@jshookmcp/jshook 0.2.5 → 0.2.7

package/dist/src/modules/deobfuscator/JScramblerDeobfuscator.js

@@ -1,235 +0,0 @@
-import * as parser from '@babel/parser';
-import traverse from '@babel/traverse';
-import generate from '@babel/generator';
-import * as t from '@babel/types';
-import { logger } from '../../utils/logger.js';
-export class JScramberDeobfuscator {
-    async deobfuscate(options) {
-        const { code, removeDeadCode = true, restoreControlFlow = true, decryptStrings = true, simplifyExpressions = true, } = options;
-        logger.info(' JScrambler...');
-        const transformations = [];
-        const warnings = [];
-        let currentCode = code;
-        try {
-            const ast = parser.parse(currentCode, {
-                sourceType: 'unambiguous',
-                plugins: ['jsx', 'typescript'],
-                errorRecovery: true,
-            });
-            if (this.detectSelfDefending(ast)) {
-                this.removeSelfDefending(ast);
-                transformations.push('');
-            }
-            if (decryptStrings) {
-                const decrypted = this.decryptStrings(ast);
-                if (decrypted > 0) {
-                    transformations.push(`: ${decrypted}`);
-                }
-            }
-            if (restoreControlFlow) {
-                const restored = this.restoreControlFlow(ast);
-                if (restored > 0) {
-                    transformations.push(`: ${restored}`);
-                }
-            }
-            if (removeDeadCode) {
-                const removed = this.removeDeadCode(ast);
-                if (removed > 0) {
-                    transformations.push(`: ${removed}`);
-                }
-            }
-            if (simplifyExpressions) {
-                const simplified = this.simplifyExpressions(ast);
-                if (simplified > 0) {
-                    transformations.push(`: ${simplified}`);
-                }
-            }
-            const output = generate(ast, {
-                comments: true,
-                compact: false,
-            });
-            currentCode = output.code;
-            const confidence = this.calculateConfidence(transformations.length);
-            logger.info(`JScrambler deobfuscation complete, ${transformations.length} transformations applied`);
-            return {
-                code: currentCode,
-                success: true,
-                transformations,
-                warnings,
-                confidence,
-            };
-        }
-        catch (error) {
-            logger.error('JScrambler', error);
-            return {
-                code: currentCode,
-                success: false,
-                transformations,
-                warnings: [...warnings, String(error)],
-                confidence: 0,
-            };
-        }
-    }
-    detectSelfDefending(ast) {
-        let hasSelfDefending = false;
-        traverse(ast, {
-            FunctionDeclaration(path) {
-                if (path.node.body.body.some((stmt) => t.isDebuggerStatement(stmt))) {
-                    hasSelfDefending = true;
-                }
-                const code = generate(path.node).code;
-                if (code.includes('toString') && code.includes('constructor')) {
-                    hasSelfDefending = true;
-                }
-            },
-        });
-        return hasSelfDefending;
-    }
-    removeSelfDefending(ast) {
-        traverse(ast, {
-            DebuggerStatement(path) {
-                path.remove();
-            },
-            CallExpression(path) {
-                if (t.isIdentifier(path.node.callee) &&
-                    (path.node.callee.name === 'setInterval' || path.node.callee.name === 'setTimeout')) {
-                    const arg = path.node.arguments[0];
-                    if (t.isFunctionExpression(arg) || t.isArrowFunctionExpression(arg)) {
-                        const body = arg.body;
-                        if (t.isBlockStatement(body)) {
-                            if (body.body.some((stmt) => t.isDebuggerStatement(stmt))) {
-                                path.remove();
-                            }
-                        }
-                    }
-                }
-            },
-        });
-    }
-    decryptStrings(ast) {
-        let count = 0;
-        const decryptFunctions = this.findDecryptFunctions(ast);
-        traverse(ast, {
-            CallExpression(path) {
-                if (t.isIdentifier(path.node.callee)) {
-                    const funcName = path.node.callee.name;
-                    if (decryptFunctions.has(funcName)) {
-                        try {
-                            const decrypted = '[DECRYPTED_STRING]';
-                            path.replaceWith(t.stringLiteral(decrypted));
-                            count++;
-                        }
-                        catch { }
-                    }
-                }
-            },
-        });
-        return count;
-    }
-    findDecryptFunctions(ast) {
-        const decryptFunctions = new Set();
-        traverse(ast, {
-            FunctionDeclaration(path) {
-                const code = generate(path.node).code;
-                if (code.includes('charCodeAt') &&
-                    code.includes('fromCharCode') &&
-                    code.includes('split')) {
-                    if (path.node.id) {
-                        decryptFunctions.add(path.node.id.name);
-                    }
-                }
-            },
-        });
-        return decryptFunctions;
-    }
-    restoreControlFlow(ast) {
-        let count = 0;
-        traverse(ast, {
-            WhileStatement: (path) => {
-                if (this.isControlFlowFlatteningPattern(path.node)) {
-                    try {
-                        this.unflattenControlFlowPattern(path);
-                        count++;
-                    }
-                    catch { }
-                }
-            },
-        });
-        return count;
-    }
-    isControlFlowFlatteningPattern(node) {
-        if (!t.isBooleanLiteral(node.test) || !node.test.value) {
-            return false;
-        }
-        if (!t.isBlockStatement(node.body)) {
-            return false;
-        }
-        const firstStmt = node.body.body[0];
-        return t.isSwitchStatement(firstStmt);
-    }
-    unflattenControlFlowPattern(path) {
-        const whileStmt = path.node;
-        if (t.isBlockStatement(whileStmt.body)) {
-            const switchStmt = whileStmt.body.body[0];
-            if (t.isSwitchStatement(switchStmt)) {
-                path.replaceWithMultiple(switchStmt.cases.map((c) => c.consequent).flat());
-            }
-        }
-    }
-    removeDeadCode(ast) {
-        let count = 0;
-        traverse(ast, {
-            IfStatement(path) {
-                if (t.isBooleanLiteral(path.node.test)) {
-                    if (path.node.test.value) {
-                        path.replaceWith(path.node.consequent);
-                    }
-                    else {
-                        if (path.node.alternate) {
-                            path.replaceWith(path.node.alternate);
-                        }
-                        else {
-                            path.remove();
-                        }
-                    }
-                    count++;
-                }
-            },
-        });
-        return count;
-    }
-    simplifyExpressions(ast) {
-        let count = 0;
-        traverse(ast, {
-            BinaryExpression(path) {
-                if (t.isNumericLiteral(path.node.left) && t.isNumericLiteral(path.node.right)) {
-                    const left = path.node.left.value;
-                    const right = path.node.right.value;
-                    let result;
-                    switch (path.node.operator) {
-                        case '+':
-                            result = left + right;
-                            break;
-                        case '-':
-                            result = left - right;
-                            break;
-                        case '*':
-                            result = left * right;
-                            break;
-                        case '/':
-                            result = left / right;
-                            break;
-                    }
-                    if (result !== undefined) {
-                        path.replaceWith(t.numericLiteral(result));
-                        count++;
-                    }
-                }
-            },
-        });
-        return count;
-    }
-    calculateConfidence(transformationCount) {
-        return Math.min(transformationCount / 5, 1.0);
-    }
-}

