@jshookmcp/jshook 0.2.3 → 0.2.6

package/dist/src/modules/deobfuscator/JSVMPDeobfuscator.js

@@ -7,11 +7,7 @@ import { JSVMP_DEOBFUSCATE_TIMEOUT_MS, JSVMP_MAX_ITERATIONS } from '../../consta
 import { ExecutionSandbox } from '../security/ExecutionSandbox.js';
 import { restoreCustomVMBasic, restoreJSVMPCode, } from '../deobfuscator/JSVMPDeobfuscator.restore.js';
 export class JSVMPDeobfuscator {
-    llm;
     sandbox = new ExecutionSandbox();
-    constructor(llm) {
-        this.llm = llm;
-    }
     async deobfuscate(options) {
         const startTime = Date.now();
         const { code, aggressive = false, extractInstructions = false, timeout = JSVMP_DEOBFUSCATE_TIMEOUT_MS, maxIterations = JSVMP_MAX_ITERATIONS, } = options;
@@ -205,9 +201,8 @@ export class JSVMPDeobfuscator {
                 sourceType: 'unambiguous',
                 plugins: ['jsx', 'typescript'],
             });
-            const self = this;
             traverse(ast, {
-                SwitchStatement(path) {
+                SwitchStatement: (path) => {
                     if (path.node.cases.length === features.instructionCount) {
                         path.node.cases.forEach((caseNode, index) => {
                             const opcode = caseNode.test
@@ -217,7 +212,7 @@ export class JSVMPDeobfuscator {
                                         ? caseNode.test.value
                                         : index
                                 : index;
-                            const type = self.inferInstructionType(caseNode);
+                            const type = this.inferInstructionType(caseNode);
                             instructions.push({
                                 opcode,
                                 name: `INST_${opcode}`,
@@ -289,7 +284,6 @@ export class JSVMPDeobfuscator {
     async restoreCode(code, _features, vmType, aggressive, _timeout, _maxIterations) {
         void this.restoreCustomVMBasic;
         return restoreJSVMPCode({
-            llm: this.llm,
             sandbox: this.sandbox,
         }, code, vmType, aggressive);
     }

package/dist/src/modules/deobfuscator/JSVMPDeobfuscator.restore.d.ts

@@ -1,4 +1,3 @@
-import type { LLMService } from '../../services/LLMService.js';
 import type { UnresolvedPart, VMType } from '../../types/index.js';
 import { type ExecutionSandbox } from '../security/ExecutionSandbox.js';
 type RestoreResult = {
@@ -8,7 +7,7 @@ type RestoreResult = {
     unresolvedParts?: UnresolvedPart[];
 };
 type RestoreContext = {
-    llm?: LLMService;
+    llm?: any;
     sandbox: ExecutionSandbox;
 };
 export declare function restoreJSVMPCode(context: RestoreContext, code: string, vmType: VMType, aggressive: boolean): Promise<RestoreResult>;

