@jshookmcp/jshook 0.1.7 → 0.1.8

package/dist/modules/deobfuscator/webcrack.js

@@ -0,0 +1,164 @@
+import { readdir, rm, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { logger } from '../../utils/logger.js';
+const DEFAULT_OPTIONS = {
+    jsx: true,
+    mangle: false,
+    unminify: true,
+    unpack: true,
+};
+const MAX_BUNDLE_MODULES = 100;
+function normalizeOptions(options) {
+    return {
+        jsx: options.jsx ?? DEFAULT_OPTIONS.jsx,
+        mangle: options.mangle ?? DEFAULT_OPTIONS.mangle,
+        unminify: options.unminify ?? DEFAULT_OPTIONS.unminify,
+        unpack: options.unpack ?? DEFAULT_OPTIONS.unpack,
+    };
+}
+function isSupportedNodeVersion() {
+    const major = Number.parseInt(process.versions.node.split('.')[0] ?? '0', 10);
+    return Number.isFinite(major) && major >= 22;
+}
+function matchesRule(module, rule) {
+    const target = rule.target === 'path' ? module.path : module.code;
+    const matchType = rule.matchType ?? 'includes';
+    if (matchType === 'exact') {
+        return target === rule.pattern;
+    }
+    if (matchType === 'regex') {
+        try {
+            return new RegExp(rule.pattern, 'm').test(target);
+        }
+        catch {
+            return false;
+        }
+    }
+    return target.includes(rule.pattern);
+}
+function applyBundleMappings(bundle, mappings) {
+    const remapped = new Map();
+    if (!mappings || mappings.length === 0) {
+        return remapped;
+    }
+    for (const module of bundle.modules.values()) {
+        for (const rule of mappings) {
+            if (!rule.path || !rule.pattern) {
+                continue;
+            }
+            if (matchesRule(module, rule)) {
+                if (module.path !== rule.path) {
+                    remapped.set(module.id, { fromPath: module.path });
+                    module.path = rule.path;
+                }
+                break;
+            }
+        }
+    }
+    return remapped;
+}
+function summarizeBundle(bundle, options, remapped) {
+    const maxBundleModules = options.maxBundleModules ?? MAX_BUNDLE_MODULES;
+    const modules = Array.from(bundle.modules.values())
+        .sort((left, right) => {
+        if (left.isEntry !== right.isEntry) {
+            return left.isEntry ? -1 : 1;
+        }
+        return left.path.localeCompare(right.path);
+    })
+        .slice(0, maxBundleModules)
+        .map((module) => ({
+        id: module.id,
+        path: module.path,
+        isEntry: module.isEntry,
+        size: module.code.length,
+        code: options.includeModuleCode ? module.code : undefined,
+        mappedPathFrom: remapped.get(module.id)?.fromPath,
+    }));
+    return {
+        type: bundle.type,
+        entryId: bundle.entryId,
+        moduleCount: bundle.modules.size,
+        truncated: bundle.modules.size > maxBundleModules,
+        mappingsApplied: remapped.size,
+        modules,
+    };
+}
+async function collectSavedArtifacts(rootDir, currentDir = rootDir) {
+    const entries = await readdir(currentDir, { withFileTypes: true });
+    const artifacts = [];
+    for (const entry of entries) {
+        const fullPath = path.join(currentDir, entry.name);
+        if (entry.isDirectory()) {
+            artifacts.push(...(await collectSavedArtifacts(rootDir, fullPath)));
+            continue;
+        }
+        if (!entry.isFile()) {
+            continue;
+        }
+        const metadata = await stat(fullPath);
+        artifacts.push({
+            path: path.relative(rootDir, fullPath).replace(/\\/g, '/'),
+            size: metadata.size,
+            type: 'file',
+        });
+    }
+    return artifacts.sort((left, right) => left.path.localeCompare(right.path));
+}
+export async function runWebcrack(code, options) {
+    const optionsUsed = normalizeOptions(options);
+    if (!isSupportedNodeVersion()) {
+        const reason = `webcrack requires Node.js 22+; current runtime is ${process.versions.node}`;
+        logger.warn(reason);
+        return {
+            applied: false,
+            code,
+            optionsUsed,
+            reason,
+        };
+    }
+    try {
+        const { webcrack } = (await import('webcrack'));
+        const result = await webcrack(code, {
+            jsx: optionsUsed.jsx,
+            unpack: optionsUsed.unpack,
+            deobfuscate: true,
+            unminify: optionsUsed.unminify,
+            mangle: optionsUsed.mangle,
+        });
+        const remapped = result.bundle ? applyBundleMappings(result.bundle, options.mappings) : new Map();
+        let savedTo;
+        let savedArtifacts;
+        if (typeof options.outputDir === 'string' && options.outputDir.trim().length > 0) {
+            savedTo = path.resolve(options.outputDir);
+            if (options.forceOutput) {
+                await rm(savedTo, { recursive: true, force: true });
+            }
+            await result.save(savedTo);
+            savedArtifacts = await collectSavedArtifacts(savedTo);
+        }
+        return {
+            applied: true,
+            code: result.code,
+            bundle: result.bundle
+                ? summarizeBundle(result.bundle, {
+                    includeModuleCode: options.includeModuleCode,
+                    maxBundleModules: options.maxBundleModules,
+                }, remapped)
+                : undefined,
+            savedTo,
+            savedArtifacts,
+            optionsUsed,
+        };
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        logger.warn('webcrack execution failed, falling back to legacy pipeline', error);
+        return {
+            applied: false,
+            code,
+            optionsUsed,
+            reason,
+        };
+    }
+}

