@jshookmcp/jshook 0.1.2

package/dist/modules/deobfuscator/JScramblerDeobfuscator.js

@@ -0,0 +1,237 @@
+import * as parser from '@babel/parser';
+import traverse from '@babel/traverse';
+import generate from '@babel/generator';
+import * as t from '@babel/types';
+import { logger } from '../../utils/logger.js';
+export class JScramberDeobfuscator {
+    async deobfuscate(options) {
+        const { code, removeDeadCode = true, restoreControlFlow = true, decryptStrings = true, simplifyExpressions = true, } = options;
+        logger.info(' JScrambler...');
+        const transformations = [];
+        const warnings = [];
+        let currentCode = code;
+        try {
+            const ast = parser.parse(currentCode, {
+                sourceType: 'unambiguous',
+                plugins: ['jsx', 'typescript'],
+                errorRecovery: true,
+            });
+            if (this.detectSelfDefending(ast)) {
+                this.removeSelfDefending(ast);
+                transformations.push('');
+            }
+            if (decryptStrings) {
+                const decrypted = this.decryptStrings(ast);
+                if (decrypted > 0) {
+                    transformations.push(`: ${decrypted}`);
+                }
+            }
+            if (restoreControlFlow) {
+                const restored = this.restoreControlFlow(ast);
+                if (restored > 0) {
+                    transformations.push(`: ${restored}`);
+                }
+            }
+            if (removeDeadCode) {
+                const removed = this.removeDeadCode(ast);
+                if (removed > 0) {
+                    transformations.push(`: ${removed}`);
+                }
+            }
+            if (simplifyExpressions) {
+                const simplified = this.simplifyExpressions(ast);
+                if (simplified > 0) {
+                    transformations.push(`: ${simplified}`);
+                }
+            }
+            const output = generate(ast, {
+                comments: true,
+                compact: false,
+            });
+            currentCode = output.code;
+            const confidence = this.calculateConfidence(transformations.length);
+            logger.info(`JScrambler deobfuscation complete, ${transformations.length} transformations applied`);
+            return {
+                code: currentCode,
+                success: true,
+                transformations,
+                warnings,
+                confidence,
+            };
+        }
+        catch (error) {
+            logger.error('JScrambler', error);
+            return {
+                code: currentCode,
+                success: false,
+                transformations,
+                warnings: [...warnings, String(error)],
+                confidence: 0,
+            };
+        }
+    }
+    detectSelfDefending(ast) {
+        let hasSelfDefending = false;
+        traverse(ast, {
+            FunctionDeclaration(path) {
+                if (path.node.body.body.some((stmt) => t.isDebuggerStatement(stmt))) {
+                    hasSelfDefending = true;
+                }
+                const code = generate(path.node).code;
+                if (code.includes('toString') && code.includes('constructor')) {
+                    hasSelfDefending = true;
+                }
+            },
+        });
+        return hasSelfDefending;
+    }
+    removeSelfDefending(ast) {
+        traverse(ast, {
+            DebuggerStatement(path) {
+                path.remove();
+            },
+            CallExpression(path) {
+                if (t.isIdentifier(path.node.callee) &&
+                    (path.node.callee.name === 'setInterval' || path.node.callee.name === 'setTimeout')) {
+                    const arg = path.node.arguments[0];
+                    if (t.isFunctionExpression(arg) || t.isArrowFunctionExpression(arg)) {
+                        const body = arg.body;
+                        if (t.isBlockStatement(body)) {
+                            if (body.body.some((stmt) => t.isDebuggerStatement(stmt))) {
+                                path.remove();
+                            }
+                        }
+                    }
+                }
+            },
+        });
+    }
+    decryptStrings(ast) {
+        let count = 0;
+        const decryptFunctions = this.findDecryptFunctions(ast);
+        traverse(ast, {
+            CallExpression(path) {
+                if (t.isIdentifier(path.node.callee)) {
+                    const funcName = path.node.callee.name;