package/dist/src/modules/deobfuscator/JSVMPDeobfuscator.restore.js

@@ -1,4 +1,3 @@
-import { generateVMAnalysisMessages } from '../../services/prompts/deobfuscation.js';
 import { logger } from '../../utils/logger.js';
 import {} from '../security/ExecutionSandbox.js';
 export async function restoreJSVMPCode(context, code, vmType, aggressive) {
@@ -184,60 +183,9 @@ async function restoreJJEncode(context, code, warnings) {
         };
     }
 }
-async function restoreCustomVM(context, code, aggressive, warnings, unresolvedParts) {
-    if (!context.llm) {
-        warnings.push('LLM service unavailable, using fallback');
-        warnings.push('Configure DeepSeek/OpenAI API key for AI-assisted deobfuscation');
-        return restoreCustomVMBasic(code, aggressive, warnings, unresolvedParts);
-    }
-    try {
-        logger.info(' LLMVM...');
-        const response = await context.llm.chat(generateVMAnalysisMessages(code));
-        const analysisText = response.content;
-        logger.info(' LLM');
-        logger.info(`: ${analysisText.substring(0, 200)}...`);
-        let vmAnalysis;
-        try {
-            const jsonMatch = analysisText.match(/\{[\s\S]*\}/);
-            if (jsonMatch) {
-                const parsed = JSON.parse(jsonMatch[0]);
-                if (parsed && typeof parsed === 'object') {
-                    vmAnalysis = parsed;
-                }
-            }
-        }
-        catch {
-            warnings.push('LLM analysis failed, using fallback');
-            return restoreCustomVMBasic(code, aggressive, warnings, unresolvedParts);
-        }
-        if (vmAnalysis) {
-            warnings.push(`LLMVM: ${typeof vmAnalysis.vmType === 'string' ? vmAnalysis.vmType : 'Unknown'}`);
-            const vmWarnings = vmAnalysis.warnings;
-            if (Array.isArray(vmWarnings)) {
-                warnings.push(...vmWarnings);
-            }
-            const restorationSteps = vmAnalysis.restorationSteps;
-            if (Array.isArray(restorationSteps)) {
-                unresolvedParts.push({
-                    location: 'VM Restoration',
-                    reason: 'LLM',
-                    suggestion: restorationSteps.join('\n'),
-                });
-            }
-            return {
-                code,
-                confidence: 0.6,
-                warnings,
-                unresolvedParts: unresolvedParts.length > 0 ? unresolvedParts : undefined,
-            };
-        }
-        return restoreCustomVMBasic(code, aggressive, warnings, unresolvedParts);
-    }
-    catch (error) {
-        logger.error('LLM', error);
-        warnings.push(`LLM: ${error}`);
-        return restoreCustomVMBasic(code, aggressive, warnings, unresolvedParts);
-    }
+async function restoreCustomVM(_context, code, aggressive, warnings, unresolvedParts) {
+    warnings.push('AI-assisted deobfuscation removed, using fallback directly.');
+    return restoreCustomVMBasic(code, aggressive, warnings, unresolvedParts);
 }
 export function restoreCustomVMBasic(code, aggressive, warnings, unresolvedParts) {
     let restored = code;

package/dist/src/modules/deobfuscator/JScramblerDeobfuscator.js

@@ -144,12 +144,11 @@ export class JScramberDeobfuscator {
     }
     restoreControlFlow(ast) {
         let count = 0;
-        const self = this;
         traverse(ast, {
-            WhileStatement(path) {
-                if (self.isControlFlowFlatteningPattern(path.node)) {
+            WhileStatement: (path) => {
+                if (this.isControlFlowFlatteningPattern(path.node)) {
                     try {
-                        self.unflattenControlFlowPattern(path);
+                        this.unflattenControlFlowPattern(path);
                         count++;
                     }
                     catch { }

package/dist/src/modules/deobfuscator/VMDeobfuscator.d.ts

@@ -1,4 +1,3 @@
-import { type LLMService } from '../../services/LLMService.js';
 type VMStructure = {
     hasInterpreter: boolean;
     instructionTypes: string[];
@@ -11,15 +10,14 @@ type VMComponents = {
     interpreterFunction?: string;
 };
 export declare class VMDeobfuscator {
-    private llm?;
-    constructor(llm?: LLMService);
+    constructor(legacyDependency?: unknown);
     detectVMProtection(code: string): {
         detected: boolean;
         type: string;
         instructionCount: number;
     };
     countVMInstructions(code: string): number;
-    deobfuscateVM(code: string, vmInfo: {
+    deobfuscateVM(code: string, _vmInfo: {
         type: string;
         instructionCount: number;
     }): Promise<{
@@ -28,12 +26,6 @@ export declare class VMDeobfuscator {
     }>;
     analyzeVMStructure(code: string): VMStructure;
     extractVMComponents(code: string): VMComponents;
-    buildVMDeobfuscationPrompt(code: string, vmInfo: {
-        type: string;
-        instructionCount: number;
-    }, vmStructure: VMStructure, vmComponents: VMComponents): string;
     simplifyVMCode(code: string, vmComponents: VMComponents): string;
-    extractCodeFromLLMResponse(response: string): string;
-    isValidJavaScript(code: string): boolean;
 }
 export {};