package/dist/modules/detector/ObfuscationDetector.d.ts

@@ -4,12 +4,18 @@ export interface DetectionResult {
     confidence: Record<ObfuscationType, number>;
     features: string[];
     recommendations: string[];
+    toolRecommendations: Array<{
+        tool: string;
+        reason: string;
+        suggestedArgs?: Record<string, unknown>;
+    }>;
     vmFeatures?: VMFeatures;
 }
 export declare class ObfuscationDetector {
     private jsvmpDetector;
     constructor();
     detect(code: string): DetectionResult;
+    private buildToolRecommendations;
     private detectVMProtectionDetailed;
     private detectJavaScriptObfuscator;
     private detectWebpack;

package/dist/modules/detector/ObfuscationDetector.js

@@ -16,13 +16,13 @@ export class ObfuscationDetector {
             confidence['javascript-obfuscator'] = 0.9;
             features.push('String array with rotation');
             features.push('Control flow flattening');
-            recommendations.push('Use webcrack or restringer for deobfuscation');
+            recommendations.push('Use deobfuscate/advanced_deobfuscate with webcrack enabled');
         }
         if (this.detectWebpack(code)) {
             types.push('webpack');
             confidence['webpack'] = 0.85;
             features.push('__webpack_require__');
-            recommendations.push('Use webpack-bundle-analyzer');
+            recommendations.push('Use deobfuscate/advanced_deobfuscate with unpack=true to recover modules');
         }
         if (this.detectUglify(code)) {
             types.push('uglify');
@@ -140,9 +140,51 @@ export class ObfuscationDetector {
             confidence: confidence,
             features,
             recommendations,
+            toolRecommendations: this.buildToolRecommendations(types, code),
             vmFeatures,
         };
     }
+    buildToolRecommendations(types, code) {
+        const recommendations = new Map();
+        const addRecommendation = (tool, reason, suggestedArgs) => {
+            if (!recommendations.has(tool)) {
+                recommendations.set(tool, { tool, reason, suggestedArgs });
+            }
+        };
+        if (types.includes('webpack') || types.includes('packer')) {
+            addRecommendation('webcrack_unpack', 'Bundle or wrapper markers detected; unpacking modules is likely the highest-value first step.', { code, unpack: true, unminify: true });
+        }
+        if (types.some((type) => [
+            'javascript-obfuscator',
+            'string-array-rotation',
+            'hex-encoding',
+            'base64-encoding',
+            'urlencoded',
+            'unknown',
+        ].includes(type))) {
+            addRecommendation('deobfuscate', 'Static cleanup is likely sufficient; start with the standard webcrack-backed deobfuscation path.', { code, unminify: true });
+        }
+        if (types.some((type) => [
+            'vm-protection',
+            'control-flow-flattening',
+            'dead-code-injection',
+            'opaque-predicates',
+            'invisible-unicode',
+            'jscrambler',
+            'jsfuck',
+            'aaencode',
+            'jjencode',
+        ].includes(type))) {
+            addRecommendation('advanced_deobfuscate', 'Complex protections detected; use the advanced webcrack-backed flow for deeper cleanup.', { code, detectOnly: false, unminify: true });
+        }
+        if (types.includes('eval-obfuscation') || types.includes('self-modifying')) {
+            addRecommendation('manage_hooks', 'Runtime-generated code is present; capture or hook execution points before static cleanup if analysis stalls.', { action: 'create', target: 'eval', type: 'function' });
+        }
+        if (recommendations.size === 0) {
+            addRecommendation('deobfuscate', 'No strong signature matched; start with the standard webcrack-backed path.', { code });
+        }
+        return Array.from(recommendations.values());
+    }
     detectVMProtectionDetailed(code) {
         try {
             const detector = this.jsvmpDetector;
@@ -273,6 +315,15 @@ export class ObfuscationDetector {
         result.recommendations.forEach((rec) => {
             report += `  - ${rec}\n`;
         });
+        if (result.toolRecommendations.length > 0) {
+            report += `\nSuggested Tools:\n`;
+            result.toolRecommendations.forEach((item) => {
+                report += `  - ${item.tool}: ${item.reason}\n`;
+                if (item.suggestedArgs) {
+                    report += `    args: ${JSON.stringify(item.suggestedArgs)}\n`;
+                }
+            });
+        }
         return report;
     }
 }

