@jshookmcp/jshook 0.1.6 → 0.1.8

package/dist/modules/deobfuscator/Deobfuscator.js

@@ -1,15 +1,11 @@
-import * as parser from '@babel/parser';
-import traverse from '@babel/traverse';
-import generate from '@babel/generator';
-import * as t from '@babel/types';
 import crypto from 'crypto';
 import { logger } from '../../utils/logger.js';
 import { DEOBF_LLM_MAX_TOKENS } from '../../constants.js';
 import { generateDeobfuscationPrompt } from '../../services/prompts/deobfuscation.js';
 import { calculateReadabilityScore as calculateReadabilityScoreUtil, detectObfuscationType as detectObfuscationTypeUtil, } from '../deobfuscator/Deobfuscator.utils.js';
+import { runWebcrack } from '../deobfuscator/webcrack.js';
 export class Deobfuscator {
     llm;
-    stringArrays = new Map();
     resultCache = new Map();
     maxCacheSize = 100;
     constructor(llm) {
@@ -17,9 +13,17 @@ export class Deobfuscator {
     }
     generateCacheKey(options) {
         const key = JSON.stringify({
-            code: options.code.substring(0, 1000),
-            aggressive: options.aggressive,
-            preserveLogic: options.preserveLogic,
+            code: options.code.substring(0, 2000),
+            forceOutput: options.forceOutput,
+            includeModuleCode: options.includeModuleCode,
+            jsx: options.jsx,
+            llm: options.llm,
+            mangle: options.mangle ?? options.renameVariables,
+            mappings: options.mappings,
+            maxBundleModules: options.maxBundleModules,
+            outputDir: options.outputDir,
+            unpack: options.unpack,
+            unminify: options.unminify,
         });
         return crypto.createHash('md5').update(key).digest('hex');
     }
@@ -30,427 +34,144 @@ export class Deobfuscator {
             logger.debug('Deobfuscation result from cache');
             return cached;
         }
-        logger.info('Starting deobfuscation...');
+        logger.info('Starting webcrack deobfuscation...');
         const startTime = Date.now();
-        try {
-            let code = options.code;
-            const transformations = [];
-            const obfuscationType = this.detectObfuscationType(code);
-            logger.info(`Detected obfuscation types: ${obfuscationType.join(', ')}`);
-            code = await this.extractStringArrays(code, transformations);
-            code = await this.basicTransform(code, transformations);
-            code = await this.decodeStrings(code, transformations);
-            code = await this.decryptArrays(code, transformations);
-            if (options.aggressive) {
-                code = await this.unflattenControlFlow(code, transformations);
-            }
-            code = await this.simplifyExpressions(code, transformations);
-            if (options.renameVariables) {
-                code = await this.renameVariables(code, transformations);
+        const obfuscationType = this.detectObfuscationType(options.code);
+        const warnings = [];
+        if (options.aggressive !== undefined) {
+            warnings.push('aggressive is deprecated and ignored; webcrack is now the only deobfuscation engine.');
+        }
+        if (options.preserveLogic !== undefined) {
+            warnings.push('preserveLogic is deprecated and ignored.');
+        }
+        if (options.inlineFunctions !== undefined) {
+            warnings.push('inlineFunctions is deprecated and ignored.');
+        }
+        const webcrackResult = await runWebcrack(options.code, {
+            unpack: options.unpack,
+            unminify: options.unminify,
+            jsx: options.jsx,
+            mangle: options.mangle ?? options.renameVariables,
+            mappings: options.mappings,
+            includeModuleCode: options.includeModuleCode,
+            maxBundleModules: options.maxBundleModules,
+            outputDir: options.outputDir,
+            forceOutput: options.forceOutput,
+        });
+        if (!webcrackResult.applied) {
+            const reason = webcrackResult.reason ?? 'webcrack did not return a result';
+            logger.error(`webcrack deobfuscation failed: ${reason}`);
+            throw new Error(reason);
+        }
+        let analysis = this.buildAnalysis(webcrackResult, obfuscationType);
+        if (this.llm && options.llm) {
+            const llmResult = await this.llmAnalysis(webcrackResult.code);
+            if (llmResult) {
+                analysis = llmResult;
             }
-            let analysis = 'Basic deobfuscation completed.';
-            if (this.llm && options.llm) {
-                const llmResult = await this.llmAnalysis(code);
-                if (llmResult) {
-                    analysis = llmResult;
-                    transformations.push({
+        }
+        const transformations = [
+            {
+                type: 'webcrack',
+                description: `Ran webcrack (unminify=${webcrackResult.optionsUsed.unminify}, unpack=${webcrackResult.optionsUsed.unpack}, jsx=${webcrackResult.optionsUsed.jsx}, mangle=${webcrackResult.optionsUsed.mangle})`,
