
+                        if (t.isBinaryExpression(firstArg) && firstArg.operator === '+') {
+                            bytecodePattern = true;
+                            hasBytecodeArray = true;
+                        }
+                    }
+                    if (t.isMemberExpression(path.node.callee) &&
+                        t.isIdentifier(path.node.callee.property, { name: 'apply' })) {
+                        hasApplyCall = true;
+                    }
+                },
+                WhileStatement(path) {
+                    if (t.isBooleanLiteral(path.node.test, { value: true }) ||
+                        t.isNumericLiteral(path.node.test, { value: 1 })) {
+                        hasWhileLoop = true;
+                    }
+                },
+                ForStatement(path) {
+                    if (!path.node.test) {
+                        hasWhileLoop = true;
+                    }
+                },
+            });
+            const isJSVMP = hasSwitch &&
+                (hasInstructionArray || hasProgramCounter) &&
+                (hasApplyCall || hasWhileLoop || bytecodePattern);
+            if (isJSVMP) {
+                const complexity = instructionCount > 100 ? 'high' : instructionCount > 50 ? 'medium' : 'low';
+                logger.info(' JSVMP:');
+                logger.info(`  - Switch: ${hasSwitch} (${maxSwitchCases} cases)`);
+                logger.info(`  - : ${hasInstructionArray}`);
+                logger.info(`  - : ${hasProgramCounter}`);
+                logger.info(`  - : ${hasBytecodeArray}`);
+                logger.info(`  - Apply: ${hasApplyCall}`);
+                logger.info(`  - : ${hasWhileLoop}`);
+                logger.info(`  - : ${bytecodePattern}`);
+                return {
+                    instructionCount,
+                    interpreterLocation,
+                    complexity,
+                    hasSwitch,
+                    hasInstructionArray,
+                    hasProgramCounter,
+                };
+            }
+            return null;
+        }
+        catch (error) {
+            logger.warn('JSVMP analysis failed', error);
+            return this.detectJSVMPWithRegex(code);
+        }
+    }
+    detectJSVMPWithRegex(code) {
+        const switchMatches = code.match(/switch\s*\(/g);
+        const hasSwitch = (switchMatches?.length || 0) > 0;
+        const bytecodePattern = /parseInt\s*\(\s*["']?\s*\+\s*\w+\[/g.test(code);
+        const applyPattern = /\.apply\s*\(/g.test(code);
+        const whilePattern = /while\s*\(\s*(true|1)\s*\)/g.test(code);
+        if (hasSwitch && (bytecodePattern || applyPattern || whilePattern)) {
+            logger.info(' JSVMP');
+            return {
+                instructionCount: 0,
+                interpreterLocation: 'Unknown',
+                complexity: 'medium',
+                hasSwitch: true,
+                hasInstructionArray: bytecodePattern,
+                hasProgramCounter: applyPattern,
+            };
+        }
+        return null;
+    }
+    identifyVMType(code, _features) {
+        if (code.includes('_0x') && code.includes('function(_0x')) {
+            return 'obfuscator.io';
+        }
+        if (/^\s*\[\s*\]\s*\[\s*\(/.test(code)) {
+            return 'jsfuck';
+        }
+        if (code.includes('$=~[];')) {
+            return 'jjencode';
+        }
+        return 'custom';
+    }
+    extractInstructions(code, features) {
+        const instructions = [];
+        try {
+            const ast = parser.parse(code, {
+                sourceType: 'unambiguous',
+                plugins: ['jsx', 'typescript'],
+            });
+            const self = this;
+            traverse(ast, {
+                SwitchStatement(path) {
+                    if (path.node.cases.length === features.instructionCount) {
+                        path.node.cases.forEach((caseNode, index) => {
+                            const opcode = caseNode.test
+                                ? t.isNumericLiteral(caseNode.test)
+                                    ? caseNode.test.value
+                                    : t.isStringLiteral(caseNode.test)
+                                        ? caseNode.test.value
+                                        : index
+                                : index;
+                            const type = self.inferInstructionType(caseNode);
+                            instructions.push({
+                                opcode,
+                                name: `INST_${opcode}`,
+                                type,
+                                description: `Instruction ${opcode}`,
+                            });