package/dist/src/modules/deobfuscator/PackerDeobfuscator.d.ts

@@ -1,39 +0,0 @@
-export interface PackerDeobfuscatorOptions {
-    code: string;
-    maxIterations?: number;
-}
-export interface PackerDeobfuscatorResult {
-    code: string;
-    success: boolean;
-    iterations: number;
-    warnings: string[];
-}
-export declare class PackerDeobfuscator {
-    private readonly sandbox;
-    static detect(code: string): boolean;
-    deobfuscate(options: PackerDeobfuscatorOptions): Promise<PackerDeobfuscatorResult>;
-    private unpack;
-    private parsePackerParams;
-    private executeUnpacker;
-    private base;
-    beautify(code: string): string;
-}
-export declare class AAEncodeDeobfuscator {
-    private readonly sandbox;
-    static detect(code: string): boolean;
-    deobfuscate(code: string): Promise<string>;
-}
-export declare class URLEncodeDeobfuscator {
-    static detect(code: string): boolean;
-    deobfuscate(code: string): Promise<string>;
-}
-export declare class UniversalUnpacker {
-    private packerDeobfuscator;
-    private aaencodeDeobfuscator;
-    private urlencodeDeobfuscator;
-    deobfuscate(code: string): Promise<{
-        code: string;
-        type: string;
-        success: boolean;
-    }>;
-}