+                    if (decryptFunctions.has(funcName)) {
+                        try {
+                            const decrypted = '[DECRYPTED_STRING]';
+                            path.replaceWith(t.stringLiteral(decrypted));
+                            count++;
+                        }
+                        catch { }
+                    }
+                }
+            },
+        });
+        return count;
+    }
+    findDecryptFunctions(ast) {
+        const decryptFunctions = new Set();
+        traverse(ast, {
+            FunctionDeclaration(path) {
+                const code = generate(path.node).code;
+                if (code.includes('charCodeAt') &&
+                    code.includes('fromCharCode') &&
+                    code.includes('split')) {
+                    if (path.node.id) {
+                        decryptFunctions.add(path.node.id.name);
+                    }
+                }
+            },
+        });
+        return decryptFunctions;
+    }
+    restoreControlFlow(ast) {
+        let count = 0;
+        const self = this;
+        traverse(ast, {
+            WhileStatement(path) {
+                if (self.isControlFlowFlatteningPattern(path.node)) {
+                    try {
+                        self.unflattenControlFlowPattern(path);
+                        count++;
+                    }
+                    catch { }
+                }
+            },
+        });
+        return count;
+    }
+    isControlFlowFlatteningPattern(node) {
+        if (!t.isBooleanLiteral(node.test) || !node.test.value) {
+            return false;
+        }
+        if (!t.isBlockStatement(node.body)) {
+            return false;
+        }
+        const firstStmt = node.body.body[0];
+        return t.isSwitchStatement(firstStmt);
+    }
+    unflattenControlFlowPattern(path) {
+        const whileStmt = path.node;
+        if (t.isBlockStatement(whileStmt.body)) {
+            const switchStmt = whileStmt.body.body[0];
+            if (t.isSwitchStatement(switchStmt)) {
+                path.replaceWithMultiple(switchStmt.cases.map((c) => c.consequent).flat());
+            }
+        }
+    }
+    removeDeadCode(ast) {
+        let count = 0;
+        traverse(ast, {
+            IfStatement(path) {
+                if (t.isBooleanLiteral(path.node.test)) {
+                    if (path.node.test.value) {
+                        path.replaceWith(path.node.consequent);
+                    }
+                    else {
+                        if (path.node.alternate) {
+                            path.replaceWith(path.node.alternate);
+                        }
+                        else {
+                            path.remove();
+                        }
+                    }
+                    count++;
+                }
+            },
+        });
+        return count;
+    }
+    simplifyExpressions(ast) {
+        let count = 0;
+        traverse(ast, {
+            BinaryExpression(path) {
+                if (t.isNumericLiteral(path.node.left) && t.isNumericLiteral(path.node.right)) {
+                    const left = path.node.left.value;
+                    const right = path.node.right.value;
+                    let result;
+                    switch (path.node.operator) {
+                        case '+':
+                            result = left + right;
+                            break;
+                        case '-':
+                            result = left - right;
+                            break;
+                        case '*':
+                            result = left * right;
+                            break;
+                        case '/':
+                            result = left / right;
+                            break;
+                    }
+                    if (result !== undefined) {
+                        path.replaceWith(t.numericLiteral(result));
+                        count++;
+                    }
+                }
+            },
+        });
+        return count;
+    }
+    calculateConfidence(transformationCount) {
+        return Math.min(transformationCount / 5, 1.0);
+    }
+}
+//# sourceMappingURL=JScramblerDeobfuscator.js.map