+                        });
+                    }
+                },
+            });
+        }
+        catch (error) {
+            logger.warn('', error);
+        }
+        return instructions;
+    }
+    inferInstructionType(caseNode) {
+        const code = generate(caseNode).code;
+        const consequent = caseNode.consequent;
+        let hasAssignment = false;
+        let hasArrayAccess = false;
+        let hasFunctionCall = false;
+        let hasArithmetic = false;
+        let hasControlFlow = false;
+        for (const stmt of consequent) {
+            if (t.isExpressionStatement(stmt)) {
+                const expr = stmt.expression;
+                if (t.isAssignmentExpression(expr)) {
+                    hasAssignment = true;
+                }
+                if (t.isMemberExpression(expr) && t.isNumericLiteral(expr.property)) {
+                    hasArrayAccess = true;
+                }
+                if (t.isCallExpression(expr)) {
+                    hasFunctionCall = true;
+                }
+                if (t.isBinaryExpression(expr)) {
+                    if (['+', '-', '*', '/', '%', '**'].includes(expr.operator)) {
+                        hasArithmetic = true;
+                    }
+                }
+            }
+            if (t.isIfStatement(stmt) ||
+                t.isWhileStatement(stmt) ||
+                t.isBreakStatement(stmt) ||
+                t.isContinueStatement(stmt) ||
+                t.isReturnStatement(stmt)) {
+                hasControlFlow = true;
+            }
+        }
+        if ((code.includes('push') || code.includes('.push(')) &&
+            (hasArrayAccess || code.includes('['))) {
+            return 'load';
+        }
+        if (hasAssignment && !hasArithmetic && !hasFunctionCall) {
+            return 'store';
+        }
+        if (hasArithmetic || code.match(/[+\-*/%]/)) {
+            return 'arithmetic';
+        }
+        if (hasControlFlow || code.includes('break') || code.includes('continue')) {
+            return 'control';
+        }
+        if (hasFunctionCall || code.includes('.apply(') || code.includes('.call(')) {
+            return 'call';
+        }
+        return 'unknown';
+    }
+    async restoreCode(code, _features, vmType, aggressive, _timeout, _maxIterations) {
+        void this.restoreCustomVMBasic;
+        return restoreJSVMPCode({
+            llm: this.llm,
+            sandbox: this.sandbox,
+        }, code, vmType, aggressive);
+    }
+    restoreCustomVMBasic(code, aggressive, warnings, unresolvedParts) {
+        return restoreCustomVMBasic(code, aggressive, warnings, unresolvedParts);
+    }
+}
+//# sourceMappingURL=JSVMPDeobfuscator.js.map

package/dist/modules/deobfuscator/JSVMPDeobfuscator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JSVMPDeobfuscator.js","sourceRoot":"","sources":["../../../src/modules/deobfuscator/JSVMPDeobfuscator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,QAAQ,MAAM,iBAAiB,CAAC;AACvC,OAAO,QAAQ,MAAM,kBAAkB,CAAC;AACxC,OAAO,KAAK,CAAC,MAAM,cAAc,CAAC;AAUlC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,iDAAiD,CAAC;AAEzG,MAAM,OAAO,iBAAiB;IACpB,GAAG,CAAc;IACR,OAAO,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAElD,YAAY,GAAgB;QAC1B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAiC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,EACJ,IAAI,EACJ,UAAU,GAAG,KAAK,EAClB,mBAAmB,GAAG,KAAK,EAC3B,OAAO,GAAG,4BAA4B,EACtC,aAAa,GAAG,oBAAoB,GACrC,GAAG,OAAO,CAAC;QAEZ,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,gBAAgB,EAAE,IAAI;oBACtB,UAAU,EAAE,CAAC;oBACb,QAAQ,EAAE,CAAC,OAAO,CAAC;iBACpB,CAAC;YACJ,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,wCAAwC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;YAC7E,MAAM,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAEjD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC;YAE5B,IAAI,YAAyC,CAAC;YAC9C,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC,KAAK,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;YAC3C,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,WAAW,CAChD,IAAI,EACJ,UAAU,EACV,MAAM,EACN,UAAU,EACV,OAAO,EACP,aAAa,CACd,CAAC;YAEF,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAE9C,MAAM,MAAM,GAA4B;gBACtC,OAAO,EAAE,IAAI;gBACb,MAAM;gBACN,UAAU;gBACV,YAAY;gBACZ,gBAAgB,EAAE,mBAAmB,CAAC,IAAI;gBAC1C,UAAU,EAAE,mBAAmB,CAAC,UAAU;gBAC1C,QAAQ,EAAE,mBAAmB,CAAC,QAAQ;gBACtC,eAAe,EAAE,mBAAmB,CAAC,eAAe;gBACpD,KAAK,EAAE;oBACL,YAAY,EAAE,IAAI,CAAC,MAAM;oBACzB,gBAAgB,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM;oBACjD,aAAa,EAAE,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;oBAChE,cAAc;iBACf;aACF,CAAC;YAEF,MAAM,CAAC,IAAI,CAAC,mCAAmC,cAAc,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAE3