@jshookmcp/jshook 0.2.6 → 0.2.7

package/dist/src/modules/deobfuscator/AdvancedDeobfuscator.ast.js

@@ -1,347 +0,0 @@
-import * as parser from '@babel/parser';
-import generate from '@babel/generator';
-import traverse, {} from '@babel/traverse';
-import * as t from '@babel/types';
-import { logger } from '../../utils/logger.js';
-export function derotateStringArray(code) {
-    logger.info('Derotating string array...');
-    try {
-        const ast = parser.parse(code, {
-            sourceType: 'module',
-            plugins: ['jsx', 'typescript'],
-        });
-        let derotated = 0;
-        traverse(ast, {
-            CallExpression(path) {
-                if (!t.isFunctionExpression(path.node.callee) &&
-                    !t.isArrowFunctionExpression(path.node.callee)) {
-                    return;
-                }
-                const func = path.node.callee;
-                if (!t.isFunctionExpression(func) || !t.isBlockStatement(func.body)) {
-                    return;
-                }
-                const hasWhileLoop = func.body.body.some((stmt) => t.isWhileStatement(stmt));
-                const hasArrayRotation = JSON.stringify(func.body).includes('push') && JSON.stringify(func.body).includes('shift');
-                if (hasWhileLoop && hasArrayRotation) {
-                    logger.debug('Found string array rotation IIFE');
-                    path.remove();
-                    derotated++;
-                }
-            },
-        });
-        if (derotated > 0) {
-            logger.info(`Removed ${derotated} string array rotation functions`);
-            return generate(ast, { comments: true, compact: false }).code;
-        }
-        return code;
-    }
-    catch (error) {
-        logger.error('Failed to derotate string array:', error);
-        return code;
-    }
-}
-export function removeDeadCode(code) {
-    logger.info('Removing dead code...');
-    try {
-        const ast = parser.parse(code, {
-            sourceType: 'module',
-            plugins: ['jsx', 'typescript'],
-        });
-        let removed = 0;
-        traverse(ast, {
-            IfStatement(path) {
-                const test = path.node.test;
-                if (t.isBooleanLiteral(test) && test.value === false) {
-                    if (path.node.alternate) {
-                        path.replaceWith(path.node.alternate);
-                    }
-                    else {
-                        path.remove();
-                    }
-                    removed++;
-                    return;
-                }
-                if (t.isBooleanLiteral(test) && test.value === true) {
-                    path.replaceWith(path.node.consequent);
-                    removed++;
-                    return;
-                }
-                if (t.isUnaryExpression(test) &&
-                    test.operator === '!' &&
-                    t.isUnaryExpression(test.argument) &&
-                    test.argument.operator === '!' &&
-                    t.isArrayExpression(test.argument.argument)) {
-                    path.replaceWith(path.node.consequent);
-                    removed++;
-                    return;
-                }
-            },
-            BlockStatement(path) {
-                const body = path.node.body;
-                let foundTerminator = false;
-                const newBody = [];
-                for (const stmt of body) {
-                    if (foundTerminator) {
-                        removed++;
-                        continue;
-                    }
-                    newBody.push(stmt);
-                    if (t.isReturnStatement(stmt) || t.isThrowStatement(stmt)) {
-                        foundTerminator = true;
-                    }
-                }
-                if (newBody.length < body.length) {
-                    path.node.body = newBody;
-                }
-            },
-        });
-        if (removed > 0) {
-            logger.info(`Removed ${removed} dead code blocks`);
-            return generate(ast, { comments: true, compact: false }).code;
-        }
-        return code;
-    }
-    catch (error) {
-        logger.error('Failed to remove dead code:', error);
-        return code;
-    }
-}
-export function removeOpaquePredicates(code) {
-    logger.info('Removing opaque predicates...');
-    try {
-        const ast = parser.parse(code, {
-            sourceType: 'module',
-            plugins: ['jsx', 'typescript'],
-        });
-        let removed = 0;
-        traverse(ast, {
-            IfStatement(path) {
-                const test = path.node.test;
-                if (t.isBinaryExpression(test)) {
-                    const left = test.left;
-                    const right = test.right;
-                    const operator = test.operator;
-                    if (t.isNumericLiteral(left) && t.isNumericLiteral(right)) {
-                        let result;
-                        switch (operator) {
-                            case '>':
-                                result = left.value > right.value;
-                                break;
-                            case '<':
-                                result = left.value < right.value;
-                                break;
-                            case '>=':
-                                result = left.value >= right.value;
-                                break;
-                            case '<=':
-                                result = left.value <= right.value;
-                                break;
-                            case '===':
-                            case '==':
-                                result = left.value === right.value;
-                                break;
-                            case '!==':
-                            case '!=':
-                                result = left.value !== right.value;
-                                break;
-                        }
-                        if (result !== undefined) {
-                            if (result) {
-                                path.replaceWith(path.node.consequent);
-                            }
-                            else if (path.node.alternate) {
-                                path.replaceWith(path.node.alternate);
-                            }
-                            else {
-                                path.remove();
-                            }
-                            removed++;
-                            return;
-                        }
-                    }
-                }
-                if (t.isBinaryExpression(test) && (test.operator === '===' || test.operator === '==')) {
-                    const left = test.left;
