@jshookmcp/jshook 0.2.3 → 0.2.5

package/dist/src/modules/debugger/ScriptManager.impl.extract-function-tree.js

@@ -38,7 +38,7 @@ export async function extractFunctionTreeCore(ctx, scriptId, functionName, optio
         t = await import('@babel/types');
     }
     catch (error) {
-        throw new Error(`Failed to load Babel dependencies. Please install: npm install @babel/parser @babel/traverse @babel/generator @babel/types\nError: ${getErrorMessage(error)}`);
+        throw new Error(`Failed to load Babel dependencies. Please install: npm install @babel/parser @babel/traverse @babel/generator @babel/types\nError: ${getErrorMessage(error)}`, { cause: error });
     }
     let ast;
     try {
@@ -48,7 +48,9 @@ export async function extractFunctionTreeCore(ctx, scriptId, functionName, optio
         });
     }
     catch (error) {
-        throw new Error(`Failed to parse script ${scriptId}: ${getErrorMessage(error)}`);
+        throw new Error(`Failed to parse script ${scriptId}: ${getErrorMessage(error)}`, {
+            cause: error,
+        });
     }
     const allFunctions = new Map();
     const callGraph = {};

package/dist/src/modules/debugger/WatchExpressionManager.js

@@ -101,7 +101,7 @@ export class WatchExpressionManager {
     deepEqual(a, b) {
         if (a === b)
             return true;
-        if (a == null || b == null)
+        if (a === null || a === undefined || b === null || b === undefined)
             return false;
         if (!this.isRecord(a) || !this.isRecord(b))
             return false;

package/dist/src/modules/deobfuscator/Deobfuscator.d.ts

@@ -1,15 +1,12 @@
 import type { DeobfuscateOptions, DeobfuscateResult } from '../../types/index.js';
-import { type LLMService } from '../../services/LLMService.js';
 export declare class Deobfuscator {
-    private llm?;
     private resultCache;
     private maxCacheSize;
-    constructor(llm?: LLMService);
+    constructor(legacyDependency?: unknown);
     private generateCacheKey;
     deobfuscate(options: DeobfuscateOptions): Promise<DeobfuscateResult>;
     private detectObfuscationType;
     private calculateReadabilityScore;
     private calculateConfidence;
     private buildAnalysis;
-    private llmAnalysis;
 }

package/dist/src/modules/deobfuscator/Deobfuscator.js

@@ -1,16 +1,12 @@
 import crypto from 'crypto';
 import { logger } from '../../utils/logger.js';
-import { DEOBF_LLM_MAX_TOKENS } from '../../constants.js';
-import {} from '../../services/LLMService.js';
-import { generateDeobfuscationPrompt } from '../../services/prompts/deobfuscation.js';
 import { calculateReadabilityScore as calculateReadabilityScoreUtil, detectObfuscationType as detectObfuscationTypeUtil, } from '../deobfuscator/Deobfuscator.utils.js';
 import { runWebcrack } from '../deobfuscator/webcrack.js';
 export class Deobfuscator {
-    llm;
     resultCache = new Map();
     maxCacheSize = 100;
-    constructor(llm) {
-        this.llm = llm;
+    constructor(legacyDependency) {
+        void legacyDependency;
     }
     generateCacheKey(options) {
         const key = JSON.stringify({
@@ -18,7 +14,7 @@ export class Deobfuscator {
             forceOutput: options.forceOutput,
             includeModuleCode: options.includeModuleCode,
             jsx: options.jsx,
-            llm: options.llm,
+            llm: false,
             mangle: options.mangle ?? options.renameVariables,
             mappings: options.mappings,
             maxBundleModules: options.maxBundleModules,
@@ -64,13 +60,7 @@ export class Deobfuscator {
             logger.error(`webcrack deobfuscation failed: ${reason}`);
             throw new Error(reason);
         }
-        let analysis = this.buildAnalysis(webcrackResult, obfuscationType);
-        if (this.llm && options.llm) {
-            const llmResult = await this.llmAnalysis(webcrackResult.code);
-            if (llmResult) {
-                analysis = llmResult;
-            }
-        }
+        const analysis = this.buildAnalysis(webcrackResult, obfuscationType);
         const transformations = [
             {
                 type: 'webcrack',
@@ -95,15 +85,6 @@ export class Deobfuscator {
                     },
                 ]
                 : []),
-            ...(this.llm && options.llm
-                ? [
-                    {
-                        type: 'llm-analysis',
-                        description: 'AI-assisted analysis completed after webcrack deobfuscation',
-                        success: true,
-                    },
-                ]
-                : []),
         ];
         const readabilityScore = this.calculateReadabilityScore(webcrackResult.code);
         const confidence = this.calculateConfidence(webcrackResult, readabilityScore);
@@ -161,20 +142,4 @@ export class Deobfuscator {
         }
         return parts.join(' ');
     }
-    async llmAnalysis(code) {
-        if (!this.llm)
-            return null;
-        try {
-            const messages = generateDeobfuscationPrompt(code);
-            const response = await this.llm.chat(messages, {
-                temperature: 0.3,
-                maxTokens: DEOBF_LLM_MAX_TOKENS,
-            });
-            return response.content;
-        }
-        catch (error) {
-            logger.warn('LLM analysis failed after webcrack deobfuscation', error);
-            return null;
-        }
-    }
 }