D,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC7B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,gBAAgB,EAAE,IAAI;gBACtB,UAAU,EAAE,CAAC;gBACb,QAAQ,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;aACzB,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,IAAY;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;gBAC7B,UAAU,EAAE,aAAa;gBACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;gBAC9B,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;YAEH,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,mBAAmB,GAAG,KAAK,CAAC;YAChC,IAAI,iBAAiB,GAAG,KAAK,CAAC;YAC9B,IAAI,gBAAgB,GAAG,CAAC,CAAC;YACzB,IAAI,mBAAmB,GAAG,EAAE,CAAC;YAC7B,IAAI,cAAc,GAAG,CAAC,CAAC;YAEvB,IAAI,gBAAgB,GAAG,KAAK,CAAC;YAC7B,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,IAAI,eAAe,GAAG,KAAK,CAAC;YAE5B,QAAQ,CAAC,GAAG,EAAE;gBACZ,eAAe,CAAC,IAAI;oBAClB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBACzC,IAAI,SAAS,GAAG,EAAE,EAAE,CAAC;wBACnB,SAAS,GAAG,IAAI,CAAC;wBACjB,IAAI,SAAS,GAAG,cAAc,EAAE,CAAC;4BAC/B,cAAc,GAAG,SAAS,CAAC;4BAC3B,gBAAgB,GAAG,SAAS,CAAC;4BAC7B,mBAAmB,GAAG,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;wBACjE,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,eAAe,CAAC,IAAI;oBAClB,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;wBACnC,mBAAmB,GAAG,IAAI,CAAC;oBAC7B,CAAC;gBACH,CAAC;gBAED,gBAAgB,CAAC,IAAI;oBACnB,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;wBAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;wBAC/B,IAAI,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;4BAChD,iBAAiB,GAAG,IAAI,CAAC;wBAC3B,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,cAAc,CAAC,IAAI;oBACjB,IACE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;wBACtD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,EAC/B,CAAC;wBACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;wBACxC,IAAI,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;4BAChE,eAAe,GAAG,IAAI,CAAC;4BACvB,gBAAgB,GAAG,IAAI,CAAC;wBAC1B,CAAC;oBACH,CAAC;oBAED,IACE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;wBACtC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAC5D,CAAC;wBACD,YAAY,GAAG,IAAI,CAAC;oBACtB,CAAC;gBACH,CAAC;gBAED,cAAc,CAAC,IAAI;oBACjB,IACE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;wBACnD,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAChD,CAAC;wBACD,YAAY,GAAG,IAAI,CAAC;oBACtB,CAAC;gBACH,CAAC;gBAED,YAAY,CAAC,IAAI;oBACf,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;wBACpB,YAAY,GAAG,IAAI,CAAC;oBACtB,CAAC;gBACH,CAAC;aACF,CAAC,CAAC;YAEH,MAAM,OAAO,GACX,SAAS;gBACT,CAAC,mBAAmB,IAAI,iBAAiB,CAAC;gBAC1C,CAAC,YAAY,IAAI,YAAY,IAAI,eAAe,CAAC,CAAC;YAEpD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,UAAU,GACd,gBAAgB,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;gBAE7E,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,eAAe,SAAS,KAAK,cAAc,SAAS,CAAC,CAAC;gBAClE,MAAM,CAAC,IAAI,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAC;gBAC1C,MAAM,CAAC,IAAI,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAAC;gBACzC,MAAM,CAAC,IAAI,CAAC,cAAc,YAAY,EAAE,CAAC,CAAC;gBAC1C,MAAM,CAAC,IAAI,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC;gBACrC,MAAM,CAAC,IAAI,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC;gBAExC,OAAO;oBACL,gBAAgB;oBAChB,mBAAmB;oBACnB,UAAU;oBACV,SAAS;oBACT,mBAAmB;oBACnB,iBAAiB;iBAClB,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;YAE5C,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,IAAY;QACvC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAEnD,MAAM,eAAe,GAAG,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEzE,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEhD,MAAM,YAAY,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE9D,IAAI,SAAS,IAAI,CAAC,eAAe,IAAI,YAAY,IAAI,YAAY,CAAC,EAAE,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;gBACL,gBAAgB,EAAE,CAAC;gBACnB,mBAAmB,EAAE,SAAS;gBAC9B,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,IAAI;gBACf,mBAAmB,EAAE,eAAe;gBACpC,iBAAiB,EAAE,YAAY;aAChC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,IAAY,EAAE,SAAqB;QACxD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1D,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,mBAAmB,CAAC,IAAY,EAAE,QAAoB;QAC5D,MAAM,YAAY,GAAoB,EAAE,CAAC;QAEzC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;gBAC7B,UAAU,EAAE,aAAa;gBACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;aAC/B,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,IAAI,CAAC;YAClB,QAAQ,CAAC,GAAG,EAAE;gBACZ,eAAe,CAAC,IAAI;oBAClB,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,gBAAgB,EAAE,CAAC;wBACzD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;4BAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI;gCAC1B,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC;oCACjC