package/dist/modules/deobfuscator/JScramblerDeobfuscator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JScramblerDeobfuscator.js","sourceRoot":"","sources":["../../../src/modules/deobfuscator/JScramblerDeobfuscator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,QAAQ,MAAM,iBAAiB,CAAC;AAEvC,OAAO,QAAQ,MAAM,kBAAkB,CAAC;AACxC,OAAO,KAAK,CAAC,MAAM,cAAc,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAkBvC,MAAM,OAAO,qBAAqB;IAChC,KAAK,CAAC,WAAW,CAAC,OAAqC;QACrD,MAAM,EACJ,IAAI,EACJ,cAAc,GAAG,IAAI,EACrB,kBAAkB,GAAG,IAAI,EACzB,cAAc,GAAG,IAAI,EACrB,mBAAmB,GAAG,IAAI,GAC3B,GAAG,OAAO,CAAC;QAEZ,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAE9B,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,WAAW,GAAG,IAAI,CAAC;QAEvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE;gBACpC,UAAU,EAAE,aAAa;gBACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;gBAC9B,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;YAEH,IAAI,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;gBAC9B,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;gBAC3C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;oBAClB,eAAe,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;YAED,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBAC9C,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;oBACjB,eAAe,CAAC,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;gBACzC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;oBAChB,eAAe,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;YAED,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;gBACjD,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;oBACnB,eAAe,CAAC,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE;gBAC3B,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YAEH,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC;YAE1B,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAEpE,MAAM,CAAC,IAAI,CACT,sCAAsC,eAAe,CAAC,MAAM,0BAA0B,CACvF,CAAC;YAEF,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,IAAI;gBACb,eAAe;gBACf,QAAQ;gBACR,UAAU;aACX,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAClC,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,KAAK;gBACd,eAAe;gBACf,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBACtC,UAAU,EAAE,CAAC;aACd,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,GAAW;QACrC,IAAI,gBAAgB,GAAG,KAAK,CAAC;QAE7B,QAAQ,CAAC,GAAG,EAAE;YACZ,mBAAmB,CAAC,IAAI;gBACtB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBACpE,gBAAgB,GAAG,IAAI,CAAC;gBAC1B,CAAC;gBAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;gBACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC9D,gBAAgB,GAAG,IAAI,CAAC;gBAC1B,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAEO,mBAAmB,CAAC,GAAW;QACrC,QAAQ,CAAC,GAAG,EAAE;YACZ,iBAAiB,CAAC,IAAI;gBACpB,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,CAAC;YAED,cAAc,CAAC,IAAI;gBACjB,IACE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;oBAChC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,EACnF,CAAC;oBACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBACnC,IAAI,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;wBACpE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;wBACtB,IAAI,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;4BAC7B,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gCAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;4BAChB,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,GAAW;QAChC,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,MAAM,gBAAgB,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAExD,QAAQ,CAAC,GAAG,EAAE;YACZ,cAAc,CAAC,IAAI;gBACjB,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACvC,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACnC,IAAI,CAAC;4BACH,MAAM,SAAS,GAAG,oBAAoB,CAAC;4BACvC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;4BAC7C,KAAK,EAAE,CAAC;wBACV,CAAC;wBAAC,MAAM,CAAC,CAAA,CAAC;oBACZ,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,oBAAoB,CAAC,GAAW;QACtC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;QAE3C,QAAQ,CAAC,GAAG,EAAE;YACZ,mBAAmB,CAAC,IAAI;gBACtB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;gBACtC,IACE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAC3B,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;oBAC7B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EACtB,CAAC;oBACD,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACjB,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;oBAC1C,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAEO,kBAAkB,CAAC,GAAW;QACpC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,IAAI,GAAG,IAAI,CAAC;QAElB,QAAQ,CAAC,GAAG,EAAE;YACZ,cAAc,CAAC,IAAI;gBACjB,IAAI,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnD,IAAI,CAAC;wBACH,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;wBACvC,KAAK,EAAE,CAAC;oBACV,CAAC;oBAAC,MAAM,CAAC,CAAA,CAAC;gBACZ,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,8BAA8B,CAAC,IAAsB;QAC3D,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAEO,2BAA2B,CAAC,IAAgC;QAClE