-                    const right = test.right;
-                    if (t.isBinaryExpression(left) &&
-                        left.operator === '*' &&
-                        t.isNumericLiteral(right) &&
-                        right.value === 0) {
-                        if ((t.isNumericLiteral(left.left) && left.left.value === 0) ||
-                            (t.isNumericLiteral(left.right) && left.right.value === 0)) {
-                            path.replaceWith(path.node.consequent);
-                            removed++;
-                        }
-                    }
-                }
-            },
-        });
-        if (removed > 0) {
-            logger.info(`Removed ${removed} opaque predicates`);
-            return generate(ast, { comments: true, compact: false }).code;
-        }
-        return code;
-    }
-    catch (error) {
-        logger.error('Failed to remove opaque predicates:', error);
-        return code;
-    }
-}
-export function decodeStrings(code) {
-    logger.info('Decoding strings...');
-    try {
-        const ast = parser.parse(code, {
-            sourceType: 'module',
-            plugins: ['jsx', 'typescript'],
-        });
-        let decoded = 0;
-        traverse(ast, {
-            CallExpression(path) {
-                if (t.isMemberExpression(path.node.callee) &&
-                    t.isIdentifier(path.node.callee.object, { name: 'String' }) &&
-                    t.isIdentifier(path.node.callee.property, { name: 'fromCharCode' })) {
-                    const numericArgs = path.node.arguments.filter((arg) => t.isNumericLiteral(arg));
-                    if (numericArgs.length === path.node.arguments.length) {
-                        const charCodes = numericArgs.map((arg) => arg.value);
-                        const decodedString = String.fromCharCode(...charCodes);
-                        path.replaceWith(t.stringLiteral(decodedString));
-                        decoded++;
-                    }
-                }
-            },
-        });
-        if (decoded > 0) {
-            logger.info(`Decoded ${decoded} string expressions`);
-            return generate(ast, { comments: false, compact: false }).code;
-        }
-        return code;
-    }
-    catch (error) {
-        logger.error('Failed to decode strings:', error);
-        return code;
-    }
-}
-export function applyASTOptimizations(code) {
-    logger.info('Applying AST optimizations...');
-    try {
-        const ast = parser.parse(code, {
-            sourceType: 'module',
-            plugins: ['jsx', 'typescript'],
-        });
-        let optimized = 0;
-        traverse(ast, {
-            BinaryExpression(path) {
-                const { left, right, operator } = path.node;
-                if (t.isNumericLiteral(left) && t.isNumericLiteral(right)) {
-                    let result;
-                    switch (operator) {
-                        case '+':
-                            result = left.value + right.value;
-                            break;
-                        case '-':
-                            result = left.value - right.value;
-                            break;
-                        case '*':
-                            result = left.value * right.value;
-                            break;
-                        case '/':
-                            result = left.value / right.value;
-                            break;
-                        case '%':
-                            result = left.value % right.value;
-                            break;
-                        case '**':
-                            result = Math.pow(left.value, right.value);
-                            break;
-                    }
-                    if (result !== undefined) {
-                        path.replaceWith(t.numericLiteral(result));
-                        optimized++;
-                    }
-                }
-            },
-            LogicalExpression(path) {
-                const { left, right, operator } = path.node;
-                if (operator === '&&' && t.isBooleanLiteral(left) && left.value === true) {
-                    path.replaceWith(right);
-                    optimized++;
-                }
-                if (operator === '||' && t.isBooleanLiteral(left) && left.value === false) {
-                    path.replaceWith(right);
-                    optimized++;
-                }
-            },
-            EmptyStatement(path) {
-                path.remove();
-                optimized++;
-            },
-            ConditionalExpression(path) {
-                const { test, consequent, alternate } = path.node;
-                if (t.isBooleanLiteral(test) && test.value === true) {
-                    path.replaceWith(consequent);
-                    optimized++;
-                }
-                if (t.isBooleanLiteral(test) && test.value === false) {
-                    path.replaceWith(alternate);
-                    optimized++;
-                }
-            },
-        });
-        if (optimized > 0) {
-            logger.info(`Applied ${optimized} AST optimizations`);
-            return generate(ast, { comments: true, compact: false }).code;
-        }
-        return code;
-    }
-    catch (error) {
-        logger.error('Failed to apply AST optimizations:', error);
-        return code;
-    }
-}
-export function estimateCodeComplexity(code) {
-    try {
-        const ast = parser.parse(code, {
-            sourceType: 'module',
-            plugins: ['jsx', 'typescript'],
-        });
-        let complexity = 0;
-        traverse(ast, {
-            FunctionDeclaration() {
-                complexity += 2;
-            },
-            FunctionExpression() {
-                complexity += 2;
-            },
-            ArrowFunctionExpression() {
-                complexity += 2;
-            },
-            IfStatement() {
-                complexity += 1;
-            },
-            SwitchStatement() {
-                complexity += 2;
-            },
-            ConditionalExpression() {
-                complexity += 1;
-            },
-            WhileStatement() {
-                complexity += 2;
-            },
-            ForStatement() {
-                complexity += 2;
-            },
-            DoWhileStatement() {
-                complexity += 2;
-            },
-            TryStatement() {
-                complexity += 3;
-            },
-        });
-        return complexity;
-    }
-    catch (err) {
-        logger.debug(`[AST] Complexity calculation failed, using fallback: ${err instanceof Error ? err.message : String(err)}`);
-        return 100;
-    }
-}

