@jshookmcp/jshook 0.1.8 → 0.1.9

package/dist/src/modules/collector/PageController.js

@@ -0,0 +1,306 @@
+import { logger } from '../../utils/logger.js';
+export class PageController {
+    collector;
+    constructor(collector) {
+        this.collector = collector;
+    }
+    async navigate(url, options) {
+        const page = await this.collector.getActivePage();
+        const startTime = Date.now();
+        await page.goto(url, {
+            waitUntil: options?.waitUntil || 'networkidle2',
+            timeout: options?.timeout || 30000,
+        });
+        const loadTime = Date.now() - startTime;
+        const title = await page.title();
+        const currentUrl = page.url();
+        logger.info(`Navigated to: ${url}`);
+        return {
+            url: currentUrl,
+            title,
+            loadTime,
+        };
+    }
+    async reload(options) {
+        const page = await this.collector.getActivePage();
+        await page.reload({
+            waitUntil: options?.waitUntil || 'networkidle2',
+            timeout: options?.timeout || 30000,
+        });
+        logger.info('Page reloaded');
+    }
+    async goBack() {
+        const page = await this.collector.getActivePage();
+        await page.goBack();
+        logger.info('Navigated back');
+    }
+    async goForward() {
+        const page = await this.collector.getActivePage();
+        await page.goForward();
+        logger.info('Navigated forward');
+    }
+    async click(selector, options) {
+        const page = await this.collector.getActivePage();
+        await page.click(selector, {
+            button: options?.button || 'left',
+            clickCount: options?.clickCount || 1,
+            delay: options?.delay,
+        });
+        logger.info(`Clicked: ${selector}`);
+    }
+    async type(selector, text, options) {
+        const page = await this.collector.getActivePage();
+        await page.type(selector, text, {
+            delay: options?.delay,
+        });
+        logger.info(`Typed into ${selector}: ${text.substring(0, 20)}...`);
+    }
+    async select(selector, ...values) {
+        const page = await this.collector.getActivePage();
+        await page.select(selector, ...values);
+        logger.info(`Selected in ${selector}: ${values.join(', ')}`);
+    }
+    async hover(selector) {
+        const page = await this.collector.getActivePage();
+        await page.hover(selector);
+        logger.info(`Hovered: ${selector}`);
+    }
+    async scroll(options) {
+        const page = await this.collector.getActivePage();
+        await page.evaluate((opts) => {
+            window.scrollTo(opts.x || 0, opts.y || 0);
+        }, options);
+        logger.info(`Scrolled to: x=${options.x || 0}, y=${options.y || 0}`);
+    }
+    async waitForSelector(selector, timeout) {
+        try {
+            const page = await this.collector.getActivePage();
+            await page.waitForSelector(selector, {
+                timeout: timeout || 30000,
+            });
+            const element = await page.evaluate((sel) => {
+                const el = document.querySelector(sel);
+                if (!el)
+                    return null;
+                return {
+                    tagName: el.tagName.toLowerCase(),
+                    id: el.id || undefined,
+                    className: el.className || undefined,
+                    textContent: el.textContent?.trim().substring(0, 100) || undefined,
+                    attributes: Array.from(el.attributes).reduce((acc, attr) => {
+                        acc[attr.name] = attr.value;
+                        return acc;
+                    }, {}),
+                };
+            }, selector);
+            logger.info(`Selector appeared: ${selector}`);
+            return {
+                success: true,
+                element,
+                message: `Selector appeared: ${selector}`,
+            };
+        }
+        catch (error) {
+            logger.error(`waitForSelector timeout for ${selector}:`, error);
+            return {
+                success: false,
+                message: `Timeout waiting for selector: ${selector}`,
+            };
+        }
+    }
+    async waitForNavigation(timeout) {
+        const page = await this.collector.getActivePage();
+        await page.waitForNavigation({