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAwB,CAAC;QAChD,IAAI,CAAC,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,GAAW;QAChC,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,QAAQ,CAAC,GAAG,EAAE;YACZ,WAAW,CAAC,IAAI;gBACd,IAAI,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBACzC,CAAC;yBAAM,CAAC;wBACN,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;4BACxB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;wBACxC,CAAC;6BAAM,CAAC;4BACN,IAAI,CAAC,MAAM,EAAE,CAAC;wBAChB,CAAC;oBACH,CAAC;oBACD,KAAK,EAAE,CAAC;gBACV,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,mBAAmB,CAAC,GAAW;QACrC,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,QAAQ,CAAC,GAAG,EAAE;YACZ,gBAAgB,CAAC,IAAI;gBACnB,IAAI,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;oBAClC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;oBACpC,IAAI,MAA0B,CAAC;oBAE/B,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAC3B,KAAK,GAAG;4BACN,MAAM,GAAG,IAAI,GAAG,KAAK,CAAC;4BACtB,MAAM;wBACR,KAAK,GAAG;4BACN,MAAM,GAAG,IAAI,GAAG,KAAK,CAAC;4BACtB,MAAM;wBACR,KAAK,GAAG;4BACN,MAAM,GAAG,IAAI,GAAG,KAAK,CAAC;4BACtB,MAAM;wBACR,KAAK,GAAG;4BACN,MAAM,GAAG,IAAI,GAAG,KAAK,CAAC;4BACtB,MAAM;oBACV,CAAC;oBAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBACzB,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;wBAC3C,KAAK,EAAE,CAAC;oBACV,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,mBAAmB,CAAC,mBAA2B;QACrD,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;CACF"}

package/dist/modules/deobfuscator/PackerDeobfuscator.d.ts

@@ -0,0 +1,40 @@
+export interface PackerDeobfuscatorOptions {
+    code: string;
+    maxIterations?: number;
+}
+export interface PackerDeobfuscatorResult {
+    code: string;
+    success: boolean;
+    iterations: number;
+    warnings: string[];
+}
+export declare class PackerDeobfuscator {
+    private readonly sandbox;
+    static detect(code: string): boolean;
+    deobfuscate(options: PackerDeobfuscatorOptions): Promise<PackerDeobfuscatorResult>;
+    private unpack;
+    private parsePackerParams;
+    private executeUnpacker;
+    private base;
+    beautify(code: string): string;
+}
+export declare class AAEncodeDeobfuscator {
+    private readonly sandbox;
+    static detect(code: string): boolean;
+    deobfuscate(code: string): Promise<string>;
+}
+export declare class URLEncodeDeobfuscator {
+    static detect(code: string): boolean;
+    deobfuscate(code: string): Promise<string>;
+}
+export declare class UniversalUnpacker {
+    private packerDeobfuscator;
+    private aaencodeDeobfuscator;
+    private urlencodeDeobfuscator;
+    deobfuscate(code: string): Promise<{
+        code: string;
+        type: string;
+        success: boolean;
+    }>;
+}
+//# sourceMappingURL=PackerDeobfuscator.d.ts.map

package/dist/modules/deobfuscator/PackerDeobfuscator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PackerDeobfuscator.d.ts","sourceRoot":"","sources":["../../../src/modules/deobfuscator/PackerDeobfuscator.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAElD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAM9B,WAAW,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,wBAAwB,CAAC;YA0C1E,MAAM;YAyBN,iBAAiB;IAsC/B,OAAO,CAAC,eAAe;IAwBvB,OAAO,CAAC,IAAI;IAgBZ,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAW/B;AAED,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAElD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI9B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAiBjD;AAED,qBAAa,qBAAqB;IAChC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAK9B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAYjD;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,kBAAkB,CAA4B;IACtD,OAAO,CAAC,oBAAoB,CAA8B;IAC1D,OAAO,CAAC,qBAAqB,CAA+B;IAEtD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QACvC,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;CAwCH"}

package/dist/modules/deobfuscator/PackerDeobfuscator.js

@@ -0,0 +1,207 @@
+import { logger } from '../../utils/logger.js';
+import { PACKER_SANDBOX_TIMEOUT_MS } from '../../constants.js';
+import { ExecutionSandbox } from '../security/ExecutionSandbox.js';
+export class PackerDeobfuscator {
+    sandbox = new ExecutionSandbox();
+    static detect(code) {
+        const packerPattern = /eval\s*\(\s*function\s*\(\s*p\s*,\s*a\s*,\s*c\s*,\s*k\s*,\s*e\s*,\s*[dr]\s*\)/;
+        return packerPattern.test(code);
+    }
+    async deobfuscate(options) {
+        const { code, maxIterations = 5 } = options;
+        logger.info(' Packer...');
+        const warnings = [];
+        let currentCode = code;
+        let iterations = 0;
+        try {