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK;oCACrB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC;wCAChC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK;wCACrB,CAAC,CAAC,KAAK;gCACX,CAAC,CAAC,KAAK,CAAC;4BAEV,MAAM,IAAI,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;4BAEjD,YAAY,CAAC,IAAI,CAAC;gCAChB,MAAM;gCACN,IAAI,EAAE,QAAQ,MAAM,EAAE;gCACtB,IAAI;gCACJ,WAAW,EAAE,eAAe,MAAM,EAAE;6BACrC,CAAC,CAAC;wBACL,CAAC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAEO,oBAAoB,CAAC,QAAsB;QACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;QACrC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;QAEvC,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;QAE3B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;gBAE7B,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,aAAa,GAAG,IAAI,CAAC;gBACvB,CAAC;gBAED,IAAI,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACpE,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC;gBAED,IAAI,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,eAAe,GAAG,IAAI,CAAC;gBACzB,CAAC;gBAED,IAAI,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAC5D,aAAa,GAAG,IAAI,CAAC;oBACvB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IACE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC;gBACrB,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC;gBACxB,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC;gBACxB,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;gBAC3B,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,EACzB,CAAC;gBACD,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;QACH,CAAC;QAED,IACE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC,cAAc,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACtC,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,aAAa,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe,EAAE,CAAC;YACxD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,IAAI,cAAc,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,eAAe,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3E,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,IAAY,EACZ,SAAqB,EACrB,MAAc,EACd,UAAmB,EACnB,QAAgB,EAChB,cAAsB;QAOtB,KAAK,IAAI,CAAC,oBAAoB,CAAC;QAC/B,OAAO,gBAAgB,CACrB;YACE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,EACD,IAAI,EACJ,MAAM,EACN,UAAU,CACX,CAAC;IACJ,CAAC;IAGO,oBAAoB,CAC1B,IAAY,EACZ,UAAmB,EACnB,QAAkB,EAClB,eAAiC;QAEjC,OAAO,oBAAoB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/dist/modules/deobfuscator/JSVMPDeobfuscator.restore.d.ts

@@ -0,0 +1,17 @@
+import type { LLMService } from '../../services/LLMService.js';
+import type { UnresolvedPart, VMType } from '../../types/index.js';
+import { ExecutionSandbox } from '../security/ExecutionSandbox.js';
+type RestoreResult = {
+    code: string;
+    confidence: number;
+    warnings: string[];
+    unresolvedParts?: UnresolvedPart[];
+};
+type RestoreContext = {
+    llm?: LLMService;
+    sandbox: ExecutionSandbox;
+};
+export declare function restoreJSVMPCode(context: RestoreContext, code: string, vmType: VMType, aggressive: boolean): Promise<RestoreResult>;
+export declare function restoreCustomVMBasic(code: string, aggressive: boolean, warnings: string[], unresolvedParts: UnresolvedPart[]): RestoreResult;
+export {};
+//# sourceMappingURL=JSVMPDeobfuscator.restore.d.ts.map

package/dist/modules/deobfuscator/JSVMPDeobfuscator.restore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JSVMPDeobfuscator.restore.d.ts","sourceRoot":"","sources":["../../../src/modules/deobfuscator/JSVMPDeobfuscator.restore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAEtE,KAAK,aAAa,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC;CACpC,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,gBAAgB,CAAC;CAC3B,CAAC;AAEF,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC,aAAa,CAAC,CAcxB;AAoRD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,OAAO,EACnB,QAAQ,EAAE,MAAM,EAAE,EAClB,eAAe,EAAE,cAAc,EAAE,GAChC,aAAa,CA2Cf"}

package/dist/modules/deobfuscator/JSVMPDeobfuscator.restore.js

@@ -0,0 +1,275 @@
+import { generateVMAnalysisMessages } from '../../services/prompts/deobfuscation.js';
+import { logger } from '../../utils/logger.js';
+export async function restoreJSVMPCode(context, code, vmType, aggressive) {
+    const warnings = [];
+    const unresolvedParts = [];
+    if (vmType === 'obfuscator.io') {
+        return restoreObfuscatorIO(context, code, aggressive, warnings, unresolvedParts);
+    }
+    if (vmType === 'jsfuck') {
+        return restoreJSFuck(context, code, warnings);
+    }
+    if (vmType === 'jjencode') {
+        return restoreJJEncode(context, code, warnings);
+    }
+    return restoreCustomVM(context, code, aggressive, warnings, unresolvedParts);
+}