+            waitUntil: 'networkidle2',
+            timeout: timeout || 30000,
+        });
+        logger.info('Navigation completed');
+    }
+    async evaluate(code) {
+        const page = await this.collector.getActivePage();
+        const result = await page.evaluate(code);
+        logger.info('JavaScript executed');
+        return result;
+    }
+    async getURL() {
+        const page = await this.collector.getActivePage();
+        return page.url();
+    }
+    async getTitle() {
+        const page = await this.collector.getActivePage();
+        return await page.title();
+    }
+    async getContent() {
+        const page = await this.collector.getActivePage();
+        return await page.content();
+    }
+    async screenshot(options) {
+        const page = await this.collector.getActivePage();
+        const screenshotOpts = {
+            path: options?.path,
+            type: options?.type || 'png',
+            quality: options?.quality,
+            fullPage: options?.fullPage || false,
+        };
+        if (options?.clip) {
+            screenshotOpts.clip = options.clip;
+            screenshotOpts.fullPage = false;
+        }
+        const buffer = await page.screenshot(screenshotOpts);
+        logger.info(`Screenshot taken${options?.path ? `: ${options.path}` : ''}`);
+        return buffer;
+    }
+    async getPerformanceMetrics() {
+        const page = await this.collector.getActivePage();
+        const metrics = await page.evaluate(() => {
+            const perf = performance.getEntriesByType('navigation')[0];
+            return {
+                domContentLoaded: perf.domContentLoadedEventEnd - perf.domContentLoadedEventStart,
+                loadComplete: perf.loadEventEnd - perf.loadEventStart,
+                dns: perf.domainLookupEnd - perf.domainLookupStart,
+                tcp: perf.connectEnd - perf.connectStart,
+                request: perf.responseStart - perf.requestStart,
+                response: perf.responseEnd - perf.responseStart,
+                total: perf.loadEventEnd - perf.fetchStart,
+                resources: performance.getEntriesByType('resource').length,
+            };
+        });
+        logger.info('Performance metrics retrieved');
+        return metrics;
+    }
+    async injectScript(scriptContent) {
+        const page = await this.collector.getActivePage();
+        await page.evaluate((script) => {
+            const scriptElement = document.createElement('script');
+            scriptElement.textContent = script;
+            document.head.appendChild(scriptElement);
+        }, scriptContent);
+        logger.info('Script injected into page');
+    }
+    async setCookies(cookies) {
+        const page = await this.collector.getActivePage();
+        await page.setCookie(...cookies);
+        logger.info(`Set ${cookies.length} cookies`);
+    }
+    async getCookies() {
+        const page = await this.collector.getActivePage();
+        const cookies = await page.cookies();
+        logger.info(`Retrieved ${cookies.length} cookies`);
+        return cookies;
+    }
+    async clearCookies() {
+        const page = await this.collector.getActivePage();
+        const cookies = await page.cookies();
+        await page.deleteCookie(...cookies);
+        logger.info('All cookies cleared');
+    }
+    async setViewport(width, height) {
+        const page = await this.collector.getActivePage();
+        await page.setViewport({ width, height });
+        logger.info(`Viewport set to ${width}x${height}`);
+    }
+    async emulateDevice(deviceName) {
+        const page = await this.collector.getActivePage();
+        const devices = {
+            iPhone: {
+                viewport: { width: 375, height: 812, isMobile: true },
+                userAgent: 'Mozilla/5.0 (iPhone; CPU iPhone OS 14_0 like Mac OS X) AppleWebKit/605.1.15',
+            },
+            iPad: {
+                viewport: { width: 768, height: 1024, isMobile: true },
+                userAgent: 'Mozilla/5.0 (iPad; CPU OS 14_0 like Mac OS X) AppleWebKit/605.1.15',
+            },
+            Android: {
+                viewport: { width: 360, height: 640, isMobile: true },
+                userAgent: 'Mozilla/5.0 (Linux; Android 10) AppleWebKit/537.36 Chrome/91.0.4472.120',
+            },
+        };