package/dist/src/modules/deobfuscator/AdvancedDeobfuscator.d.ts

@@ -1,43 +0,0 @@
-import type { DeobfuscateBundleSummary, DeobfuscateMappingRule, DeobfuscateSavedArtifact } from '../../types/deobfuscator.js';
-export interface AdvancedDeobfuscateOptions {
-    code: string;
-    detectOnly?: boolean;
-    aggressiveVM?: boolean;
-    useASTOptimization?: boolean;
-    timeout?: number;
-    unpack?: boolean;
-    unminify?: boolean;
-    jsx?: boolean;
-    mangle?: boolean;
-    outputDir?: string;
-    forceOutput?: boolean;
-    includeModuleCode?: boolean;
-    maxBundleModules?: number;
-    mappings?: DeobfuscateMappingRule[];
-}
-export interface AdvancedDeobfuscateResult {
-    code: string;
-    detectedTechniques: string[];
-    confidence: number;
-    warnings: string[];
-    cached?: boolean;
-    astOptimized?: boolean;
-    bundle?: DeobfuscateBundleSummary;
-    savedTo?: string;
-    savedArtifacts?: DeobfuscateSavedArtifact[];
-    engine?: 'webcrack';
-    webcrackApplied?: boolean;
-    vmDetected?: {
-        type: string;
-        instructions: number;
-        deobfuscated: boolean;
-    };
-}
-export declare class AdvancedDeobfuscator {
-    private resultCache;
-    private maxCacheSize;
-    private generateCacheKey;
-    deobfuscate(options: AdvancedDeobfuscateOptions): Promise<AdvancedDeobfuscateResult>;
-    private storeCacheEntry;
-    private calculateConfidence;
-}