package/dist/src/modules/deobfuscator/VMDeobfuscator.js

@@ -1,14 +1,10 @@
 import { logger } from '../../utils/logger.js';
-import { VM_DEOBF_LLM_MAX_TOKENS } from '../../constants.js';
-import {} from '../../services/LLMService.js';
 import * as parser from '@babel/parser';
 import traverse from '@babel/traverse';
 import * as t from '@babel/types';
-import { generateVMDeobfuscationMessages } from '../../services/prompts/deobfuscation.js';
 export class VMDeobfuscator {
-    llm;
-    constructor(llm) {
-        this.llm = llm;
+    constructor(legacyDependency) {
+        void legacyDependency;
     }
     detectVMProtection(code) {
         const vmPatterns = [
@@ -31,7 +27,7 @@ export class VMDeobfuscator {
         const match = code.match(/case\s+\d+:/g);
         return match ? match.length : 0;
     }
-    async deobfuscateVM(code, vmInfo) {
+    async deobfuscateVM(code, _vmInfo) {
         logger.warn('VM deobfuscation is experimental and may fail');
         try {
             const vmStructure = this.analyzeVMStructure(code);
@@ -39,24 +35,6 @@ export class VMDeobfuscator {
                 logger.info(`Detected VM interpreter with ${vmStructure.instructionTypes.length} instruction types`);
             }
             const vmComponents = this.extractVMComponents(code);
-            if (this.llm) {
-                const prompt = this.buildVMDeobfuscationPrompt(code, vmInfo, vmStructure, vmComponents);
-                const response = await this.llm.chat(generateVMDeobfuscationMessages(prompt), {
-                    temperature: 0.05,
-                    maxTokens: VM_DEOBF_LLM_MAX_TOKENS,
-                });
-                const deobfuscatedCode = this.extractCodeFromLLMResponse(response.content);
-                if (this.isValidJavaScript(deobfuscatedCode)) {
-                    logger.success('VM deobfuscation succeeded via LLM');
-                    return {
-                        success: true,
-                        code: deobfuscatedCode,
-                    };
-                }
-                else {
-                    logger.warn('LLM output is not valid JavaScript, falling back to original');
-                }
-            }
             const simplifiedCode = this.simplifyVMCode(code, vmComponents);
             return {
                 success: simplifiedCode !== code,
@@ -134,91 +112,6 @@ export class VMDeobfuscator {
         }
         return components;
     }
-    buildVMDeobfuscationPrompt(code, vmInfo, vmStructure, vmComponents) {
-        const codeSnippet = code.length > 2000 ? code.slice(0, 2000) + '\n...(truncated)' : code;
-        return `# VM Deobfuscation Analysis
-
-## VM Profile
-- **Architecture**: ${vmInfo.type}
-- **Instruction Count**: ${vmInfo.instructionCount}
-- **Interpreter Loop**: ${vmStructure.hasInterpreter ? 'Detected' : 'Not detected'}
-- **Stack Operations**: ${vmStructure.hasStack ? 'Present' : 'Absent'}
-- **Register Usage**: ${vmStructure.hasRegisters ? 'Present' : 'Absent'}
-- **Instruction Variety**: ${vmStructure.instructionTypes.length} distinct types
-
-## Identified Components
-${vmComponents.instructionArray ? ` Instruction Array: Found at ${vmComponents.instructionArray}` : ' Instruction Array: Not found'}
-${vmComponents.dataArray ? ` Data Array: Found at ${vmComponents.dataArray}` : ' Data Array: Not found'}
-${vmComponents.interpreterFunction ? ` Interpreter Function: Found at ${vmComponents.interpreterFunction}` : ' Interpreter Function: Not found'}
-
-## VM-Protected Code
-\`\`\`javascript
-${codeSnippet}
-\`\`\`
-
-## Deobfuscation Instructions (Chain-of-Thought)
-
-### Step 1: VM Structure Analysis
-Examine the code to identify:
-- Instruction array (usually a large array of numbers/strings)
-- Interpreter loop (while/for loop processing instructions)
-- Stack/register variables
-- Opcode handlers (switch-case or if-else chains)
-
-### Step 2: Instruction Decoding
-For each instruction type, determine:
-- What JavaScript operation it represents (e.g., opcode 0x01 = addition)
-- How it manipulates the stack/registers
-- What side effects it has (function calls, property access, etc.)
-
-### Step 3: Control Flow Reconstruction
-- Map VM jumps/branches to JavaScript if/while/for statements
-- Identify function calls and returns
-- Reconstruct try-catch blocks if present
-
-### Step 4: Code Generation
-- Replace VM instruction sequences with equivalent JavaScript
-- Use meaningful variable names based on usage context
-- Remove VM overhead (interpreter loop, stack management)
-- Preserve all side effects and program behavior
-
-### Step 5: Validation
-- Ensure output is syntactically valid JavaScript
-- Verify no functionality is lost
-- Add comments for complex patterns
-
-## Example Transformation (Few-shot Learning)
-
-**VM Code (Before)**:
-\`\`\`javascript
-var vm = [0x01, 0x05, 0x02, 0x03, 0x10];
-var stack = [];
-for(var i=0; i<vm.length; i++) {
-  switch(vm[i]) {
-    case 0x01: stack.push(5); break;
-    case 0x02: stack.push(3); break;
-    case 0x10: var b=stack.pop(), a=stack.pop(); stack.push(a+b); break;
-  }
-}
-console.log(stack[0]);
-\`\`\`
-
-**Deobfuscated Code (After)**:
-\`\`\`javascript
-var result = 5 + 3;
-console.log(result);
-\`\`\`
-
-## Critical Requirements
-1. Output ONLY the deobfuscated JavaScript code
-2. NO markdown code blocks, NO explanations, NO comments outside the code
-3. Code must be syntactically valid and executable
-4. Preserve exact program logic and side effects
-5. If full deobfuscation is impossible, return the best partial result
-
-## Output Format
-Return clean JavaScript code starting immediately (no preamble).`;
-    }
     simplifyVMCode(code, vmComponents) {
         try {
             let simplified = code;
@@ -237,22 +130,4 @@ Return clean JavaScript code starting immediately (no preamble).`;
             return code;
         }
     }
-    extractCodeFromLLMResponse(response) {
-        let code = response.trim();
-        code = code.replace(/^```(?:javascript|js)?\s*\n/i, '');
-        code = code.replace(/\n```\s*$/i, '');
-        return code.trim();
-    }
-    isValidJavaScript(code) {
-        try {
-            parser.parse(code, {
-                sourceType: 'module',
-                plugins: ['jsx', 'typescript'],
-            });
-            return true;
-        }
-        catch {
-            return false;
-        }
-    }
 }