+async function restoreObfuscatorIO(context, code, aggressive, warnings, unresolvedParts) {
+    let restored = code;
+    let confidence = 0.5;
+    try {
+        const stringArrayMatch = code.match(/var\s+(_0x[a-f0-9]+)\s*=\s*(\[.*?\]);/s);
+        if (stringArrayMatch) {
+            const arrayName = stringArrayMatch[1];
+            const arrayContent = stringArrayMatch[2];
+            logger.info(` : ${arrayName}`);
+            try {
+                const sandboxResult = await context.sandbox.execute({
+                    code: `return ${arrayContent || '[]'};`,
+                    timeoutMs: 3000,
+                });
+                const stringArray = sandboxResult.ok ? sandboxResult.output : undefined;
+                if (Array.isArray(stringArray)) {
+                    logger.info(`String array detected, ${stringArray.length} strings found`);
+                    const refPattern = new RegExp(`${arrayName}\\[(\\d+)\\]`, 'g');
+                    restored = restored.replace(refPattern, (_match, index) => {
+                        const idx = parseInt(index, 10);
+                        if (idx < stringArray.length) {
+                            return JSON.stringify(stringArray[idx]);
+                        }
+                        return _match;
+                    });
+                    confidence += 0.2;
+                }
+            }
+            catch (e) {
+                warnings.push(`: ${e}`);
+                unresolvedParts.push({
+                    location: 'String Array',
+                    reason: '',
+                    suggestion: '',
+                });
+            }
+        }
+        restored = restored.replace(/\(function\s*\(_0x[a-f0-9]+,\s*_0x[a-f0-9]+\)\s*\{[\s\S]*?\}\(_0x[a-f0-9]+,\s*0x[a-f0-9]+\)\);?/g, '');
+        if (aggressive) {
+            restored = restored.replace(/\(function\s*\(\)\s*\{([\s\S]*)\}\(\)\);?/g, '$1');
+            confidence += 0.1;
+        }
+        restored = restored.replace(/0x([0-9a-f]+)/gi, (_match, hex) => {
+            return String(parseInt(hex, 16));
+        });
+        restored = restored.replace(/;\s*;/g, ';');
+        restored = restored.replace(/\{\s*\}/g, '{}');
+        warnings.push('obfuscator.io detected, may need special handling');
+        return {
+            code: restored,
+            confidence: Math.min(confidence, 1.0),
+            warnings,
+            unresolvedParts: unresolvedParts.length > 0 ? unresolvedParts : undefined,
+        };
+    }
+    catch (error) {
+        warnings.push(`obfuscator.io: ${error}`);
+        return {
+            code,
+            confidence: 0.2,
+            warnings,
+            unresolvedParts,
+        };
+    }
+}
+async function restoreJSFuck(context, code, warnings) {
+    try {
+        logger.info('JSFuck detected, attempting deobfuscation...');
+        try {
+            if (code.length > 100000) {
+                warnings.push('JSFuck code detected, file too large to process directly.');
+                warnings.push('Consider using an online JSFuck decoder tool.');
+                return {
+                    code,
+                    confidence: 0.1,
+                    warnings,
+                };
+            }
+            const sandboxResult = await context.sandbox.execute({ code: `return ${code};`, timeoutMs: 5000 });
+            const result = sandboxResult.ok ? sandboxResult.output : undefined;
+            if (typeof result === 'string') {
+                logger.info(' JSFuck');
+                return {
+                    code: result,
+                    confidence: 0.9,
+                    warnings: ['JSFuck'],
+                };
+            }
+            warnings.push('JSFuck');
+            return {
+                code,
+                confidence: 0.2,
+                warnings,
+            };
+        }
+        catch (execError) {
+            warnings.push(`JSFuck: ${execError}`);
+            warnings.push('Consider using an online JSFuck decoder tool.');
+            return {
+                code,
+                confidence: 0.1,
+                warnings,
+            };
+        }
+    }
+    catch (error) {
+        warnings.push(`JSFuck: ${error}`);
+        return {
+            code,
+            confidence: 0.1,
+            warnings,
+        };
+    }
+}
+async function restoreJJEncode(context, code, warnings) {
+    try {
+        logger.info('JJEncode detected, attempting deobfuscation...');
+        try {
+            const lines = code.split('\n').filter((line) => line.trim());
+            const lastLine = lines.length > 0 ? lines[lines.length - 1] : '';
+            if (lastLine && lastLine.includes('$$$$')) {