+                success: true,
+            },
+            ...(webcrackResult.bundle
+                ? [
+                    {
+                        type: 'webcrack-unpack',
+                        description: `Recovered ${webcrackResult.bundle.moduleCount} bundled modules`,
+                        success: true,
+                    },
+                ]
+                : []),
+            ...(webcrackResult.savedTo
+                ? [
+                    {
+                        type: 'webcrack-save',
+                        description: `Saved webcrack artifacts to ${webcrackResult.savedTo}`,
+                        success: true,
+                    },
+                ]
+                : []),
+            ...(this.llm && options.llm
+                ? [
+                    {
                         type: 'llm-analysis',
-                        description: 'AI-assisted code analysis completed',
+                        description: 'AI-assisted analysis completed after webcrack deobfuscation',
                         success: true,
-                    });
-                }
-            }
-            const deobfuscateTime = Date.now() - startTime;
-            const readabilityScore = this.calculateReadabilityScore(code);
-            const confidence = this.calculateConfidence(transformations, readabilityScore);
-            logger.success(`Deobfuscation completed in ${deobfuscateTime}ms (confidence: ${(confidence * 100).toFixed(1)}%)`);
-            const result = {
-                code,
-                readabilityScore,
-                confidence,
-                obfuscationType,
-                transformations,
-                analysis,
-            };
-            if (this.resultCache.size >= this.maxCacheSize) {
-                const firstKey = this.resultCache.keys().next().value;
-                if (firstKey) {
-                    this.resultCache.delete(firstKey);
-                }
+                    },
+                ]
+                : []),
+        ];
+        const readabilityScore = this.calculateReadabilityScore(webcrackResult.code);
+        const confidence = this.calculateConfidence(webcrackResult, readabilityScore);
+        const duration = Date.now() - startTime;
+        logger.success(`webcrack deobfuscation completed in ${duration}ms (confidence: ${(confidence * 100).toFixed(1)}%)`);
+        const result = {
+            code: webcrackResult.code,
+            readabilityScore,
+            confidence,
+            obfuscationType,
+            transformations,
+            analysis,
+            bundle: webcrackResult.bundle,
+            savedTo: webcrackResult.savedTo,
+            savedArtifacts: webcrackResult.savedArtifacts,
+            warnings: warnings.length > 0 ? warnings : undefined,
+            engine: 'webcrack',
+            webcrackApplied: true,
+        };
+        if (this.resultCache.size >= this.maxCacheSize) {
+            const firstKey = this.resultCache.keys().next().value;
+            if (firstKey) {
+                this.resultCache.delete(firstKey);
             }
-            this.resultCache.set(cacheKey, result);
-            return result;
-        }
-        catch (error) {
-            logger.error('Deobfuscation failed', error);
-            throw error;
         }
+        this.resultCache.set(cacheKey, result);
+        return result;
     }
     detectObfuscationType(code) {
         return detectObfuscationTypeUtil(code);
     }
-    async basicTransform(code, transformations) {
-        try {
-            const ast = parser.parse(code, {
-                sourceType: 'module',
-                plugins: ['jsx', 'typescript'],
-            });
-            traverse(ast, {
-                BinaryExpression(path) {
-                    if (t.isNumericLiteral(path.node.left) && t.isNumericLiteral(path.node.right)) {
-                        const left = path.node.left.value;
-                        const right = path.node.right.value;
-                        let result;
-                        switch (path.node.operator) {
-                            case '+':
-                                result = left + right;
-                                break;
-                            case '-':
-                                result = left - right;
-                                break;
-                            case '*':
-                                result = left * right;
-                                break;
-                            case '/':
-                                result = left / right;
-                                break;
-                        }
-                        if (result !== undefined) {
-                            path.replaceWith(t.numericLiteral(result));
-                        }
-                    }
-                },
-                IfStatement(path) {
-                    if (t.isBooleanLiteral(path.node.test)) {