package/dist/modules/hook/AIHookGenerator.js

@@ -61,7 +61,7 @@ export class AIHookGenerator {
     generateFunctionHook(request, hookId) {
         const { target, behavior, condition, customCode } = request;
         const functionName = target.name || target.pattern || 'unknownFunction';
-        let code = `
+        const code = `
 (function() {
   const originalFunction = window.${functionName};
   

package/dist/modules/process/memory/writer.js

@@ -149,7 +149,7 @@ export async function writeMemory(platform, pid, address, data, encoding = 'hex'
                 buffer = Buffer.from(cleanHex, 'hex');
             }
         }
-        catch (e) {
+        catch (_e) {
             return { success: false, error: `Invalid ${encoding} data` };
         }
         if (platform === 'win32' && isKoffiAvailable()) {

package/dist/server/domains/analysis/definitions.js

@@ -138,7 +138,7 @@ export const coreTools = [
     },
     {
         name: 'deobfuscate',
-        description: 'Run LLM-assisted JavaScript deobfuscation.',
+        description: 'Run webcrack-powered JavaScript deobfuscation with bundle unpacking support.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -157,6 +157,75 @@ export const coreTools = [
                     description: 'Enable aggressive deobfuscation strategy',
                     default: false,
                 },
+                unpack: {
+                    type: 'boolean',
+                    description: 'Use webcrack to unpack webpack/browserify bundles when possible',
+                    default: true,
+                },
+                unminify: {
+                    type: 'boolean',
+                    description: 'Use webcrack to reformat and unminify code before post-processing',
+                    default: true,
+                },
+                jsx: {
+                    type: 'boolean',
+                    description: 'Ask webcrack to decompile React.createElement trees back to JSX when supported',
+                    default: true,
+                },
+                mangle: {
+                    type: 'boolean',
+                    description: 'Rename obfuscated identifiers using webcrack mangle pass',
+                    default: false,
+                },
+                outputDir: {
+                    type: 'string',
+                    description: 'Optional directory where webcrack should save the deobfuscated code and extracted bundle',
+                },
+                forceOutput: {
+                    type: 'boolean',
+                    description: 'Remove outputDir before saving webcrack artifacts',
+                    default: false,
+                },
+                includeModuleCode: {
+                    type: 'boolean',
+                    description: 'Include unpacked module source in bundle output when returning bundle details',
+                    default: false,
+                },
+                maxBundleModules: {
+                    type: 'number',
+                    description: 'Maximum number of bundle modules to return in the response',
+                    default: 100,
+                },
+                mappings: {
+                    type: 'array',
+                    description: 'Optional remapping rules applied to unpacked bundle module paths. Each rule can match against module code or current path.',
+                    items: {
+                        type: 'object',
+                        properties: {
+                            path: {
+                                type: 'string',
+                                description: 'New module path to assign when the rule matches',
+                            },
+                            pattern: {
+                                type: 'string',
+                                description: 'Text or regex used to match module code/path',
+                            },
+                            matchType: {
+                                type: 'string',
+                                enum: ['includes', 'regex', 'exact'],
+                                description: 'How to interpret pattern',
+                                default: 'includes',
+                            },
+                            target: {
+                                type: 'string',
+                                enum: ['code', 'path'],
+                                description: 'Whether to match against module source code or the current module path',
+                                default: 'code',
+                            },
+                        },
+                        required: ['path', 'pattern'],
+                    },
+                },
             },
             required: ['code'],
         },
@@ -258,7 +327,7 @@ export const coreTools = [
     },
     {
         name: 'advanced_deobfuscate',
-        description: 'Run advanced deobfuscation with VM-oriented strategies.',
+        description: 'Run advanced deobfuscation with webcrack backend (deprecated legacy flags ignored).',
         inputSchema: {
             type: 'object',
             properties: {
@@ -286,6 +355,158 @@ export const coreTools = [
                     description: 'Operation timeout in milliseconds',
                     default: 60000,
                 },
+                unpack: {
+                    type: 'boolean',
+                    description: 'Use webcrack to unpack webpack/browserify bundles before advanced cleanup',
+                    default: true,
+                },
+                unminify: {
+                    type: 'boolean',
+                    description: 'Use webcrack unminify pass before VM and AST-oriented cleanup',
+                    default: true,
+                },
+                jsx: {
+                    type: 'boolean',
+                    description: 'Allow webcrack to decompile React.createElement back to JSX when supported',
+                    default: true,
+                },
+                mangle: {
+                    type: 'boolean',
+                    description: 'Rename obfuscated identifiers during the webcrack phase',
+                    default: false,