+                const sandboxResult = await context.sandbox.execute({
+                    code: `${code}; return $$$$()`,
+                    timeoutMs: 5000,
+                });
+                const result = sandboxResult.ok ? sandboxResult.output : undefined;
+                if (typeof result === 'string') {
+                    logger.info(' JJEncode');
+                    return {
+                        code: result,
+                        confidence: 0.9,
+                        warnings: ['JJEncode'],
+                    };
+                }
+            }
+            const sandboxResult = await context.sandbox.execute({ code, timeoutMs: 5000 });
+            if (!sandboxResult.ok) {
+                logger.warn('JJEncode sandbox execution failed:', sandboxResult.error);
+            }
+            warnings.push('JJEncode deobfuscation may be incomplete');
+            warnings.push('Result may still contain JJEncode fragments');
+            return {
+                code,
+                confidence: 0.2,
+                warnings,
+            };
+        }
+        catch (execError) {
+            warnings.push(`JJEncode: ${execError}`);
+            warnings.push('Result may contain evaluation artifacts');
+            return {
+                code,
+                confidence: 0.1,
+                warnings,
+            };
+        }
+    }
+    catch (error) {
+        warnings.push(`JJEncode: ${error}`);
+        return {
+            code,
+            confidence: 0.1,
+            warnings,
+        };
+    }
+}
+async function restoreCustomVM(context, code, aggressive, warnings, unresolvedParts) {
+    if (!context.llm) {
+        warnings.push('LLM service unavailable, using fallback');
+        warnings.push('Configure DeepSeek/OpenAI API key for AI-assisted deobfuscation');
+        return restoreCustomVMBasic(code, aggressive, warnings, unresolvedParts);
+    }
+    try {
+        logger.info(' LLMVM...');
+        const response = await context.llm.chat(generateVMAnalysisMessages(code));
+        const analysisText = response.content;
+        logger.info(' LLM');
+        logger.info(`: ${analysisText.substring(0, 200)}...`);
+        let vmAnalysis;
+        try {
+            const jsonMatch = analysisText.match(/\{[\s\S]*\}/);
+            if (jsonMatch) {
+                const parsed = JSON.parse(jsonMatch[0]);
+                if (parsed && typeof parsed === 'object') {
+                    vmAnalysis = parsed;
+                }
+            }
+        }
+        catch {
+            warnings.push('LLM analysis failed, using fallback');
+            return restoreCustomVMBasic(code, aggressive, warnings, unresolvedParts);
+        }
+        if (vmAnalysis) {
+            warnings.push(`LLMVM: ${typeof vmAnalysis.vmType === 'string' ? vmAnalysis.vmType : 'Unknown'}`);
+            const vmWarnings = vmAnalysis.warnings;
+            if (Array.isArray(vmWarnings)) {
+                warnings.push(...vmWarnings);
+            }
+            const restorationSteps = vmAnalysis.restorationSteps;
+            if (Array.isArray(restorationSteps)) {
+                unresolvedParts.push({
+                    location: 'VM Restoration',
+                    reason: 'LLM',
+                    suggestion: restorationSteps.join('\n'),
+                });
+            }
+            return {
+                code,
+                confidence: 0.6,
+                warnings,
+                unresolvedParts: unresolvedParts.length > 0 ? unresolvedParts : undefined,
+            };
+        }
+        return restoreCustomVMBasic(code, aggressive, warnings, unresolvedParts);
+    }
+    catch (error) {
+        logger.error('LLM', error);
+        warnings.push(`LLM: ${error}`);
+        return restoreCustomVMBasic(code, aggressive, warnings, unresolvedParts);
+    }
+}
+export function restoreCustomVMBasic(code, aggressive, warnings, unresolvedParts) {
+    let restored = code;
+    let confidence = 0.3;
+    try {
+        restored = restored.replace(/if\s*\([^)]*\)\s*\{\s*\}/g, '');
+        restored = restored.replace(/!!\s*\(/g, 'Boolean(');
+        restored = restored.replace(/""\s*\+\s*/g, '');
+        if (aggressive) {
+            restored = restored.replace(/debugger;?/g, '');
+            confidence += 0.1;
+            restored = restored.replace(/\?\s*([^:]+)\s*:\s*\1/g, '$1');
+            confidence += 0.05;
+        }
+        warnings.push('Analysis incomplete, partial results may be returned');
+        warnings.push('For better results, configure an LLM API key');
+        unresolvedParts.push({
+            location: 'Custom VM',
+            reason: 'VM',