package/dist/src/modules/deobfuscator/PackerDeobfuscator.js

@@ -1,212 +0,0 @@
-import { logger } from '../../utils/logger.js';
-import { PACKER_SANDBOX_TIMEOUT_MS } from '../../constants.js';
-import { ExecutionSandbox } from '../security/ExecutionSandbox.js';
-export class PackerDeobfuscator {
-    sandbox = new ExecutionSandbox();
-    static detect(code) {
-        const packerPattern = /eval\s*\(\s*function\s*\(\s*p\s*,\s*a\s*,\s*c\s*,\s*k\s*,\s*e\s*,\s*[dr]\s*\)/;
-        return packerPattern.test(code);
-    }
-    async deobfuscate(options) {
-        const { code, maxIterations = 5 } = options;
-        logger.info(' Packer...');
-        const warnings = [];
-        let currentCode = code;
-        let iterations = 0;
-        try {
-            while (PackerDeobfuscator.detect(currentCode) && iterations < maxIterations) {
-                const unpacked = await this.unpack(currentCode);
-                if (!unpacked || unpacked === currentCode) {
-                    warnings.push('');
-                    break;
-                }
-                currentCode = unpacked;
-                iterations++;
-                logger.info(`  ${iterations} `);
-            }
-            logger.info(`Packer deobfuscation complete in ${iterations} iterations`);
-            return {
-                code: currentCode,
-                success: true,
-                iterations,
-                warnings,
-            };
-        }
-        catch (error) {
-            logger.error('Packer', error);
-            return {
-                code: currentCode,
-                success: false,
-                iterations,
-                warnings: [...warnings, String(error)],
-            };
-        }
-    }
-    async unpack(code) {
-        const match = code.match(/eval\s*\(\s*function\s*\(\s*p\s*,\s*a\s*,\s*c\s*,\s*k\s*,\s*e\s*,\s*[dr]\s*\)\s*{([\s\S]*?)}\s*\((.*?)\)\s*\)/);
-        if (!match?.[2]) {
-            return code;
-        }
-        const args = match[2];
-        const params = await this.parsePackerParams(args);
-        if (!params) {
-            return code;
-        }
-        try {
-            const unpacked = this.executeUnpacker(params);
-            return unpacked || code;
-        }
-        catch (error) {
-            logger.warn('', error);
-            return code;
-        }
-    }
-    async parsePackerParams(argsString) {
-        try {
-            const sandboxResult = await this.sandbox.execute({
-                code: `return [${argsString}];`,
-                timeoutMs: PACKER_SANDBOX_TIMEOUT_MS,
-            });
-            if (!sandboxResult.ok)
-                return null;
-            const params = sandboxResult.output;
-            if (!Array.isArray(params) || params.length < 4) {
-                return null;
-            }
-            return {
-                p: params[0] || '',
-                a: params[1] || 0,
-                c: params[2] || 0,
-                k: (typeof params[3] === 'string' ? params[3] : '').split('|'),
-                e: params[4] ||
-                    function (c) {
-                        return c;
-                    },
-                d: params[5] ||
-                    function () {
-                        return '';
-                    },
-            };
-        }
-        catch {
-            return null;
-        }
-    }
-    executeUnpacker(params) {
-        const { p, a, k } = params;
-        let { c } = params;
-        let result = p;
-        while (c--) {
-            const replacement = k[c];
-            if (replacement) {
-                const pattern = new RegExp('\\b' + this.base(c, a) + '\\b', 'g');
-                result = result.replace(pattern, replacement);
-            }
-        }
-        return result;
-    }
-    base(num, radix) {
-        const digits = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
-        if (num === 0) {
-            return '0';
-        }
-        let result = '';
-        while (num > 0) {
-            result = digits[num % radix] + result;
-            num = Math.floor(num / radix);
-        }
-        return result || '0';
-    }
-    beautify(code) {
-        let result = code;
-        result = result.replace(/;/g, ';\n');
-        result = result.replace(/{/g, '{\n');
-        result = result.replace(/}/g, '\n}\n');
-        result = result.replace(/\n\n+/g, '\n\n');
-        return result.trim();
-    }
-}
-export class AAEncodeDeobfuscator {
-    sandbox = new ExecutionSandbox();
-    static detect(code) {
-        return code.includes('゜-゜') || code.includes('ω゜') || code.includes('o゜)');
-    }
-    async deobfuscate(code) {
-        logger.info(' AAEncode...');
-        try {
-            const sandboxResult = await this.sandbox.execute({
-                code: `return (${code})`,
-                timeoutMs: 5000,
-            });
-            const decoded = sandboxResult.ok ? sandboxResult.output : undefined;
-            if (typeof decoded === 'string') {
-                logger.info(' AAEncode');
-                return decoded;
-            }
-            return code;
-        }
-        catch (error) {
-            logger.error('AAEncode', error);
-            return code;
-        }
-    }
-}
-export class URLEncodeDeobfuscator {
-    static detect(code) {
-        const percentCount = (code.match(/%[0-9A-Fa-f]{2}/g) || []).length;
-        return percentCount > 10;
-    }
-    async deobfuscate(code) {
-        logger.info(' URLEncode...');
-        try {
-            const decoded = decodeURIComponent(code);
-            logger.info(' URLEncode');
-            return decoded;
-        }
-        catch (error) {
-            logger.error('URLEncode', error);
-            return code;
-        }
-    }
-}
-export class UniversalUnpacker {
-    packerDeobfuscator = new PackerDeobfuscator();
-    aaencodeDeobfuscator = new AAEncodeDeobfuscator();
-    urlencodeDeobfuscator = new URLEncodeDeobfuscator();
-    async deobfuscate(code) {
-        logger.info(' ...');
-        if (PackerDeobfuscator.detect(code)) {
-            logger.info(': Packer');
-            const result = await this.packerDeobfuscator.deobfuscate({ code });
-            return {
-                code: result.code,
-                type: 'Packer',
-                success: result.success,
-            };
-        }
-        if (AAEncodeDeobfuscator.detect(code)) {
-            logger.info(': AAEncode');
-            const decoded = await this.aaencodeDeobfuscator.deobfuscate(code);
-            return {
-                code: decoded,
-                type: 'AAEncode',
-                success: decoded !== code,
-            };
-        }
-        if (URLEncodeDeobfuscator.detect(code)) {
-            logger.info(': URLEncode');
-            const decoded = await this.urlencodeDeobfuscator.deobfuscate(code);
-            return {
-                code: decoded,
-                type: 'URLEncode',
-                success: decoded !== code,
-            };
-        }
-        logger.info('');
-        return {
-            code,
-            type: 'Unknown',
-            success: false,
-        };
-    }
-}