package/dist/src/modules/deobfuscator/JSVMPDeobfuscator.d.ts

@@ -1,9 +1,6 @@
 import type { JSVMPDeobfuscatorOptions, JSVMPDeobfuscatorResult } from '../../types/index.js';
-import type { LLMService } from '../../services/LLMService.js';
 export declare class JSVMPDeobfuscator {
-    private llm?;
     private readonly sandbox;
-    constructor(llm?: LLMService);
     deobfuscate(options: JSVMPDeobfuscatorOptions): Promise<JSVMPDeobfuscatorResult>;
     private detectJSVMP;
     private detectJSVMPWithRegex;

package/dist/src/modules/deobfuscator/JSVMPDeobfuscator.js

@@ -7,11 +7,7 @@ import { JSVMP_DEOBFUSCATE_TIMEOUT_MS, JSVMP_MAX_ITERATIONS } from '../../consta
 import { ExecutionSandbox } from '../security/ExecutionSandbox.js';
 import { restoreCustomVMBasic, restoreJSVMPCode, } from '../deobfuscator/JSVMPDeobfuscator.restore.js';
 export class JSVMPDeobfuscator {
-    llm;
     sandbox = new ExecutionSandbox();
-    constructor(llm) {
-        this.llm = llm;
-    }
     async deobfuscate(options) {
         const startTime = Date.now();
         const { code, aggressive = false, extractInstructions = false, timeout = JSVMP_DEOBFUSCATE_TIMEOUT_MS, maxIterations = JSVMP_MAX_ITERATIONS, } = options;
@@ -205,9 +201,8 @@ export class JSVMPDeobfuscator {
                 sourceType: 'unambiguous',
                 plugins: ['jsx', 'typescript'],
             });
-            const self = this;
             traverse(ast, {
-                SwitchStatement(path) {
+                SwitchStatement: (path) => {
                     if (path.node.cases.length === features.instructionCount) {
                         path.node.cases.forEach((caseNode, index) => {
                             const opcode = caseNode.test
@@ -217,7 +212,7 @@ export class JSVMPDeobfuscator {
                                         ? caseNode.test.value
                                         : index
                                 : index;
-                            const type = self.inferInstructionType(caseNode);
+                            const type = this.inferInstructionType(caseNode);
                             instructions.push({
                                 opcode,
                                 name: `INST_${opcode}`,
@@ -289,7 +284,6 @@ export class JSVMPDeobfuscator {
     async restoreCode(code, _features, vmType, aggressive, _timeout, _maxIterations) {
         void this.restoreCustomVMBasic;
         return restoreJSVMPCode({
-            llm: this.llm,
             sandbox: this.sandbox,
         }, code, vmType, aggressive);
     }