package/dist/src/modules/deobfuscator/webcrack.js

@@ -1,5 +1,6 @@
 import { readdir, rm, stat } from 'node:fs/promises';
 import path from 'node:path';
+import vm from 'node:vm';
 import { logger } from '../../utils/logger.js';
 const DEFAULT_OPTIONS = {
     jsx: true,
@@ -60,7 +61,7 @@ function applyBundleMappings(bundle, mappings) {
 function summarizeBundle(bundle, options, remapped) {
     const maxBundleModules = options.maxBundleModules ?? MAX_BUNDLE_MODULES;
     const modules = Array.from(bundle.modules.values())
-        .sort((left, right) => {
+        .toSorted((left, right) => {
         if (left.isEntry !== right.isEntry) {
             return left.isEntry ? -1 : 1;
         }
@@ -103,7 +104,7 @@ async function collectSavedArtifacts(rootDir, currentDir = rootDir) {
             type: 'file',
         });
     }
-    return artifacts.sort((left, right) => left.path.localeCompare(right.path));
+    return artifacts.toSorted((left, right) => left.path.localeCompare(right.path));
 }
 export async function runWebcrack(code, options) {
     const optionsUsed = normalizeOptions(options);
@@ -117,6 +118,17 @@ export async function runWebcrack(code, options) {
             reason,
         };
     }
+    let sandboxOption;
+    try {
+        await import('isolated-vm');
+    }
+    catch {
+        logger.warn('isolated-vm is unavailable (likely Node 24 incompatibility). Falling back to native node:vm for deobfuscation sandbox.');
+        sandboxOption = async (evalCode) => {
+            const context = vm.createContext(Object.create(null));
+            return vm.runInContext(evalCode, context, { timeout: 8000 });
+        };
+    }
     try {
         const { webcrack } = (await import('webcrack'));
         const result = await webcrack(code, {
@@ -125,6 +137,7 @@ export async function runWebcrack(code, options) {
             deobfuscate: true,
             unminify: optionsUsed.unminify,
             mangle: optionsUsed.mangle,
+            ...(sandboxOption ? { sandbox: sandboxOption } : {}),
         });
         const remapped = result.bundle
             ? applyBundleMappings(result.bundle, options.mappings)