package/dist/src/modules/deobfuscator/AdvancedDeobfuscator.js

@@ -1,125 +0,0 @@
-import { logger } from '../../utils/logger.js';
-import { runWebcrack } from '../deobfuscator/webcrack.js';
-import { detectObfuscationType as detectObfuscationTypeUtil } from '../deobfuscator/Deobfuscator.utils.js';
-import crypto from 'crypto';
-export class AdvancedDeobfuscator {
-    resultCache = new Map();
-    maxCacheSize = 100;
-    generateCacheKey(options) {
-        const key = JSON.stringify({
-            aggressiveVM: options.aggressiveVM,
-            code: options.code.substring(0, 2000),
-            detectOnly: options.detectOnly,
-            forceOutput: options.forceOutput,
-            includeModuleCode: options.includeModuleCode,
-            jsx: options.jsx,
-            mangle: options.mangle,
-            mappings: options.mappings,
-            maxBundleModules: options.maxBundleModules,
-            outputDir: options.outputDir,
-            timeout: options.timeout,
-            unpack: options.unpack,
-            unminify: options.unminify,
-            useASTOptimization: options.useASTOptimization,
-        });
-        return crypto.createHash('md5').update(key).digest('hex');
-    }
-    async deobfuscate(options) {
-        const cacheKey = this.generateCacheKey(options);
-        const cached = this.resultCache.get(cacheKey);
-        if (cached) {
-            logger.debug('Advanced deobfuscation result from cache');
-            return { ...cached, cached: true };
-        }
-        logger.info('Starting advanced webcrack deobfuscation...');
-        const detectedTechniques = detectObfuscationTypeUtil(options.code);
-        const warnings = [];
-        if (options.aggressiveVM !== undefined) {
-            warnings.push('aggressiveVM is deprecated and ignored; VM-specific legacy logic has been removed.');
-        }
-        if (options.useASTOptimization !== undefined) {
-            warnings.push('useASTOptimization is deprecated and ignored; legacy AST post-processing has been removed.');
-        }
-        if (options.timeout !== undefined) {
-            warnings.push('timeout is currently ignored; webcrack controls its own execution flow.');
-        }
-        if (options.detectOnly) {
-            const result = {
-                code: options.code,
-                detectedTechniques,
-                confidence: Math.min(0.6 + detectedTechniques.length * 0.05, 0.9),
-                warnings: [
-                    ...warnings,
-                    'detectOnly does not invoke a separate legacy detector anymore; techniques are inferred from the current static signature pass.',
-                ],
-                astOptimized: false,
-                engine: 'webcrack',
-                webcrackApplied: false,
-            };
-            this.storeCacheEntry(cacheKey, result);
-            return { ...result, cached: false };
-        }
-        const webcrackResult = await runWebcrack(options.code, {
-            unpack: options.unpack,
-            unminify: options.unminify,
-            jsx: options.jsx,
-            mangle: options.mangle,
-            mappings: options.mappings,
-            includeModuleCode: options.includeModuleCode,
-            maxBundleModules: options.maxBundleModules,
-            outputDir: options.outputDir,
-            forceOutput: options.forceOutput,
-        });
-        if (!webcrackResult.applied) {
-            const reason = webcrackResult.reason ?? 'webcrack did not return a result';
-            logger.error(`advanced webcrack deobfuscation failed: ${reason}`);
-            throw new Error(reason);
-        }
-        if (webcrackResult.bundle) {
-            detectedTechniques.push('bundle-unpack');
-        }
-        if (webcrackResult.optionsUsed.unminify) {
-            detectedTechniques.push('unminify');
-        }
-        if (webcrackResult.optionsUsed.jsx) {
-            detectedTechniques.push('jsx-decompile');
-        }
-        if (webcrackResult.optionsUsed.mangle) {
-            detectedTechniques.push('mangle');
-        }
-        detectedTechniques.push('webcrack');
-        const result = {
-            code: webcrackResult.code,
-            detectedTechniques: Array.from(new Set(detectedTechniques)),
-            confidence: this.calculateConfidence(webcrackResult, detectedTechniques),
-            warnings,
-            astOptimized: false,
-            bundle: webcrackResult.bundle,
-            savedTo: webcrackResult.savedTo,
-            savedArtifacts: webcrackResult.savedArtifacts,
-            engine: 'webcrack',
-            webcrackApplied: true,
-        };
-        this.storeCacheEntry(cacheKey, result);
-        return { ...result, cached: false };
-    }
-    storeCacheEntry(cacheKey, result) {
-        if (this.resultCache.size >= this.maxCacheSize) {
-            const firstKey = this.resultCache.keys().next().value;
-            if (firstKey) {
-                this.resultCache.delete(firstKey);
-            }
-        }
-        this.resultCache.set(cacheKey, result);
-    }
-    calculateConfidence(webcrackResult, detectedTechniques) {
-        let confidence = 0.72 + detectedTechniques.length * 0.03;
-        if (webcrackResult.bundle) {
-            confidence += 0.08;
-        }
-        if (webcrackResult.savedTo) {
-            confidence += 0.04;
-        }
-        return Math.min(confidence, 0.99);
-    }
-}