package/dist/src/modules/deobfuscator/JSVMPDeobfuscator.restore.d.ts

@@ -1,4 +1,3 @@
-import type { LLMService } from '../../services/LLMService.js';
 import type { UnresolvedPart, VMType } from '../../types/index.js';
 import { type ExecutionSandbox } from '../security/ExecutionSandbox.js';
 type RestoreResult = {
@@ -8,7 +7,7 @@ type RestoreResult = {
     unresolvedParts?: UnresolvedPart[];
 };
 type RestoreContext = {
-    llm?: LLMService;
+    llm?: any;
     sandbox: ExecutionSandbox;
 };
 export declare function restoreJSVMPCode(context: RestoreContext, code: string, vmType: VMType, aggressive: boolean): Promise<RestoreResult>;

package/dist/src/modules/deobfuscator/JSVMPDeobfuscator.restore.js

@@ -1,4 +1,3 @@
-import { generateVMAnalysisMessages } from '../../services/prompts/deobfuscation.js';
 import { logger } from '../../utils/logger.js';
 import {} from '../security/ExecutionSandbox.js';
 export async function restoreJSVMPCode(context, code, vmType, aggressive) {
@@ -184,60 +183,9 @@ async function restoreJJEncode(context, code, warnings) {
         };
     }
 }
-async function restoreCustomVM(context, code, aggressive, warnings, unresolvedParts) {
-    if (!context.llm) {
-        warnings.push('LLM service unavailable, using fallback');
-        warnings.push('Configure DeepSeek/OpenAI API key for AI-assisted deobfuscation');
-        return restoreCustomVMBasic(code, aggressive, warnings, unresolvedParts);
-    }
-    try {
-        logger.info(' LLMVM...');
-        const response = await context.llm.chat(generateVMAnalysisMessages(code));
-        const analysisText = response.content;
-        logger.info(' LLM');
-        logger.info(`: ${analysisText.substring(0, 200)}...`);
-        let vmAnalysis;
-        try {
-            const jsonMatch = analysisText.match(/\{[\s\S]*\}/);
-            if (jsonMatch) {
-                const parsed = JSON.parse(jsonMatch[0]);
-                if (parsed && typeof parsed === 'object') {
-                    vmAnalysis = parsed;
-                }
-            }
-        }
-        catch {
-            warnings.push('LLM analysis failed, using fallback');
-            return restoreCustomVMBasic(code, aggressive, warnings, unresolvedParts);
-        }
-        if (vmAnalysis) {
-            warnings.push(`LLMVM: ${typeof vmAnalysis.vmType === 'string' ? vmAnalysis.vmType : 'Unknown'}`);
-            const vmWarnings = vmAnalysis.warnings;
-            if (Array.isArray(vmWarnings)) {
-                warnings.push(...vmWarnings);
-            }
-            const restorationSteps = vmAnalysis.restorationSteps;
-            if (Array.isArray(restorationSteps)) {
-                unresolvedParts.push({
-                    location: 'VM Restoration',
-                    reason: 'LLM',
-                    suggestion: restorationSteps.join('\n'),
-                });
-            }
-            return {
-                code,
-                confidence: 0.6,
-                warnings,
-                unresolvedParts: unresolvedParts.length > 0 ? unresolvedParts : undefined,
-            };
-        }
-        return restoreCustomVMBasic(code, aggressive, warnings, unresolvedParts);
-    }
-    catch (error) {
-        logger.error('LLM', error);
-        warnings.push(`LLM: ${error}`);
-        return restoreCustomVMBasic(code, aggressive, warnings, unresolvedParts);
-    }
+async function restoreCustomVM(_context, code, aggressive, warnings, unresolvedParts) {
+    warnings.push('AI-assisted deobfuscation removed, using fallback directly.');
+    return restoreCustomVMBasic(code, aggressive, warnings, unresolvedParts);
 }
 export function restoreCustomVMBasic(code, aggressive, warnings, unresolvedParts) {
     let restored = code;

package/dist/src/modules/deobfuscator/JScramblerDeobfuscator.js

@@ -144,12 +144,11 @@ export class JScramberDeobfuscator {
     }
     restoreControlFlow(ast) {
         let count = 0;
-        const self = this;
         traverse(ast, {
-            WhileStatement(path) {
-                if (self.isControlFlowFlatteningPattern(path.node)) {
+            WhileStatement: (path) => {
+                if (this.isControlFlowFlatteningPattern(path.node)) {
                     try {
-                        self.unflattenControlFlowPattern(path);
+                        this.unflattenControlFlowPattern(path);
                         count++;
                     }
                     catch { }