+                },
+                outputDir: {
+                    type: 'string',
+                    description: 'Optional directory where webcrack should save the deobfuscated code and extracted bundle',
+                },
+                forceOutput: {
+                    type: 'boolean',
+                    description: 'Remove outputDir before saving webcrack artifacts',
+                    default: false,
+                },
+                includeModuleCode: {
+                    type: 'boolean',
+                    description: 'Include unpacked module source in bundle output when returning bundle details',
+                    default: false,
+                },
+                maxBundleModules: {
+                    type: 'number',
+                    description: 'Maximum number of bundle modules to return in the response',
+                    default: 100,
+                },
+                mappings: {
+                    type: 'array',
+                    description: 'Optional remapping rules applied to unpacked bundle module paths. Each rule can match against module code or current path.',
+                    items: {
+                        type: 'object',
+                        properties: {
+                            path: {
+                                type: 'string',
+                                description: 'New module path to assign when the rule matches',
+                            },
+                            pattern: {
+                                type: 'string',
+                                description: 'Text or regex used to match module code/path',
+                            },
+                            matchType: {
+                                type: 'string',
+                                enum: ['includes', 'regex', 'exact'],
+                                description: 'How to interpret pattern',
+                                default: 'includes',
+                            },
+                            target: {
+                                type: 'string',
+                                enum: ['code', 'path'],
+                                description: 'Whether to match against module source code or the current module path',
+                                default: 'code',
+                            },
+                        },
+                        required: ['path', 'pattern'],
+                    },
+                },
+            },
+            required: ['code'],
+        },
+    },
+    {
+        name: 'webcrack_unpack',
+        description: 'Run webcrack bundle unpacking directly and return extracted module graph details.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                code: {
+                    type: 'string',
+                    description: 'Bundled or obfuscated JavaScript source',
+                },
+                unpack: {
+                    type: 'boolean',
+                    description: 'Extract modules from the bundle when supported',
+                    default: true,
+                },
+                unminify: {
+                    type: 'boolean',
+                    description: 'Unminify the code before extracting bundle modules',
+                    default: true,
+                },
+                jsx: {
+                    type: 'boolean',
+                    description: 'Decompile React.createElement trees back to JSX when supported',
+                    default: true,
+                },
+                mangle: {
+                    type: 'boolean',
+                    description: 'Rename obfuscated identifiers during the webcrack pass',
+                    default: false,
+                },
+                outputDir: {
+                    type: 'string',
+                    description: 'Optional directory where webcrack should save the extracted bundle files',
+                },
+                forceOutput: {
+                    type: 'boolean',
+                    description: 'Remove outputDir before saving webcrack artifacts',
+                    default: false,
+                },
+                includeModuleCode: {
+                    type: 'boolean',
+                    description: 'Include unpacked module source in bundle output',
+                    default: false,
+                },
+                maxBundleModules: {
+                    type: 'number',
+                    description: 'Maximum number of bundle modules to return in the response',
+                    default: 100,
+                },
+                mappings: {
+                    type: 'array',
+                    description: 'Optional remapping rules applied to unpacked bundle module paths. Each rule can match against module code or current path.',
+                    items: {
+                        type: 'object',
+                        properties: {
+                            path: {
+                                type: 'string',
+                                description: 'New module path to assign when the rule matches',
+                            },
+                            pattern: {
+                                type: 'string',
+                                description: 'Text or regex used to match module code/path',
+                            },
+                            matchType: {
+                                type: 'string',
+                                enum: ['includes', 'regex', 'exact'],
+                                description: 'How to interpret pattern',
+                                default: 'includes',
+                            },
+                            target: {
+                                type: 'string',
+                                enum: ['code', 'path'],
+                                description: 'Whether to match against module source code or the current module path',
+                                default: 'code',
+                            },
+                        },
+                        required: ['path', 'pattern'],
+                    },
+                },
             },
             required: ['code'],
         },