+            suggestion: 'VM protection detected, LLM-assisted analysis recommended',
+        });
+        return {
+            code: restored,
+            confidence,
+            warnings,
+            unresolvedParts: unresolvedParts.length > 0 ? unresolvedParts : undefined,
+        };
+    }
+    catch (error) {
+        warnings.push(`: ${error}`);
+        return {
+            code,
+            confidence: 0.1,
+            warnings,
+            unresolvedParts,
+        };
+    }
+}
+//# sourceMappingURL=JSVMPDeobfuscator.restore.js.map

package/dist/modules/deobfuscator/JSVMPDeobfuscator.restore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JSVMPDeobfuscator.restore.js","sourceRoot":"","sources":["../../../src/modules/deobfuscator/JSVMPDeobfuscator.restore.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAevC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAuB,EACvB,IAAY,EACZ,MAAc,EACd,UAAmB;IAEnB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,eAAe,GAAqB,EAAE,CAAC;IAE7C,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;QAC/B,OAAO,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAuB,EACvB,IAAY,EACZ,UAAmB,EACnB,QAAkB,EAClB,eAAiC;IAEjC,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,UAAU,GAAG,GAAG,CAAC;IAErB,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC9E,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAEzC,MAAM,CAAC,IAAI,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;YAE/B,IAAI,CAAC;gBACH,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;oBAClD,IAAI,EAAE,UAAU,YAAY,IAAI,IAAI,GAAG;oBACvC,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC;gBACH,MAAM,WAAW,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;gBAExE,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,MAAM,CAAC,IAAI,CAAC,0BAA0B,WAAW,CAAC,MAAM,gBAAgB,CAAC,CAAC;oBAE1E,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,GAAG,SAAS,cAAc,EAAE,GAAG,CAAC,CAAC;oBAC/D,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;wBACxD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBAChC,IAAI,GAAG,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;4BAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC1C,CAAC;wBACD,OAAO,MAAM,CAAC;oBAChB,CAAC,CAAC,CAAC;oBAEH,UAAU,IAAI,GAAG,CAAC;gBACpB,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACxB,eAAe,CAAC,IAAI,CAAC;oBACnB,QAAQ,EAAE,cAAc;oBACxB,MAAM,EAAE,EAAE;oBACV,UAAU,EAAE,EAAE;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,QAAQ,GAAG,QAAQ,CAAC,OAAO,CACzB,kGAAkG,EAClG,EAAE,CACH,CAAC;QAEF,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,4CAA4C,EAAE,IAAI,CAAC,CAAC;YAChF,UAAU,IAAI,GAAG,CAAC;QACpB,CAAC;QAED,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;YAC7D,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC3C,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAE9C,QAAQ,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QAEnE,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC;YACrC,QAAQ;YACR,eAAe,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;SAC1E,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;QACzC,OAAO;YACL,IAAI;YACJ,UAAU,EAAE,GAAG;YACf,QAAQ;YACR,eAAe;SAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAAuB,EACvB,IAAY,EACZ,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAE5D,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;gBACzB,QAAQ,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;gBAC3E,QAAQ,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;gBAC/D,OAAO;oBACL,IAAI;oBACJ,UAAU,EAAE,GAAG;oBACf,QAAQ;iBACT,CAAC;YACJ,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,IAAI,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClG,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAEnE,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACvB,OAAO;oBACL,IAAI,EAAE,MAAM;oBACZ,UAAU,EAAE,GAAG;oBACf,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB,CAAC;YACJ,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO;gBACL,IAAI;gBACJ,UAAU,EAAE,GAAG;gBACf,QAAQ;aACT,CAAC;QACJ,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,WAAW,SAAS,EAAE,CAAC,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;YAC/D,OAAO;gBACL,IAAI;gBACJ,UAAU,EAAE,GAAG;gBACf,QAAQ;aACT,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;QAClC,OAAO;YACL,IAAI;YACJ,UAAU,EAAE,GAAG;YACf,QAAQ;SACT,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAuB,EACvB,IAAY,EACZ,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAE9D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAEjE,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1C,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;oBAClD,IAAI,EAAE,GAAG,IAAI,iBAAiB;oBAC9B,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;gBAEnE,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;oBACzB,OAAO;wBACL,IAAI,