package/dist/src/modules/deobfuscator/VMDeobfuscator.d.ts

@@ -1,4 +1,3 @@
-import { type LLMService } from '../../services/LLMService.js';
 type VMStructure = {
     hasInterpreter: boolean;
     instructionTypes: string[];
@@ -11,15 +10,14 @@ type VMComponents = {
     interpreterFunction?: string;
 };
 export declare class VMDeobfuscator {
-    private llm?;
-    constructor(llm?: LLMService);
+    constructor(legacyDependency?: unknown);
     detectVMProtection(code: string): {
         detected: boolean;
         type: string;
         instructionCount: number;
     };
     countVMInstructions(code: string): number;
-    deobfuscateVM(code: string, vmInfo: {
+    deobfuscateVM(code: string, _vmInfo: {
         type: string;
         instructionCount: number;
     }): Promise<{
@@ -28,12 +26,6 @@ export declare class VMDeobfuscator {
     }>;
     analyzeVMStructure(code: string): VMStructure;
     extractVMComponents(code: string): VMComponents;
-    buildVMDeobfuscationPrompt(code: string, vmInfo: {
-        type: string;
-        instructionCount: number;
-    }, vmStructure: VMStructure, vmComponents: VMComponents): string;
     simplifyVMCode(code: string, vmComponents: VMComponents): string;
-    extractCodeFromLLMResponse(response: string): string;
-    isValidJavaScript(code: string): boolean;
 }
 export {};