+        const normalized = String(deviceName || '').trim().toLowerCase();
+        let resolvedDevice = null;
+        if (normalized.includes('iphone')) {
+            resolvedDevice = 'iPhone';
+        }
+        else if (normalized.includes('ipad')) {
+            resolvedDevice = 'iPad';
+        }
+        else if (normalized.includes('android') || normalized.includes('pixel')) {
+            resolvedDevice = 'Android';
+        }
+        if (!resolvedDevice) {
+            throw new Error(`Unsupported device "${deviceName}". Supported values include: iPhone, iPad, Android (aliases like "iPhone 13" are accepted).`);
+        }
+        const device = devices[resolvedDevice];
+        await page.setViewport(device.viewport);
+        await page.setUserAgent(device.userAgent);
+        logger.info(`Emulating ${resolvedDevice} (input: ${deviceName})`);
+        return resolvedDevice;
+    }
+    async waitForNetworkIdle(timeout = 30000) {
+        const page = await this.collector.getActivePage();
+        await page.waitForNetworkIdle({ timeout });
+        logger.info('Network is idle');
+    }
+    async getLocalStorage() {
+        const page = await this.collector.getActivePage();
+        const storage = await page.evaluate(() => {
+            const items = {};
+            for (let i = 0; i < localStorage.length; i++) {
+                const key = localStorage.key(i);
+                if (key) {
+                    items[key] = localStorage.getItem(key) || '';
+                }
+            }
+            return items;
+        });
+        logger.info(`Retrieved ${Object.keys(storage).length} localStorage items`);
+        return storage;
+    }
+    async setLocalStorage(key, value) {
+        const page = await this.collector.getActivePage();
+        await page.evaluate((k, v) => {
+            localStorage.setItem(k, v);
+        }, key, value);
+        logger.info(`Set localStorage: ${key}`);
+    }
+    async clearLocalStorage() {
+        const page = await this.collector.getActivePage();
+        await page.evaluate(() => {
+            localStorage.clear();
+        });
+        logger.info('LocalStorage cleared');
+    }
+    async pressKey(key) {
+        const page = await this.collector.getActivePage();
+        await page.keyboard.press(key);
+        logger.info(`Pressed key: ${key}`);
+    }
+    async uploadFile(selector, filePath) {
+        const page = await this.collector.getActivePage();
+        const input = await page.$(selector);
+        if (!input) {
+            throw new Error(`File input not found: ${selector}`);
+        }
+        await input.uploadFile(filePath);
+        logger.info(`File uploaded: ${filePath}`);
+    }
+    async getAllLinks() {
+        const page = await this.collector.getActivePage();
+        const links = await page.evaluate(() => {
+            const anchors = document.querySelectorAll('a[href]');
+            const result = [];
+            for (let i = 0; i < anchors.length; i++) {
+                const anchor = anchors[i];
+                result.push({
+                    text: anchor.textContent?.trim() || '',
+                    href: anchor.href,
+                });
+            }
+            return result;
+        });
+        logger.info(`Found ${links.length} links`);
+        return links;
+    }
+    async getPage() {
+        return await this.collector.getActivePage();
+    }
+}

package/dist/src/modules/detector/ObfuscationDetector.js

@@ -0,0 +1,329 @@
+import { logger } from '../../utils/logger.js';
+import { JSVMPDeobfuscator } from '../deobfuscator/JSVMPDeobfuscator.js';
+export class ObfuscationDetector {
+    jsvmpDetector;
+    constructor() {
+        this.jsvmpDetector = new JSVMPDeobfuscator();
+    }
+    detect(code) {
+        const types = [];
+        const confidence = {};
+        const features = [];
+        const recommendations = [];
+        let vmFeatures;
+        if (this.detectJavaScriptObfuscator(code)) {
+            types.push('javascript-obfuscator');
+            confidence['javascript-obfuscator'] = 0.9;
+            features.push('String array with rotation');
+            features.push('Control flow flattening');
+            recommendations.push('Use deobfuscate/advanced_deobfuscate with webcrack enabled');
+        }
+        if (this.detectWebpack(code)) {