EAAE,MAAM;wBACZ,UAAU,EAAE,GAAG;wBACf,QAAQ,EAAE,CAAC,UAAU,CAAC;qBACvB,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;YACzE,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;YAC7D,OAAO;gBACL,IAAI;gBACJ,UAAU,EAAE,GAAG;gBACf,QAAQ;aACT,CAAC;QACJ,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,aAAa,SAAS,EAAE,CAAC,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YACzD,OAAO;gBACL,IAAI;gBACJ,UAAU,EAAE,GAAG;gBACf,QAAQ;aACT,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC;QACpC,OAAO;YACL,IAAI;YACJ,UAAU,EAAE,GAAG;YACf,QAAQ;SACT,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAuB,EACvB,IAAY,EACZ,UAAmB,EACnB,QAAkB,EAClB,eAAiC;IAEjC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QACzD,QAAQ,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;QAEjF,OAAO,oBAAoB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAEzB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;QAE1E,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC;QAEtC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,KAAK,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAEtD,IAAI,UAA+C,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACpD,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACzC,UAAU,GAAG,MAAiC,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACrD,OAAO,oBAAoB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CACX,UAAU,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAClF,CAAC;YAEF,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC;YACvC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CAAC,GAAI,UAAuB,CAAC,CAAC;YAC7C,CAAC;YAED,MAAM,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;YACrD,IAAI,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpC,eAAe,CAAC,IAAI,CAAC;oBACnB,QAAQ,EAAE,gBAAgB;oBAC1B,MAAM,EAAE,KAAK;oBACb,UAAU,EAAG,gBAA8B,CAAC,IAAI,CAAC,IAAI,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,IAAI;gBACJ,UAAU,EAAE,GAAG;gBACf,QAAQ;gBACR,eAAe,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;aAC1E,CAAC;QACJ,CAAC;QAED,OAAO,oBAAoB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC;QAC/B,OAAO,oBAAoB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,UAAmB,EACnB,QAAkB,EAClB,eAAiC;IAEjC,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,UAAU,GAAG,GAAG,CAAC;IAErB,IAAI,CAAC;QACH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;QAE7D,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAEpD,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAE/C,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YAC/C,UAAU,IAAI,GAAG,CAAC;YAElB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;YAC5D,UAAU,IAAI,IAAI,CAAC;QACrB,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACtE,QAAQ,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAE9D,eAAe,CAAC,IAAI,CAAC;YACnB,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,2DAA2D;SACxE,CAAC,CAAC;QAEH,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,QAAQ;YACR,eAAe,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;SAC1E,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;QAC5B,OAAO;YACL,IAAI;YACJ,UAAU,EAAE,GAAG;YACf,QAAQ;YACR,eAAe;SAChB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/modules/deobfuscator/JScramblerDeobfuscator.d.ts

@@ -0,0 +1,28 @@
+export interface JScramberDeobfuscatorOptions {
+    code: string;
+    removeDeadCode?: boolean;
+    restoreControlFlow?: boolean;
+    decryptStrings?: boolean;
+    simplifyExpressions?: boolean;
+}
+export interface JScramberDeobfuscatorResult {
+    code: string;
+    success: boolean;
+    transformations: string[];
+    warnings: string[];
+    confidence: number;
+}
+export declare class JScramberDeobfuscator {
+    deobfuscate(options: JScramberDeobfuscatorOptions): Promise<JScramberDeobfuscatorResult>;
+    private detectSelfDefending;
+    private removeSelfDefending;
+    private decryptStrings;
+    private findDecryptFunctions;
+    private restoreControlFlow;
+    private isControlFlowFlatteningPattern;
+    private unflattenControlFlowPattern;
+    private removeDeadCode;
+    private simplifyExpressions;
+    private calculateConfidence;
+}
+//# sourceMappingURL=JScramblerDeobfuscator.d.ts.map

package/dist/modules/deobfuscator/JScramblerDeobfuscator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JScramblerDeobfuscator.d.ts","sourceRoot":"","sources":["../../../src/modules/deobfuscator/JScramblerDeobfuscator.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,qBAAqB;IAC1B,WAAW,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAuF9F,OAAO,CAAC,mBAAmB;IAmB3B,OAAO,CAAC,mBAAmB;IAyB3B,OAAO,CAAC,cAAc;IAuBtB,OAAO,CAAC,oBAAoB;IAqB5B,OAAO,CAAC,kBAAkB;IAkB1B,OAAO,CAAC,8BAA8B;IAatC,OAAO,CAAC,2BAA2B;IAUnC,OAAO,CAAC,cAAc;IAuBtB,OAAO,CAAC,mBAAmB;IAoC3B,OAAO,CAAC,mBAAmB;CAG5B"}