-                        if (path.node.test.value) {
-                            path.replaceWith(path.node.consequent);
-                        }
-                        else if (path.node.alternate) {
-                            path.replaceWith(path.node.alternate);
-                        }
-                        else {
-                            path.remove();
-                        }
-                    }
-                },
-            });
-            const output = generate(ast, {
-                comments: true,
-                compact: false,
-            });
-            transformations.push({
-                type: 'basic-ast-transform',
-                description: 'Applied constant folding and dead code elimination',
-                success: true,
-            });
-            return output.code;
+    calculateReadabilityScore(code) {
+        return calculateReadabilityScoreUtil(code);
+    }
+    calculateConfidence(webcrackResult, readabilityScore) {
+        let confidence = 0.7;
+        confidence += readabilityScore / 500;
+        if (webcrackResult.bundle) {
+            confidence += 0.1;
         }
-        catch (error) {
-            logger.warn('Basic transform failed, returning original code', error);
-            transformations.push({
-                type: 'basic-ast-transform',
-                description: 'Failed to apply AST transformations',
-                success: false,
-            });
-            return code;
+        if (webcrackResult.savedTo) {
+            confidence += 0.05;
         }
+        return Math.min(confidence, 0.99);
     }
-    async decodeStrings(code, transformations) {
-        try {
-            const ast = parser.parse(code, {
-                sourceType: 'module',
-                plugins: ['jsx', 'typescript'],
-            });
-            let decoded = 0;
-            traverse(ast, {
-                StringLiteral(path) {
-                    const value = path.node.value;
-                    if (value.includes('\\x')) {
-                        try {
-                            const decodedValue = value.replace(/\\x([0-9A-Fa-f]{2})/g, (_, hex) => {
-                                return String.fromCharCode(parseInt(hex, 16));
-                            });
-                            path.node.value = decodedValue;
-                            decoded++;
-                        }
-                        catch { }
-                    }
-                    if (value.includes('\\u')) {
-                        try {
-                            const decodedValue = value.replace(/\\u([0-9A-Fa-f]{4})/g, (_, hex) => {
-                                return String.fromCharCode(parseInt(hex, 16));
-                            });
-                            path.node.value = decodedValue;
-                            decoded++;
-                        }
-                        catch { }
-                    }
-                },
-            });
-            if (decoded > 0) {
-                const output = generate(ast, { comments: true, compact: false });
-                transformations.push({
-                    type: 'string-decode',
-                    description: `Decoded ${decoded} strings`,
-                    success: true,
-                });
-                return output.code;
-            }
-            return code;
+    buildAnalysis(webcrackResult, obfuscationType) {
+        const parts = [`webcrack completed deobfuscation for detected types: ${obfuscationType.join(', ')}.`];
+        if (webcrackResult.bundle) {
+            parts.push(`Recovered a ${webcrackResult.bundle.type} bundle with ${webcrackResult.bundle.moduleCount} modules.`);
         }
-        catch (error) {
-            logger.warn('String decoding failed', error);
-            transformations.push({
-                type: 'string-decode',
-                description: 'Failed to decode strings',
-                success: false,
-            });
-            return code;
+        if (webcrackResult.savedTo) {
+            parts.push(`Artifacts saved to ${webcrackResult.savedTo}.`);
         }
+        return parts.join(' ');
     }
     async llmAnalysis(code) {
         if (!this.llm)
             return null;
         try {
             const messages = generateDeobfuscationPrompt(code);
-            const response = await this.llm.chat(messages, { temperature: 0.3, maxTokens: DEOBF_LLM_MAX_TOKENS });
+            const response = await this.llm.chat(messages, {
+                temperature: 0.3,
+                maxTokens: DEOBF_LLM_MAX_TOKENS,
+            });
             return response.content;
         }
         catch (error) {
-            logger.warn('LLM analysis failed', error);
+            logger.warn('LLM analysis failed after webcrack deobfuscation', error);
             return null;
         }
     }
-    calculateConfidence(transformations, readabilityScore) {
-        const successCount = transformations.filter((t) => t.success).length;