+            types.push('webpack');
+            confidence['webpack'] = 0.85;
+            features.push('__webpack_require__');
+            recommendations.push('Use deobfuscate/advanced_deobfuscate with unpack=true to recover modules');
+        }
+        if (this.detectUglify(code)) {
+            types.push('uglify');
+            confidence['uglify'] = 0.7;
+            features.push('Minified variable names');
+            recommendations.push('Use prettier or beautifier');
+        }
+        const vmDetectionResult = this.detectVMProtectionDetailed(code);
+        if (vmDetectionResult) {
+            types.push('vm-protection');
+            confidence['vm-protection'] = 0.95;
+            vmFeatures = vmDetectionResult;
+            features.push(`JSVMP with ${vmDetectionResult.instructionCount} instructions`);
+            features.push(`Complexity: ${vmDetectionResult.complexity}`);
+            recommendations.push('Use JSVMPDeobfuscator for advanced deobfuscation');
+        }
+        if (this.detectInvisibleUnicode(code)) {
+            types.push('invisible-unicode');
+            confidence['invisible-unicode'] = 1.0;
+            features.push('Zero-width characters');
+            recommendations.push('Use AdvancedDeobfuscator.decodeInvisibleUnicode()');
+        }
+        if (this.detectControlFlowFlattening(code)) {
+            types.push('control-flow-flattening');
+            confidence['control-flow-flattening'] = 0.8;
+            features.push('Switch-case state machine');
+            recommendations.push('Requires symbolic execution');
+        }
+        if (this.detectStringArrayRotation(code)) {
+            types.push('string-array-rotation');
+            confidence['string-array-rotation'] = 0.85;
+            features.push('Rotated string array');
+            recommendations.push('Extract and derotate string array');
+        }
+        if (this.detectDeadCodeInjection(code)) {
+            types.push('dead-code-injection');
+            confidence['dead-code-injection'] = 0.75;
+            features.push('Unreachable code blocks');
+            recommendations.push('Use AST-based dead code elimination');
+        }
+        if (this.detectOpaquePredicates(code)) {
+            types.push('opaque-predicates');
+            confidence['opaque-predicates'] = 0.7;
+            features.push('Always-true/false conditions');
+            recommendations.push('Use constant folding');
+        }
+        if (this.detectJSFuck(code)) {
+            types.push('jsfuck');
+            confidence['jsfuck'] = 1.0;
+            features.push('Only uses []()!+');
+            recommendations.push('Use jsfuck decoder');
+        }
+        if (this.detectAAEncode(code)) {
+            types.push('aaencode');
+            confidence['aaencode'] = 1.0;
+            features.push('Japanese emoticons');
+            recommendations.push('Use aaencode decoder');
+        }
+        if (this.detectJJEncode(code)) {
+            types.push('jjencode');
+            confidence['jjencode'] = 1.0;
+            features.push('$={___:++$');
+            recommendations.push('Use jjencode decoder');
+        }
+        if (this.detectPacker(code)) {
+            types.push('packer');
+            confidence['packer'] = 0.95;
+            features.push('eval(function(p,a,c,k,e,d)');
+            recommendations.push('Use unpacker tools');
+        }
+        if (this.detectEvalObfuscation(code)) {
+            types.push('eval-obfuscation');
+            confidence['eval-obfuscation'] = 0.8;
+            features.push('Multiple eval() calls');
+            recommendations.push('Hook eval() and log arguments');
+        }
+        if (this.detectBase64Encoding(code)) {
+            types.push('base64-encoding');
+            confidence['base64-encoding'] = 0.9;
+            features.push('atob() or Base64 strings');
+            recommendations.push('Decode Base64 strings');
+        }
+        if (this.detectHexEncoding(code)) {
+            types.push('hex-encoding');
+            confidence['hex-encoding'] = 0.85;
+            features.push('\\x hex sequences');
+            recommendations.push('Decode hex strings');
+        }
+        if (this.detectSelfModifying(code)) {
+            types.push('self-modifying');
+            confidence['self-modifying'] = 0.9;