package/dist/src/modules/emulator/AIEnvironmentAnalyzer.d.ts

@@ -1,4 +1,3 @@
-import type { LLMService } from '../../services/LLMService.js';
 import type { DetectedEnvironmentVariables, MissingAPI } from '../../types/index.js';
 import type { BrowserType } from '../emulator/BrowserEnvironmentRules.js';
 export interface AIAnalysisResult {
@@ -18,13 +17,11 @@ export interface AIAnalysisResult {
     confidence: number;
 }
 export declare class AIEnvironmentAnalyzer {
-    private llm?;
-    constructor(llm?: LLMService | undefined);
-    analyze(code: string, detected: DetectedEnvironmentVariables, missing: MissingAPI[], browserType?: BrowserType): Promise<AIAnalysisResult>;
-    private parseAIResponse;
+    constructor(legacyDependency?: unknown);
+    analyze(_code: string, _detected: DetectedEnvironmentVariables, _missing: MissingAPI[], _browserType?: BrowserType): Promise<AIAnalysisResult>;
     private getEmptyResult;
-    analyzeAntiCrawl(code: string): Promise<AIAnalysisResult['antiCrawlFeatures']>;
-    inferAPIImplementation(apiPath: string, context: string): Promise<string | null>;
-    generateSuggestions(detected: DetectedEnvironmentVariables, missing: MissingAPI[], browserType: BrowserType): Promise<string[]>;
+    analyzeAntiCrawl(_code: string): Promise<AIAnalysisResult['antiCrawlFeatures']>;
+    inferAPIImplementation(_apiPath: string, _context: string): Promise<string | null>;
+    generateSuggestions(detected: DetectedEnvironmentVariables, missing: MissingAPI[], _browserType: BrowserType): Promise<string[]>;
     private getDefaultSuggestions;
 }