package/dist/src/modules/deobfuscator/VMDeobfuscator.js

@@ -1,14 +1,10 @@
 import { logger } from '../../utils/logger.js';
-import { VM_DEOBF_LLM_MAX_TOKENS } from '../../constants.js';
-import {} from '../../services/LLMService.js';
 import * as parser from '@babel/parser';
 import traverse from '@babel/traverse';
 import * as t from '@babel/types';
-import { generateVMDeobfuscationMessages } from '../../services/prompts/deobfuscation.js';
 export class VMDeobfuscator {
-    llm;
-    constructor(llm) {
-        this.llm = llm;
+    constructor(legacyDependency) {
+        void legacyDependency;
     }
     detectVMProtection(code) {
         const vmPatterns = [
@@ -31,7 +27,7 @@ export class VMDeobfuscator {
         const match = code.match(/case\s+\d+:/g);
         return match ? match.length : 0;
     }
-    async deobfuscateVM(code, vmInfo) {
+    async deobfuscateVM(code, _vmInfo) {
         logger.warn('VM deobfuscation is experimental and may fail');
         try {
             const vmStructure = this.analyzeVMStructure(code);
@@ -39,24 +35,6 @@ export class VMDeobfuscator {
                 logger.info(`Detected VM interpreter with ${vmStructure.instructionTypes.length} instruction types`);
             }
             const vmComponents = this.extractVMComponents(code);
-            if (this.llm) {
-                const prompt = this.buildVMDeobfuscationPrompt(code, vmInfo, vmStructure, vmComponents);
-                const response = await this.llm.chat(generateVMDeobfuscationMessages(prompt), {
-                    temperature: 0.05,
-                    maxTokens: VM_DEOBF_LLM_MAX_TOKENS,
-                });
-                const deobfuscatedCode = this.extractCodeFromLLMResponse(response.content);
-                if (this.isValidJavaScript(deobfuscatedCode)) {
-                    logger.success('VM deobfuscation succeeded via LLM');
-                    return {
-                        success: true,
-                        code: deobfuscatedCode,
-                    };
-                }
-                else {
-                    logger.warn('LLM output is not valid JavaScript, falling back to original');
-                }
-            }
             const simplifiedCode = this.simplifyVMCode(code, vmComponents);
             return {
                 success: simplifiedCode !== code,
@@ -134,91 +112,6 @@ export class VMDeobfuscator {
         }
         return components;
     }
-    buildVMDeobfuscationPrompt(code, vmInfo, vmStructure, vmComponents) {
-        const codeSnippet = code.length > 2000 ? code.slice(0, 2000) + '\n...(truncated)' : code;
-        return `# VM Deobfuscation Analysis
-
-## VM Profile
-- **Architecture**: ${vmInfo.type}
-- **Instruction Count**: ${vmInfo.instructionCount}
-- **Interpreter Loop**: ${vmStructure.hasInterpreter ? 'Detected' : 'Not detected'}
-- **Stack Operations**: ${vmStructure.hasStack ? 'Present' : 'Absent'}
-- **Register Usage**: ${vmStructure.hasRegisters ? 'Present' : 'Absent'}
-- **Instruction Variety**: ${vmStructure.instructionTypes.length} distinct types
-
-## Identified Components
-${vmComponents.instructionArray ? ` Instruction Array: Found at ${vmComponents.instructionArray}` : ' Instruction Array: Not found'}
-${vmComponents.dataArray ? ` Data Array: Found at ${vmComponents.dataArray}` : ' Data Array: Not found'}
-${vmComponents.interpreterFunction ? ` Interpreter Function: Found at ${vmComponents.interpreterFunction}` : ' Interpreter Function: Not found'}
-
-## VM-Protected Code
-\`\`\`javascript
-${codeSnippet}
-\`\`\`
-
-## Deobfuscation Instructions (Chain-of-Thought)
-
-### Step 1: VM Structure Analysis
-Examine the code to identify:
-- Instruction array (usually a large array of numbers/strings)
-- Interpreter loop (while/for loop processing instructions)
-- Stack/register variables
-- Opcode handlers (switch-case or if-else chains)
-
-### Step 2: Instruction Decoding
-For each instruction type, determine:
-- What JavaScript operation it represents (e.g., opcode 0x01 = addition)
-- How it manipulates the stack/registers
-- What side effects it has (function calls, property access, etc.)
-
-### Step 3: Control Flow Reconstruction
-- Map VM jumps/branches to JavaScript if/while/for statements
-- Identify function calls and returns
-- Reconstruct try-catch blocks if present
-
-### Step 4: Code Generation
-- Replace VM instruction sequences with equivalent JavaScript
-- Use meaningful variable names based on usage context
-- Remove VM overhead (interpreter loop, stack management)
-- Preserve all side effects and program behavior
-
-### Step 5: Validation
-- Ensure output is syntactically valid JavaScript
-- Verify no functionality is lost
-- Add comments for complex patterns
-
-## Example Transformation (Few-shot Learning)
-
-**VM Code (Before)**:
-\`\`\`javascript
-var vm = [0x01, 0x05, 0x02, 0x03, 0x10];
-var stack = [];
-for(var i=0; i<vm.length; i++) {
-  switch(vm[i]) {
-    case 0x01: stack.push(5); break;
-    case 0x02: stack.push(3); break;
-    case 0x10: var b=stack.pop(), a=stack.pop(); stack.push(a+b); break;
-  }
-}
-console.log(stack[0]);
-\`\`\`
-
-**Deobfuscated Code (After)**:
-\`\`\`javascript
-var result = 5 + 3;
-console.log(result);
-\`\`\`
-
-## Critical Requirements
-1. Output ONLY the deobfuscated JavaScript code
-2. NO markdown code blocks, NO explanations, NO comments outside the code
-3. Code must be syntactically valid and executable
-4. Preserve exact program logic and side effects
-5. If full deobfuscation is impossible, return the best partial result
-
-## Output Format
-Return clean JavaScript code starting immediately (no preamble).`;
-    }
     simplifyVMCode(code, vmComponents) {
         try {
             let simplified = code;
@@ -237,22 +130,4 @@ Return clean JavaScript code starting immediately (no preamble).`;
             return code;
         }
     }
-    extractCodeFromLLMResponse(response) {
-        let code = response.trim();
-        code = code.replace(/^```(?:javascript|js)?\s*\n/i, '');
-        code = code.replace(/\n```\s*$/i, '');
-        return code.trim();
-    }
-    isValidJavaScript(code) {
-        try {
-            parser.parse(code, {
-                sourceType: 'module',
-                plugins: ['jsx', 'typescript'],
-            });
-            return true;
-        }
-        catch {
-            return false;
-        }
-    }
 }