+            while (PackerDeobfuscator.detect(currentCode) && iterations < maxIterations) {
+                const unpacked = await this.unpack(currentCode);
+                if (!unpacked || unpacked === currentCode) {
+                    warnings.push('');
+                    break;
+                }
+                currentCode = unpacked;
+                iterations++;
+                logger.info(`  ${iterations} `);
+            }
+            logger.info(`Packer deobfuscation complete in ${iterations} iterations`);
+            return {
+                code: currentCode,
+                success: true,
+                iterations,
+                warnings,
+            };
+        }
+        catch (error) {
+            logger.error('Packer', error);
+            return {
+                code: currentCode,
+                success: false,
+                iterations,
+                warnings: [...warnings, String(error)],
+            };
+        }
+    }
+    async unpack(code) {
+        const match = code.match(/eval\s*\(\s*function\s*\(\s*p\s*,\s*a\s*,\s*c\s*,\s*k\s*,\s*e\s*,\s*[dr]\s*\)\s*{([\s\S]*?)}\s*\((.*?)\)\s*\)/);
+        if (!match || !match[2]) {
+            return code;
+        }
+        const args = match[2];
+        const params = await this.parsePackerParams(args);
+        if (!params) {
+            return code;
+        }
+        try {
+            const unpacked = this.executeUnpacker(params);
+            return unpacked || code;
+        }
+        catch (error) {
+            logger.warn('', error);
+            return code;
+        }
+    }
+    async parsePackerParams(argsString) {
+        try {
+            const sandboxResult = await this.sandbox.execute({ code: `return [${argsString}];`, timeoutMs: PACKER_SANDBOX_TIMEOUT_MS });
+            if (!sandboxResult.ok)
+                return null;
+            const params = sandboxResult.output;
+            if (!Array.isArray(params) || params.length < 4) {
+                return null;
+            }
+            return {
+                p: params[0] || '',
+                a: params[1] || 0,
+                c: params[2] || 0,
+                k: (typeof params[3] === 'string' ? params[3] : '').split('|'),
+                e: params[4] ||
+                    function (c) {
+                        return c;
+                    },
+                d: params[5] ||
+                    function () {
+                        return '';
+                    },
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    executeUnpacker(params) {
+        const { p, a, k } = params;
+        let { c } = params;
+        let result = p;
+        while (c--) {
+            const replacement = k[c];
+            if (replacement) {
+                const pattern = new RegExp('\\b' + this.base(c, a) + '\\b', 'g');
+                result = result.replace(pattern, replacement);
+            }
+        }
+        return result;
+    }
+    base(num, radix) {
+        const digits = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
+        if (num === 0) {
+            return '0';
+        }
+        let result = '';
+        while (num > 0) {
+            result = digits[num % radix] + result;
+            num = Math.floor(num / radix);
+        }
+        return result || '0';
+    }
+    beautify(code) {
+        let result = code;
+        result = result.replace(/;/g, ';\n');
+        result = result.replace(/{/g, '{\n');
+        result = result.replace(/}/g, '\n}\n');
+        result = result.replace(/\n\n+/g, '\n\n');
+        return result.trim();
+    }
+}
+export class AAEncodeDeobfuscator {
+    sandbox = new ExecutionSandbox();
+    static detect(code) {
+        return code.includes('゜-゜') || code.includes('ω゜') || code.includes('o゜)');
+    }
+    async deobfuscate(code) {
+        logger.info(' AAEncode...');
+        try {
+            const sandboxResult = await this.sandbox.execute({ code: `return (${code})`, timeoutMs: 5000 });
+            const decoded = sandboxResult.ok ? sandboxResult.output : undefined;
+            if (typeof decoded === 'string') {
+                logger.info(' AAEncode');
+                return decoded;
+            }
+            return code;
+        }
+        catch (error) {
+            logger.error('AAEncode', error);
+            return code;
+        }
+    }
+}
+export class URLEncodeDeobfuscator {
+    static detect(code) {
+        const percentCount = (code.match(/%[0-9A-Fa-f]{2}/g) || []).length;
+        return percentCount > 10;
+    }
+    async deobfuscate(code) {
+        logger.info(' URLEncode...');