+            features.push('Dynamic code generation');
+            recommendations.push('Requires runtime analysis');
+        }
+        if (this.detectJScrambler(code)) {
+            types.push('jscrambler');
+            confidence['jscrambler'] = 0.85;
+            features.push('Control flow flattening + Self-defending');
+            recommendations.push('Use JScrambler deobfuscator');
+        }
+        if (this.detectURLEncode(code)) {
+            types.push('urlencoded');
+            confidence['urlencoded'] = 0.95;
+            features.push('URL encoded strings');
+            recommendations.push('Decode URL encoding');
+        }
+        if (types.length === 0) {
+            types.push('unknown');
+            confidence['unknown'] = 0.5;
+            recommendations.push('Code may be clean or use custom obfuscation');
+        }
+        logger.info(`Detected obfuscation types: ${types.join(', ')}`);
+        return {
+            types,
+            confidence: confidence,
+            features,
+            recommendations,
+            toolRecommendations: this.buildToolRecommendations(types, code),
+            vmFeatures,
+        };
+    }
+    buildToolRecommendations(types, code) {
+        const recommendations = new Map();
+        const addRecommendation = (tool, reason, suggestedArgs) => {
+            if (!recommendations.has(tool)) {
+                recommendations.set(tool, { tool, reason, suggestedArgs });
+            }
+        };
+        if (types.includes('webpack') || types.includes('packer')) {
+            addRecommendation('webcrack_unpack', 'Bundle or wrapper markers detected; unpacking modules is likely the highest-value first step.', { code, unpack: true, unminify: true });
+        }
+        if (types.some((type) => [
+            'javascript-obfuscator',
+            'string-array-rotation',
+            'hex-encoding',
+            'base64-encoding',
+            'urlencoded',
+            'unknown',
+        ].includes(type))) {
+            addRecommendation('deobfuscate', 'Static cleanup is likely sufficient; start with the standard webcrack-backed deobfuscation path.', { code, unminify: true });
+        }
+        if (types.some((type) => [
+            'vm-protection',
+            'control-flow-flattening',
+            'dead-code-injection',
+            'opaque-predicates',
+            'invisible-unicode',
+            'jscrambler',
+            'jsfuck',
+            'aaencode',
+            'jjencode',
+        ].includes(type))) {
+            addRecommendation('advanced_deobfuscate', 'Complex protections detected; use the advanced webcrack-backed flow for deeper cleanup.', { code, detectOnly: false, unminify: true });
+        }
+        if (types.includes('eval-obfuscation') || types.includes('self-modifying')) {
+            addRecommendation('manage_hooks', 'Runtime-generated code is present; capture or hook execution points before static cleanup if analysis stalls.', { action: 'create', target: 'eval', type: 'function' });
+        }
+        if (recommendations.size === 0) {
+            addRecommendation('deobfuscate', 'No strong signature matched; start with the standard webcrack-backed path.', { code });
+        }
+        return Array.from(recommendations.values());
+    }
+    detectVMProtectionDetailed(code) {
+        try {
+            const detector = this.jsvmpDetector;
+            const result = detector.detectJSVMP(code);
+            return result;
+        }
+        catch (error) {
+            logger.warn('VM Protection detection failed', error);
+            if (this.detectVMProtection(code)) {
+                return {
+                    instructionCount: 0,
+                    interpreterLocation: 'Unknown',
+                    complexity: 'medium',
+                    hasSwitch: true,
+                    hasInstructionArray: false,
+                    hasProgramCounter: false,
+                };
+            }
+            return null;
+        }
+    }
+    detectJavaScriptObfuscator(code) {
+        const patterns = [
+            /_0x[a-f0-9]{4,6}/i,
+            /var\s+_0x[a-f0-9]+\s*=\s*\[/i,
+            /\(function\s*\(_0x[a-f0-9]+,\s*_0x[a-f0-9]+\)/i,
+            /while\s*\(!!\[\]\)/i,
+        ];
+        return patterns.filter((p) => p.test(code)).length >= 2;
+    }