package/dist/src/modules/emulator/AIEnvironmentAnalyzer.js

@@ -1,48 +1,9 @@
-import { logger } from '../../utils/logger.js';
-import { generateBrowserEnvAnalysisMessages, generateAntiCrawlAnalysisMessages, generateAPIImplementationMessages, generateEnvironmentSuggestionsMessages, } from '../../services/prompts/environment.js';
 export class AIEnvironmentAnalyzer {
-    llm;
-    constructor(llm) {
-        this.llm = llm;
+    constructor(legacyDependency) {
+        void legacyDependency;
     }
-    async analyze(code, detected, missing, browserType = 'chrome') {
-        if (!this.llm) {
-            logger.warn('LLM service unavailable, skipping AI environment analysis');
-            return this.getEmptyResult();
-        }
-        try {
-            logger.info(' AI...');
-            const response = await this.llm.chat(generateBrowserEnvAnalysisMessages(code, detected, missing, browserType));
-            const result = this.parseAIResponse(response.content);
-            logger.info(`AI environment analysis complete, confidence: ${(result.confidence * 100).toFixed(1)}%`);
-            return result;
-        }
-        catch (error) {
-            logger.error('AI', error);
-            return this.getEmptyResult();
-        }
-    }
-    parseAIResponse(response) {
-        try {
-            const jsonMatch = response.match(/```json\s*([\s\S]*?)\s*```/) || response.match(/\{[\s\S]*\}/);
-            if (!jsonMatch) {
-                logger.warn('AIJSON');
-                return this.getEmptyResult();
-            }
-            const jsonStr = jsonMatch[1] || jsonMatch[0];
-            const parsed = JSON.parse(jsonStr);
-            return {
-                recommendedVariables: parsed.recommendedVariables || {},
-                recommendedAPIs: parsed.recommendedAPIs || [],
-                antiCrawlFeatures: parsed.antiCrawlFeatures || [],
-                suggestions: parsed.suggestions || [],
-                confidence: parsed.confidence || 0.5,
-            };
-        }
-        catch (error) {
-            logger.error('AI', error);
-            return this.getEmptyResult();
-        }
+    async analyze(_code, _detected, _missing, _browserType = 'chrome') {
+        return this.getEmptyResult();
     }
     getEmptyResult() {
         return {
@@ -53,67 +14,14 @@ export class AIEnvironmentAnalyzer {
             confidence: 0,
         };
     }
-    async analyzeAntiCrawl(code) {
-        if (!this.llm) {
-            return [];
-        }
-        try {
-            const response = await this.llm.chat(generateAntiCrawlAnalysisMessages(code));
-            const jsonMatch = response.content.match(/```json\s*([\s\S]*?)\s*```/) ||
-                response.content.match(/\[[\s\S]*\]/);
-            if (jsonMatch) {
-                const jsonStr = jsonMatch[1] || jsonMatch[0];
-                return JSON.parse(jsonStr);
-            }
-            return [];
-        }
-        catch (error) {
-            logger.error('', error);
-            return [];
-        }
+    async analyzeAntiCrawl(_code) {
+        return [];
     }
-    async inferAPIImplementation(apiPath, context) {
-        if (!this.llm) {
-            return null;
-        }
-        try {
-            const response = await this.llm.chat(generateAPIImplementationMessages(apiPath, context));
-            const codeMatch = response.content.match(/```(?:javascript|js)?\s*([\s\S]*?)\s*```/);
-            if (codeMatch?.[1]) {
-                return codeMatch[1].trim();
-            }
-            const trimmed = response.content.trim();
-            if (trimmed.includes('function') || trimmed.includes('const') || trimmed.includes('var')) {
-                return trimmed;
-            }
-            return null;
-        }
-        catch (error) {
-            logger.error('API', error);
-            return null;
-        }
+    async inferAPIImplementation(_apiPath, _context) {
+        return null;
     }
-    async generateSuggestions(detected, missing, browserType) {
-        if (!this.llm) {
-            return this.getDefaultSuggestions(detected, missing);
-        }
-        try {
-            const response = await this.llm.chat(generateEnvironmentSuggestionsMessages(detected, missing, browserType));
-            const jsonMatch = response.content.match(/```json\s*([\s\S]*?)\s*```/) ||
-                response.content.match(/\[[\s\S]*\]/);
-            if (jsonMatch) {
-                const jsonStr = jsonMatch[1] || jsonMatch[0];
-                const suggestions = JSON.parse(jsonStr);
-                if (Array.isArray(suggestions) && suggestions.every((s) => typeof s === 'string')) {
-                    return suggestions;
-                }
-            }
-            return this.getDefaultSuggestions(detected, missing);
-        }
-        catch (error) {
-            logger.error('', error);
-            return this.getDefaultSuggestions(detected, missing);
-        }
+    async generateSuggestions(detected, missing, _browserType) {
+        return this.getDefaultSuggestions(detected, missing);
     }
     getDefaultSuggestions(detected, missing) {
         const suggestions = [];

package/dist/src/modules/emulator/EnvironmentEmulator.d.ts

@@ -1,9 +1,7 @@
 import type { EnvironmentEmulatorOptions, EnvironmentEmulatorResult } from '../../types/index.js';
-import type { LLMService } from '../../services/LLMService.js';
 export declare class EnvironmentEmulator {
     private browser?;
-    private llm?;
-    constructor(llm?: LLMService);
+    constructor(legacyDependency?: unknown);
     analyze(options: EnvironmentEmulatorOptions): Promise<EnvironmentEmulatorResult>;
     private detectEnvironmentVariables;
     private getMemberExpressionPath;
@@ -14,8 +12,6 @@ export declare class EnvironmentEmulator {
     private resolveExecutablePath;
     private identifyMissingAPIs;
     private getSuggestionForMissingAPI;
-    private generateMissingAPIImplementationsWithAI;
-    private inferMissingVariablesWithAI;
     cleanup(): Promise<void>;
     private isRecord;
     private isIdentifierNode;