package/dist/src/modules/deobfuscator/Deobfuscator.d.ts

@@ -1,12 +0,0 @@
-import type { DeobfuscateOptions, DeobfuscateResult } from '../../types/index.js';
-export declare class Deobfuscator {
-    private resultCache;
-    private maxCacheSize;
-    constructor(legacyDependency?: unknown);
-    private generateCacheKey;
-    deobfuscate(options: DeobfuscateOptions): Promise<DeobfuscateResult>;
-    private detectObfuscationType;
-    private calculateReadabilityScore;
-    private calculateConfidence;
-    private buildAnalysis;
-}

package/dist/src/modules/deobfuscator/Deobfuscator.js

@@ -1,150 +0,0 @@
-import crypto from 'crypto';
-import { logger } from '../../utils/logger.js';
-import { calculateReadabilityScore as calculateReadabilityScoreUtil, detectObfuscationType as detectObfuscationTypeUtil, } from '../deobfuscator/Deobfuscator.utils.js';
-import { runWebcrack } from '../deobfuscator/webcrack.js';
-export class Deobfuscator {
-    resultCache = new Map();
-    maxCacheSize = 100;
-    constructor(legacyDependency) {
-        void legacyDependency;
-    }
-    generateCacheKey(options) {
-        const key = JSON.stringify({
-            aggressive: options.aggressive,
-            code: options.code.substring(0, 2000),
-            forceOutput: options.forceOutput,
-            includeModuleCode: options.includeModuleCode,
-            inlineFunctions: options.inlineFunctions,
-            jsx: options.jsx,
-            llm: false,
-            mangle: options.mangle ?? options.renameVariables,
-            mappings: options.mappings,
-            maxBundleModules: options.maxBundleModules,
-            outputDir: options.outputDir,
-            preserveLogic: options.preserveLogic,
-            unpack: options.unpack,
-            unminify: options.unminify,
-        });
-        return crypto.createHash('md5').update(key).digest('hex');
-    }
-    async deobfuscate(options) {
-        const cacheKey = this.generateCacheKey(options);
-        const cached = this.resultCache.get(cacheKey);
-        if (cached) {
-            logger.debug('Deobfuscation result from cache');
-            cached.cached = true;
-            return cached;
-        }
-        logger.info('Starting webcrack deobfuscation...');
-        const startTime = Date.now();
-        const obfuscationType = this.detectObfuscationType(options.code);
-        const warnings = [];
-        if (options.aggressive !== undefined) {
-            warnings.push('aggressive is deprecated and ignored; webcrack is now the only deobfuscation engine.');
-        }
-        if (options.preserveLogic !== undefined) {
-            warnings.push('preserveLogic is deprecated and ignored.');
-        }
-        if (options.inlineFunctions !== undefined) {
-            warnings.push('inlineFunctions is deprecated and ignored.');
-        }
-        const webcrackResult = await runWebcrack(options.code, {
-            unpack: options.unpack,
-            unminify: options.unminify,
-            jsx: options.jsx,
-            mangle: options.mangle ?? options.renameVariables,
-            mappings: options.mappings,
-            includeModuleCode: options.includeModuleCode,
-            maxBundleModules: options.maxBundleModules,
-            outputDir: options.outputDir,
-            forceOutput: options.forceOutput,
-        });
-        if (!webcrackResult.applied) {
-            const reason = webcrackResult.reason ?? 'webcrack did not return a result';
-            logger.error(`webcrack deobfuscation failed: ${reason}`);
-            throw new Error(reason);
-        }
-        const analysis = this.buildAnalysis(webcrackResult, obfuscationType);