-        const totalCount = transformations.length || 1;
-        const transformConfidence = successCount / totalCount;
-        const readabilityConfidence = readabilityScore / 100;
-        const confidence = transformConfidence * 0.6 + readabilityConfidence * 0.4;
-        return Math.min(Math.max(confidence, 0), 1);
-    }
-    async extractStringArrays(code, transformations) {
-        try {
-            const ast = parser.parse(code, {
-                sourceType: 'module',
-                plugins: ['jsx', 'typescript'],
-            });
-            let extracted = 0;
-            traverse(ast, {
-                VariableDeclarator: (path) => {
-                    if (t.isIdentifier(path.node.id) &&
-                        path.node.id.name.startsWith('_0x') &&
-                        t.isArrayExpression(path.node.init)) {
-                        const arrayName = path.node.id.name;
-                        const strings = [];
-                        path.node.init.elements.forEach((element) => {
-                            if (t.isStringLiteral(element)) {
-                                strings.push(element.value);
-                            }
-                        });
-                        if (strings.length > 0) {
-                            this.stringArrays.set(arrayName, strings);
-                            extracted++;
-                            logger.debug(`Extracted string array: ${arrayName} (${strings.length} strings)`);
-                        }
-                    }
-                },
-            });
-            if (extracted > 0) {
-                transformations.push({
-                    type: 'extract-string-arrays',
-                    description: `Extracted ${extracted} string arrays`,
-                    success: true,
-                });
-            }
-            return code;
-        }
-        catch (error) {
-            logger.warn('String array extraction failed', error);
-            transformations.push({
-                type: 'extract-string-arrays',
-                description: 'Failed to extract string arrays',
-                success: false,
-            });
-            return code;
-        }
-    }
-    async decryptArrays(code, transformations) {
-        if (this.stringArrays.size === 0) {
-            return code;
-        }
-        const self = this;
-        try {
-            const ast = parser.parse(code, {
-                sourceType: 'module',
-                plugins: ['jsx', 'typescript'],
-            });
-            let replaced = 0;
-            traverse(ast, {
-                MemberExpression(path) {
-                    if (t.isIdentifier(path.node.object) &&
-                        t.isNumericLiteral(path.node.property) &&
-                        path.node.object.name.startsWith('_0x')) {
-                        const arrayName = path.node.object.name;
-                        const index = path.node.property.value;
-                        const stringArray = self.stringArrays.get(arrayName);
-                        if (stringArray && index >= 0 && index < stringArray.length) {
-                            const value = stringArray[index];
-                            if (value !== undefined) {
-                                path.replaceWith(t.stringLiteral(value));
-                                replaced++;
-                            }
-                        }
-                    }
-                },
-            });
-            if (replaced > 0) {
-                const output = generate(ast, { comments: true, compact: false });
-                transformations.push({
-                    type: 'decrypt-arrays',
-                    description: `Replaced ${replaced} array references`,
-                    success: true,
-                });
-                return output.code;
-            }
-            return code;
-        }
-        catch (error) {
-            logger.warn('Array decryption failed', error);
-            transformations.push({
-                type: 'decrypt-arrays',
-                description: 'Failed to decrypt arrays',
-                success: false,
-            });
-            return code;
-        }
-    }
-    async unflattenControlFlow(code, transformations) {
-        try {
-            const ast = parser.parse(code, {
-                sourceType: 'module',
-                plugins: ['jsx', 'typescript'],
-            });
-            let unflattened = 0;
-            traverse(ast, {
-                WhileStatement(path) {
-                    if (t.isSwitchStatement(path.node.body) ||
-                        (t.isBlockStatement(path.node.body) &&
-                            path.node.body.body.length === 1 &&
-                            t.isSwitchStatement(path.node.body.body[0]))) {
-                        logger.debug('Found control flow flattening pattern');
-                        unflattened++;
-                    }
-                },
-            });
-            if (unflattened > 0) {