+    detectWebpack(code) {
+        return (code.includes('__webpack_require__') ||
+            code.includes('webpackJsonp') ||
+            /\/\*\*\*\*\*\*\/\s*\(/m.test(code));
+    }
+    detectUglify(code) {
+        const singleLetterVars = code.match(/\b[a-z]\b/g);
+        return (singleLetterVars?.length || 0) > 50;
+    }
+    detectVMProtection(code) {
+        const vmPatterns = [
+            /while\s*\(\s*true\s*\)\s*\{[\s\S]*?switch\s*\(/i,
+            /var\s+\w+\s*=\s*\[\s*\d+(?:\s*,\s*\d+){10,}\s*\]/i,
+            /\w+\[pc\+\+\]/i,
+            /stack\.push|stack\.pop/i,
+        ];
+        return vmPatterns.filter((p) => p.test(code)).length >= 2;
+    }
+    detectInvisibleUnicode(code) {
+        const invisibleChars = ['\u200B', '\u200C', '\u200D', '\u2060', '\uFEFF'];
+        return invisibleChars.some((char) => code.includes(char));
+    }
+    detectControlFlowFlattening(code) {
+        return /while\s*\(\s*!!\s*\[\s*\]\s*\)\s*\{[\s\S]*?switch\s*\(/i.test(code);
+    }
+    detectStringArrayRotation(code) {
+        return (/var\s+\w+\s*=\s*\[.*?\];[\s\S]*?\(\s*function\s*\(\s*\w+,\s*\w+\s*\)/i.test(code) &&
+            /\w+\s*=\s*\w+\s*\+\s*0x[0-9a-f]+/i.test(code));
+    }
+    detectDeadCodeInjection(code) {
+        return (/if\s*\(\s*false\s*\)\s*\{/i.test(code) || /if\s*\(\s*!!\s*\[\s*\]\s*\)\s*\{/i.test(code));
+    }
+    detectOpaquePredicates(code) {
+        return /if\s*\(\s*\d+\s*[<>!=]+\s*\d+\s*\)/i.test(code);
+    }
+    detectJSFuck(code) {
+        const jsfuckChars = /^[[\]()!+\s]+$/;
+        return jsfuckChars.test(code.substring(0, 1000));
+    }
+    detectAAEncode(code) {
+        return /゚ω゚|ﾟωﾟ/.test(code);
+    }
+    detectJJEncode(code) {
+        return /\$=\{___:\+\+\$/.test(code);
+    }
+    detectPacker(code) {
+        return /eval\s*\(\s*function\s*\(\s*p\s*,\s*a\s*,\s*c\s*,\s*k\s*,\s*e\s*,\s*d\s*\)/i.test(code);
+    }
+    detectEvalObfuscation(code) {
+        const evalCount = (code.match(/\beval\s*\(/g) || []).length;
+        return evalCount >= 3;
+    }
+    detectBase64Encoding(code) {
+        return code.includes('atob(') || /[A-Za-z0-9+/]{50,}={0,2}/.test(code);
+    }
+    detectHexEncoding(code) {
+        const hexCount = (code.match(/\\x[0-9a-f]{2}/gi) || []).length;
+        return hexCount > 20;
+    }
+    detectSelfModifying(code) {
+        return (code.includes('Function(') ||
+            code.includes('new Function') ||
+            /eval\s*\(\s*[^)]*\+/.test(code));
+    }
+    detectJScrambler(code) {
+        let score = 0;
+        if (/while\s*\(\s*!!\s*\[\s*\]\s*\)/.test(code) ||
+            /while\s*\(\s*true\s*\)\s*{[\s\S]*?switch/.test(code)) {
+            score += 3;
+        }
+        if (code.includes('debugger') && code.includes('constructor')) {
+            score += 2;
+        }
+        if (/function\s+\w+\s*\([^)]*\)\s*{[\s\S]*?charCodeAt[\s\S]*?fromCharCode/.test(code)) {
+            score += 2;
+        }
+        if (code.includes('Function.prototype.toString') || code.includes('.toString.call')) {
+            score += 1;
+        }
+        return score >= 3;
+    }
+    detectURLEncode(code) {
+        const percentMatches = code.match(/%[0-9A-Fa-f]{2}/g);
+        return (percentMatches?.length || 0) > 10;
+    }
+    generateReport(result) {
+        let report = '=== Obfuscation Detection Report ===\n\n';
+        report += `Detected Types (${result.types.length}):\n`;
+        result.types.forEach((type) => {
+            const conf = result.confidence[type] || 0;
+            report += `  - ${type}: ${(conf * 100).toFixed(0)}% confidence\n`;
+        });
+        report += `\nFeatures:\n`;
+        result.features.forEach((feature) => {
+            report += `  - ${feature}\n`;
+        });
+        report += `\nRecommendations:\n`;
+        result.recommendations.forEach((rec) => {
+            report += `  - ${rec}\n`;
+        });
+        if (result.toolRecommendations.length > 0) {
+            report += `\nSuggested Tools:\n`;
+            result.toolRecommendations.forEach((item) => {
+                report += `  - ${item.tool}: ${item.reason}\n`;
+                if (item.suggestedArgs) {
+                    report += `    args: ${JSON.stringify(item.suggestedArgs)}\n`;
+                }
+            });
+        }
+        return report;
+    }
+}