package/dist/src/modules/deobfuscator/VMDeobfuscator.d.ts

@@ -1,31 +0,0 @@
-type VMStructure = {
-    hasInterpreter: boolean;
-    instructionTypes: string[];
-    hasStack: boolean;
-    hasRegisters: boolean;
-};
-type VMComponents = {
-    instructionArray?: string;
-    dataArray?: string;
-    interpreterFunction?: string;
-};
-export declare class VMDeobfuscator {
-    constructor(legacyDependency?: unknown);
-    detectVMProtection(code: string): {
-        detected: boolean;
-        type: string;
-        instructionCount: number;
-    };
-    countVMInstructions(code: string): number;
-    deobfuscateVM(code: string, _vmInfo: {
-        type: string;
-        instructionCount: number;
-    }): Promise<{
-        success: boolean;
-        code: string;
-    }>;
-    analyzeVMStructure(code: string): VMStructure;
-    extractVMComponents(code: string): VMComponents;
-    simplifyVMCode(code: string, vmComponents: VMComponents): string;
-}
-export {};

package/dist/src/modules/deobfuscator/VMDeobfuscator.js

@@ -1,133 +0,0 @@
-import { logger } from '../../utils/logger.js';
-import * as parser from '@babel/parser';
-import traverse from '@babel/traverse';
-import * as t from '@babel/types';
-export class VMDeobfuscator {
-    constructor(legacyDependency) {
-        void legacyDependency;
-    }
-    detectVMProtection(code) {
-        const vmPatterns = [
-            /while\s*\(\s*true\s*\)\s*\{[\s\S]*?switch\s*\(/i,
-            /var\s+\w+\s*=\s*\[\s*\d+(?:\s*,\s*\d+){10,}\s*\]/i,
-            /\w+\[pc\+\+\]/i,
-            /stack\.push|stack\.pop/i,
-        ];
-        const matchCount = vmPatterns.filter((pattern) => pattern.test(code)).length;
-        if (matchCount >= 2) {
-            return {
-                detected: true,
-                type: matchCount >= 3 ? 'custom-vm' : 'simple-vm',
-                instructionCount: this.countVMInstructions(code),
-            };
-        }
-        return { detected: false, type: 'none', instructionCount: 0 };
-    }
-    countVMInstructions(code) {
-        const match = code.match(/case\s+\d+:/g);
-        return match ? match.length : 0;
-    }
-    async deobfuscateVM(code, _vmInfo) {
-        logger.warn('VM deobfuscation is experimental and may fail');
-        try {
-            const vmStructure = this.analyzeVMStructure(code);
-            if (vmStructure.hasInterpreter) {
-                logger.info(`Detected VM interpreter with ${vmStructure.instructionTypes.length} instruction types`);
-            }
-            const vmComponents = this.extractVMComponents(code);
-            const simplifiedCode = this.simplifyVMCode(code, vmComponents);
-            return {
-                success: simplifiedCode !== code,
-                code: simplifiedCode,
-            };
-        }
-        catch (error) {
-            logger.error('VM deobfuscation failed', error);
-            return { success: false, code };
-        }
-    }
-    analyzeVMStructure(code) {
-        const structure = {
-            hasInterpreter: false,
-            instructionTypes: [],
-            hasStack: false,
-            hasRegisters: false,
-        };
-        if (/while\s*\(\s*true\s*\)|for\s*\(\s*;\s*;\s*\)/.test(code)) {
-            structure.hasInterpreter = true;
-        }
-        const switchMatches = code.match(/case\s+0x[0-9a-f]+:/gi);
-        if (switchMatches && switchMatches.length > 10) {
-            structure.hasInterpreter = true;
-            structure.instructionTypes = switchMatches.map((m) => m.replace(/case\s+/i, '').replace(/:/, ''));
-        }
-        if (/\.push\(|\.pop\(/.test(code)) {
-            structure.hasStack = true;
-        }