package/dist/server/domains/analysis/handlers.impl.d.ts

@@ -3,7 +3,6 @@ import { CodeCollector } from '../../domains/shared/modules.js';
 import { ScriptManager } from '../../domains/shared/modules.js';
 import { Deobfuscator } from '../../domains/shared/modules.js';
 import { AdvancedDeobfuscator } from '../../domains/shared/modules.js';
-import { ASTOptimizer } from '../../domains/shared/modules.js';
 import { ObfuscationDetector } from '../../domains/shared/modules.js';
 import { CodeAnalyzer } from '../../domains/shared/modules.js';
 import { CryptoDetector } from '../../domains/shared/modules.js';
@@ -13,7 +12,6 @@ interface CoreAnalysisHandlerDeps {
     scriptManager: ScriptManager;
     deobfuscator: Deobfuscator;
     advancedDeobfuscator: AdvancedDeobfuscator;
-    astOptimizer: ASTOptimizer;
     obfuscationDetector: ObfuscationDetector;
     analyzer: CodeAnalyzer;
     cryptoDetector: CryptoDetector;
@@ -24,13 +22,13 @@ export declare class CoreAnalysisHandlers {
     private readonly scriptManager;
     private readonly deobfuscator;
     private readonly advancedDeobfuscator;
-    private readonly astOptimizer;
     private readonly obfuscationDetector;
     private readonly analyzer;
     private readonly cryptoDetector;
     private readonly hookManager;
     constructor(deps: CoreAnalysisHandlerDeps);
     private requireCodeArg;
+    private extractWebcrackArgs;
     handleCollectCode(args: ToolArgs): Promise<ToolResponse>;
     handleSearchInScripts(args: ToolArgs): Promise<ToolResponse>;
     handleExtractFunctionTree(args: ToolArgs): Promise<ToolResponse>;
@@ -40,6 +38,7 @@ export declare class CoreAnalysisHandlers {
     handleManageHooks(args: ToolArgs): Promise<ToolResponse>;
     handleDetectObfuscation(args: ToolArgs): Promise<ToolResponse>;
     handleAdvancedDeobfuscate(args: ToolArgs): Promise<ToolResponse>;
+    handleWebcrackUnpack(args: ToolArgs): Promise<ToolResponse>;
     handleWebpackEnumerate(args: ToolArgs): Promise<ToolResponse>;
     handleSourceMapExtract(args: ToolArgs): Promise<ToolResponse>;
     handleClearCollectedData(): Promise<ToolResponse>;