-        const transformations = [
-            {
-                type: 'webcrack',
-                description: `Ran webcrack (unminify=${webcrackResult.optionsUsed.unminify}, unpack=${webcrackResult.optionsUsed.unpack}, jsx=${webcrackResult.optionsUsed.jsx}, mangle=${webcrackResult.optionsUsed.mangle})`,
-                success: true,
-            },
-            ...(webcrackResult.bundle
-                ? [
-                    {
-                        type: 'webcrack-unpack',
-                        description: `Recovered ${webcrackResult.bundle.moduleCount} bundled modules`,
-                        success: true,
-                    },
-                ]
-                : []),
-            ...(webcrackResult.savedTo
-                ? [
-                    {
-                        type: 'webcrack-save',
-                        description: `Saved webcrack artifacts to ${webcrackResult.savedTo}`,
-                        success: true,
-                    },
-                ]
-                : []),
-        ];
-        const readabilityScore = this.calculateReadabilityScore(webcrackResult.code);
-        const confidence = this.calculateConfidence(webcrackResult, readabilityScore);
-        const duration = Date.now() - startTime;
-        logger.success(`webcrack deobfuscation completed in ${duration}ms (confidence: ${(confidence * 100).toFixed(1)}%)`);
-        const result = {
-            code: webcrackResult.code,
-            readabilityScore,
-            confidence,
-            obfuscationType,
-            transformations,
-            analysis,
-            bundle: webcrackResult.bundle,
-            savedTo: webcrackResult.savedTo,
-            savedArtifacts: webcrackResult.savedArtifacts,
-            warnings: warnings.length > 0 ? warnings : undefined,
-            engine: 'webcrack',
-            webcrackApplied: true,
-        };
-        if (this.resultCache.size >= this.maxCacheSize) {
-            const firstKey = this.resultCache.keys().next().value;
-            if (firstKey) {
-                this.resultCache.delete(firstKey);
-            }
-        }
-        result.cached = false;
-        this.resultCache.set(cacheKey, result);
-        return result;
-    }
-    detectObfuscationType(code) {
-        return detectObfuscationTypeUtil(code);
-    }
-    calculateReadabilityScore(code) {
-        return calculateReadabilityScoreUtil(code);
-    }
-    calculateConfidence(webcrackResult, readabilityScore) {
-        let confidence = 0.7;
-        confidence += readabilityScore / 500;
-        if (webcrackResult.bundle) {
-            confidence += 0.1;
-        }
-        if (webcrackResult.savedTo) {
-            confidence += 0.05;
-        }
-        return Math.min(confidence, 0.99);
-    }
-    buildAnalysis(webcrackResult, obfuscationType) {
-        const parts = [
-            `webcrack completed deobfuscation for detected types: ${obfuscationType.join(', ')}.`,
-        ];
-        if (webcrackResult.bundle) {
-            parts.push(`Recovered a ${webcrackResult.bundle.type} bundle with ${webcrackResult.bundle.moduleCount} modules.`);
-        }
-        if (webcrackResult.savedTo) {
-            parts.push(`Artifacts saved to ${webcrackResult.savedTo}.`);
-        }
-        return parts.join(' ');
-    }
-}

package/dist/src/modules/deobfuscator/Deobfuscator.utils.d.ts

@@ -1,3 +0,0 @@
-import type { ObfuscationType } from '../../types/index.js';
-export declare function detectObfuscationType(code: string): ObfuscationType[];
-export declare function calculateReadabilityScore(code: string): number;