package/dist/src/modules/deobfuscator/webcrack.js

@@ -1,5 +1,6 @@
 import { readdir, rm, stat } from 'node:fs/promises';
 import path from 'node:path';
+import vm from 'node:vm';
 import { logger } from '../../utils/logger.js';
 const DEFAULT_OPTIONS = {
     jsx: true,
@@ -60,7 +61,7 @@ function applyBundleMappings(bundle, mappings) {
 function summarizeBundle(bundle, options, remapped) {
     const maxBundleModules = options.maxBundleModules ?? MAX_BUNDLE_MODULES;
     const modules = Array.from(bundle.modules.values())
-        .sort((left, right) => {
+        .toSorted((left, right) => {
         if (left.isEntry !== right.isEntry) {
             return left.isEntry ? -1 : 1;
         }
@@ -103,7 +104,7 @@ async function collectSavedArtifacts(rootDir, currentDir = rootDir) {
             type: 'file',
         });
     }
-    return artifacts.sort((left, right) => left.path.localeCompare(right.path));
+    return artifacts.toSorted((left, right) => left.path.localeCompare(right.path));
 }
 export async function runWebcrack(code, options) {
     const optionsUsed = normalizeOptions(options);
@@ -117,6 +118,17 @@ export async function runWebcrack(code, options) {
             reason,
         };
     }
+    let sandboxOption;
+    try {
+        await import('isolated-vm');
+    }
+    catch {
+        logger.warn('isolated-vm is unavailable (likely Node 24 incompatibility). Falling back to native node:vm for deobfuscation sandbox.');
+        sandboxOption = async (evalCode) => {
+            const context = vm.createContext(Object.create(null));
+            return vm.runInContext(evalCode, context, { timeout: 8000 });
+        };
+    }
     try {
         const { webcrack } = (await import('webcrack'));
         const result = await webcrack(code, {
@@ -125,6 +137,7 @@ export async function runWebcrack(code, options) {
             deobfuscate: true,
             unminify: optionsUsed.unminify,
             mangle: optionsUsed.mangle,
+            ...(sandboxOption ? { sandbox: sandboxOption } : {}),
         });
         const remapped = result.bundle
             ? applyBundleMappings(result.bundle, options.mappings)

package/dist/src/modules/emulator/AIEnvironmentAnalyzer.d.ts

@@ -1,4 +1,3 @@
-import type { LLMService } from '../../services/LLMService.js';
 import type { DetectedEnvironmentVariables, MissingAPI } from '../../types/index.js';
 import type { BrowserType } from '../emulator/BrowserEnvironmentRules.js';
 export interface AIAnalysisResult {
@@ -18,13 +17,11 @@ export interface AIAnalysisResult {
     confidence: number;
 }
 export declare class AIEnvironmentAnalyzer {
-    private llm?;
-    constructor(llm?: LLMService | undefined);
-    analyze(code: string, detected: DetectedEnvironmentVariables, missing: MissingAPI[], browserType?: BrowserType): Promise<AIAnalysisResult>;
-    private parseAIResponse;
+    constructor(legacyDependency?: unknown);
+    analyze(_code: string, _detected: DetectedEnvironmentVariables, _missing: MissingAPI[], _browserType?: BrowserType): Promise<AIAnalysisResult>;
     private getEmptyResult;
-    analyzeAntiCrawl(code: string): Promise<AIAnalysisResult['antiCrawlFeatures']>;
-    inferAPIImplementation(apiPath: string, context: string): Promise<string | null>;
-    generateSuggestions(detected: DetectedEnvironmentVariables, missing: MissingAPI[], browserType: BrowserType): Promise<string[]>;
+    analyzeAntiCrawl(_code: string): Promise<AIAnalysisResult['antiCrawlFeatures']>;
+    inferAPIImplementation(_apiPath: string, _context: string): Promise<string | null>;
+    generateSuggestions(detected: DetectedEnvironmentVariables, missing: MissingAPI[], _browserType: BrowserType): Promise<string[]>;
     private getDefaultSuggestions;
 }