-        if (/r\d+\s*=|reg\[\d+\]/.test(code)) {
-            structure.hasRegisters = true;
-        }
-        return structure;
-    }
-    extractVMComponents(code) {
-        const components = {};
-        try {
-            const ast = parser.parse(code, {
-                sourceType: 'module',
-                plugins: ['jsx', 'typescript'],
-            });
-            traverse(ast, {
-                VariableDeclarator(path) {
-                    if (t.isArrayExpression(path.node.init)) {
-                        const arrayLength = path.node.init.elements.length;
-                        if (arrayLength > 50) {
-                            const arrayName = t.isIdentifier(path.node.id) ? path.node.id.name : 'unknown';
-                            const firstElement = path.node.init.elements[0];
-                            if (t.isNumericLiteral(firstElement)) {
-                                components.instructionArray = arrayName;
-                            }
-                            else if (t.isStringLiteral(firstElement)) {
-                                components.dataArray = arrayName;
-                            }
-                        }
-                    }
-                },
-                FunctionDeclaration(path) {
-                    let hasBigSwitch = false;
-                    traverse(path.node, {
-                        SwitchStatement(switchPath) {
-                            if (switchPath.node.cases.length > 10) {
-                                hasBigSwitch = true;
-                            }
-                        },
-                    }, path.scope, path);
-                    if (hasBigSwitch && t.isIdentifier(path.node.id)) {
-                        components.interpreterFunction = path.node.id.name;
-                    }
-                },
-            });
-        }
-        catch (error) {
-            logger.debug('Failed to extract VM components:', error);
-        }
-        return components;
-    }
-    simplifyVMCode(code, vmComponents) {
-        try {
-            let simplified = code;
-            if (vmComponents.interpreterFunction) {
-                const regex = new RegExp(`function\\s+${vmComponents.interpreterFunction}\\s*\\([^)]*\\)\\s*\\{[^}]*\\}`, 'g');
-                simplified = simplified.replace(regex, '/* vm interpreter removed */');
-            }
-            if (vmComponents.instructionArray) {
-                const regex = new RegExp(`var\\s+${vmComponents.instructionArray}\\s*=\\s*\\[[^\\]]*\\];`, 'g');
-                simplified = simplified.replace(regex, '/* vm instruction array removed */');
-            }
-            return simplified;
-        }
-        catch (error) {
-            logger.debug('Failed to simplify VM code:', error);
-            return code;
-        }
-    }
-}

package/dist/src/modules/deobfuscator/webcrack.d.ts

@@ -1,13 +0,0 @@
-import type { DeobfuscateBundleSummary, DeobfuscateOptions, DeobfuscateSavedArtifact } from '../../types/deobfuscator.js';
-type WebcrackInvocationOptions = Pick<DeobfuscateOptions, 'forceOutput' | 'includeModuleCode' | 'jsx' | 'mangle' | 'mappings' | 'maxBundleModules' | 'outputDir' | 'unminify' | 'unpack'>;
-export interface WebcrackExecutionResult {
-    applied: boolean;
-    code: string;
-    bundle?: DeobfuscateBundleSummary;
-    savedTo?: string;
-    savedArtifacts?: DeobfuscateSavedArtifact[];
-    optionsUsed: Required<Pick<DeobfuscateOptions, 'jsx' | 'mangle' | 'unminify' | 'unpack'>>;
-    reason?: string;
-}
-export declare function runWebcrack(code: string, options: WebcrackInvocationOptions): Promise<WebcrackExecutionResult>;
-export {};