+        try {
+            const decoded = decodeURIComponent(code);
+            logger.info(' URLEncode');
+            return decoded;
+        }
+        catch (error) {
+            logger.error('URLEncode', error);
+            return code;
+        }
+    }
+}
+export class UniversalUnpacker {
+    packerDeobfuscator = new PackerDeobfuscator();
+    aaencodeDeobfuscator = new AAEncodeDeobfuscator();
+    urlencodeDeobfuscator = new URLEncodeDeobfuscator();
+    async deobfuscate(code) {
+        logger.info(' ...');
+        if (PackerDeobfuscator.detect(code)) {
+            logger.info(': Packer');
+            const result = await this.packerDeobfuscator.deobfuscate({ code });
+            return {
+                code: result.code,
+                type: 'Packer',
+                success: result.success,
+            };
+        }
+        if (AAEncodeDeobfuscator.detect(code)) {
+            logger.info(': AAEncode');
+            const decoded = await this.aaencodeDeobfuscator.deobfuscate(code);
+            return {
+                code: decoded,
+                type: 'AAEncode',
+                success: decoded !== code,
+            };
+        }
+        if (URLEncodeDeobfuscator.detect(code)) {
+            logger.info(': URLEncode');
+            const decoded = await this.urlencodeDeobfuscator.deobfuscate(code);
+            return {
+                code: decoded,
+                type: 'URLEncode',
+                success: decoded !== code,
+            };
+        }
+        logger.info('');
+        return {
+            code,
+            type: 'Unknown',
+            success: false,
+        };
+    }
+}
+//# sourceMappingURL=PackerDeobfuscator.js.map

package/dist/modules/deobfuscator/PackerDeobfuscator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PackerDeobfuscator.js","sourceRoot":"","sources":["../../../src/modules/deobfuscator/PackerDeobfuscator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AActE,MAAM,OAAO,kBAAkB;IACZ,OAAO,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAElD,MAAM,CAAC,MAAM,CAAC,IAAY;QACxB,MAAM,aAAa,GACjB,+EAA+E,CAAC;QAClF,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAkC;QAClD,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC;QAE5C,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE1B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,WAAW,GAAG,IAAI,CAAC;QACvB,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,UAAU,GAAG,aAAa,EAAE,CAAC;gBAC5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAEhD,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;oBAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAClB,MAAM;gBACR,CAAC;gBAED,WAAW,GAAG,QAAQ,CAAC;gBACvB,UAAU,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC;YAClC,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,oCAAoC,UAAU,aAAa,CAAC,CAAC;YAEzE,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,IAAI;gBACb,UAAU;gBACV,QAAQ;aACT,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC9B,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,KAAK;gBACd,UAAU;gBACV,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;aACvC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,IAAY;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CACtB,+GAA+G,CAChH,CAAC;QAEF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAC9C,OAAO,QAAQ,IAAI,IAAI,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,UAAkB;QAQhD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,UAAU,IAAI,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC5H,IAAI,CAAC,aAAa,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAmB,CAAC;YAEjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,CAAC,EAAG,MAAM,CAAC,CAAC,CAAY,IAAI,EAAE;gBAC9B,CAAC,EAAG,MAAM,CAAC,CAAC,CAAY,IAAI,CAAC;gBAC7B,CAAC,EAAG,MAAM,CAAC,CAAC,CAAY,IAAI,CAAC;gBAC7B,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;gBAC9D,CAAC,EACE,MAAM,CAAC,CAAC,CAAc;oBACvB,UAAU,CAAU;wBAClB,OAAO,CAAC,CAAC;oBACX,CAAC;gBACH,CAAC,EACE,MAAM,CAAC,CAAC,CAAc;oBACvB;wBACE,OAAO,EAAE,CAAC;oBACZ,CAAC;aACJ,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,MAOvB;QACC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC;QAC3B,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC;QAEnB,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,OAAO,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC;gBACjE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,IAAI,CAAC,GAAW,EAAE,KAAa;QACrC,MAAM,MAAM,GAAG,gEAAgE,CAAC;QAEhF,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;YACd,OAAO,GAAG,CAAC;QACb,CAAC;QAED,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,OAAO,GAAG,GAAG,CAAC,EAAE,CAAC;YACf,MAAM,GAAG,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC;YACtC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,MAAM,IAAI,GAAG,CAAC;IACvB,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,IAAI,MAAM,GAAG,IAAI,CAAC;QAElB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEvC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE1C,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;CACF;AAED,MAAM,OAAO,oBAAoB;IACd,OAAO,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAElD,MAAM,CAAC,MAAM,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY;QAC5B,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,IAAI,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChG,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAEpE,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACzB,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,qBAAqB;IAChC,MAAM,CAAC,MAAM,CAAC,IAAY;QACxB,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACnE,OAAO,YAAY,GAAG,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY;QAC5B,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC1B,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,iBAAiB;IACpB,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAC9C,oBAAoB,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAClD,qBAAqB,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAE5D,KAAK,CAAC,WAAW,CAAC,IAAY;QAK5B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEpB,IAAI,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC;QACJ,CAAC;QAED,IAAI,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAClE,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,OAAO,KAAK,IAAI;aAC1B,CAAC;QACJ,CAAC;QAED,IAAI,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACnE,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,OAAO,KAAK,IAAI;aAC1B,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO;YACL,IAAI;YACJ,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;CACF"}

package/dist/modules/deobfuscator/VMDeobfuscator.d.ts

@@ -0,0 +1,40 @@
+import { LLMService } from '../../services/LLMService.js';
+type VMStructure = {
+    hasInterpreter: boolean;
+    instructionTypes: string[];
+    hasStack: boolean;
+    hasRegisters: boolean;
+};
+type VMComponents = {
+    instructionArray?: string;
+    dataArray?: string;
+    interpreterFunction?: string;
+};
+export declare class VMDeobfuscator {
+    private llm?;
+    constructor(llm?: LLMService);
+    detectVMProtection(code: string): {
+        detected: boolean;
+        type: string;
+        instructionCount: number;
+    };
+    countVMInstructions(code: string): number;
+    deobfuscateVM(code: string, vmInfo: {
+        type: string;
+        instructionCount: number;
+    }): Promise<{
+        success: boolean;
+        code: string;
+    }>;
+    analyzeVMStructure(code: string): VMStructure;
+    extractVMComponents(code: string): VMComponents;
+    buildVMDeobfuscationPrompt(code: string, vmInfo: {
+        type: string;
+        instructionCount: number;
+    }, vmStructure: VMStructure, vmComponents: VMComponents): string;
+    simplifyVMCode(code: string, vmComponents: VMComponents): string;
+    extractCodeFromLLMResponse(response: string): string;
+    isValidJavaScript(code: string): boolean;
+}
+export {};
+//# sourceMappingURL=VMDeobfuscator.d.ts.map

package/dist/modules/deobfuscator/VMDeobfuscator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"VMDeobfuscator.d.ts","sourceRoot":"","sources":["../../../src/modules/deobfuscator/VMDeobfuscator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAOlD,KAAK,WAAW,GAAG;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,KAAK,YAAY,GAAG;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,qBAAa,cAAc;IACzB,OAAO,CAAC,GAAG,CAAC,CAAa;gBAEb,GAAG,CAAC,EAAE,UAAU;IAIrB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG;QACvC,QAAQ,EAAE,OAAO,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,gBAAgB,EAAE,MAAM,CAAC;KAC1B;IAqBM,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAKnC,aAAa,CACxB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,GACjD,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IA+CvC,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW;IA+B7C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY;IAuD/C,0BAA0B,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,EAClD,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,YAAY,GACzB,MAAM;IAsFF,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,MAAM;IA2BhE,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IASpD,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;CAWhD"}