-                transformations.push({
-                    type: 'unflatten-control-flow',
-                    description: `Unflattened ${unflattened} control flow patterns`,
-                    success: true,
-                });
-            }
-            return code;
-        }
-        catch (error) {
-            logger.warn('Control flow unflattening failed', error);
-            transformations.push({
-                type: 'unflatten-control-flow',
-                description: 'Failed to unflatten control flow',
-                success: false,
-            });
-            return code;
-        }
-    }
-    async simplifyExpressions(code, transformations) {
-        try {
-            const ast = parser.parse(code, {
-                sourceType: 'module',
-                plugins: ['jsx', 'typescript'],
-            });
-            let simplified = 0;
-            traverse(ast, {
-                UnaryExpression(path) {
-                    if (path.node.operator === '!' &&
-                        t.isUnaryExpression(path.node.argument) &&
-                        path.node.argument.operator === '!') {
-                        path.replaceWith(path.node.argument.argument);
-                        simplified++;
-                    }
-                    else if (path.node.operator === 'void' &&
-                        t.isNumericLiteral(path.node.argument, { value: 0 })) {
-                        path.replaceWith(t.identifier('undefined'));
-                        simplified++;
-                    }
-                },
-            });
-            if (simplified > 0) {
-                const output = generate(ast, { comments: true, compact: false });
-                transformations.push({
-                    type: 'simplify-expressions',
-                    description: `Simplified ${simplified} expressions`,
-                    success: true,
-                });
-                return output.code;
-            }
-            return code;
-        }
-        catch (error) {
-            logger.warn('Expression simplification failed', error);
-            transformations.push({
-                type: 'simplify-expressions',
-                description: 'Failed to simplify expressions',
-                success: false,
-            });
-            return code;
-        }
-    }
-    async renameVariables(code, transformations) {
-        try {
-            const ast = parser.parse(code, {
-                sourceType: 'module',
-                plugins: ['jsx', 'typescript'],
-            });
-            let renamed = 0;
-            const renameMap = new Map();
-            traverse(ast, {
-                VariableDeclarator(path) {
-                    if (t.isIdentifier(path.node.id) && path.node.id.name.startsWith('_0x')) {
-                        const oldName = path.node.id.name;
-                        const newName = `var_${renamed}`;
-                        renameMap.set(oldName, newName);
-                        path.node.id.name = newName;
-                        renamed++;
-                    }
-                },
-                Identifier(path) {
-                    if (renameMap.has(path.node.name)) {
-                        path.node.name = renameMap.get(path.node.name);
-                    }
-                },
-            });
-            if (renamed > 0) {
-                const output = generate(ast, { comments: true, compact: false });
-                transformations.push({
-                    type: 'rename-variables',
-                    description: `Renamed ${renamed} variables`,
-                    success: true,
-                });
-                return output.code;
-            }
-            return code;
-        }
-        catch (error) {
-            logger.warn('Variable renaming failed', error);
-            transformations.push({
-                type: 'rename-variables',
-                description: 'Failed to rename variables',
-                success: false,
-            });
-            return code;
-        }
-    }
-    calculateReadabilityScore(code) {
-        return calculateReadabilityScoreUtil(code);
-    }
 }

package/dist/modules/deobfuscator/webcrack.d.ts

@@ -0,0 +1,13 @@
+import type { DeobfuscateBundleSummary, DeobfuscateOptions, DeobfuscateSavedArtifact } from '../../types/deobfuscator.js';
+type WebcrackInvocationOptions = Pick<DeobfuscateOptions, 'forceOutput' | 'includeModuleCode' | 'jsx' | 'mangle' | 'mappings' | 'maxBundleModules' | 'outputDir' | 'unminify' | 'unpack'>;
+export interface WebcrackExecutionResult {
+    applied: boolean;
+    code: string;
+    bundle?: DeobfuscateBundleSummary;
+    savedTo?: string;
+    savedArtifacts?: DeobfuscateSavedArtifact[];
+    optionsUsed: Required<Pick<DeobfuscateOptions, 'jsx' | 'mangle' | 'unminify' | 'unpack'>>;
+    reason?: string;
+}
+export declare function runWebcrack(code: string, options: WebcrackInvocationOptions): Promise<WebcrackExecutionResult>;
+export {};