deepspider 0.1.0

package/test/samples/v5_control_flow.js

@@ -0,0 +1,86 @@
+/**
+ * v5: 手写控制流平坦化
+ * 技术: 将线性代码转换为状态机，打乱执行顺序
+ * 特点: 增加静态分析难度，隐藏真实执行流程
+ */
+
+(function() {
+  var _0x = { s: 'deepspider_test_2024', a: 'app_12345' };
+  var _state = 0x7a3f;
+  var _vars = {};
+  var _result = null;
+
+  while (true) {
+    switch (_state) {
+      case 0x7a3f:
+        _vars.hashFn = function(str) {
+          var h = 0;
+          for (var i = 0; i < str.length; i++) {
+            h = ((h << 5) - h) + str.charCodeAt(i);
+            h = h & h;
+          }
+          return Math.abs(h).toString(16);
+        };
+        _state = 0x2b1c;
+        break;
+
+      case 0x2b1c:
+        _vars.tsFn = function() {
+          return Math.floor(Date.now() / 1000);
+        };
+        _state = 0x9d4e;
+        break;
+
+      case 0x9d4e:
+        _vars.randFn = function(len) {
+          var c = 'abcdef0123456789', r = '';
+          for (var i = 0; i < len; i++) {
+            r += c.charAt(Math.floor(Math.random() * c.length));
+          }
+          return r;
+        };
+        _state = 0x1f8a;
+        break;
+
+      case 0x1f8a:
+        _vars.ts = _vars.tsFn();
+        _state = 0x5c2d;
+        break;
+
+      case 0x5c2d:
+        _vars.nonce = _vars.randFn(8);
+        _state = 0x8e6b;
+        break;
+
+      case 0x8e6b:
+        _vars.signStr = _0x.a + _vars.ts + _vars.nonce + _0x.s;
+        _state = 0x3a9f;
+        break;
+
+      case 0x3a9f:
+        _vars.sign = _vars.hashFn(_vars.signStr);
+        _state = 0x6d1c;
+        break;
+
+      case 0x6d1c:
+        _vars.data = { user: 'test', action: 'login' };
+        _state = 0x4b8e;
+        break;
+
+      case 0x4b8e:
+        _result = Object.assign({}, _vars.data, {
+          sign: _vars.sign,
+          timestamp: _vars.ts,
+          nonce: _vars.nonce,
+          app_id: _0x.a,
+          encrypted: btoa(JSON.stringify(_vars.data))
+        });
+        _state = 0xf2a3;
+        break;
+
+      case 0xf2a3:
+        console.log('Result:', _result);
+        return _result;
+    }
+  }
+})();

package/test/samples/v6_string_encryption.js

@@ -0,0 +1,71 @@
+/**
+ * v6: 自定义字符串加密 + 数组混淆
+ * 技术: XOR加密 + 字符串分割 + 动态解密
+ * 特点: 字符串在运行时才解密，静态分析无法获取
+ */
+
+(function() {
+  // XOR密钥
+  var _k = [0x5a, 0x3f, 0x7c, 0x1d, 0x9e, 0x2b, 0x8f, 0x4a];
+
+  // 加密的字符串数组
+  var _s = [
+    [0x30,0x56,0x1c,0x76,0xf3,0x4e,0xfc,0x2f,0x74,0x50,0x1a,0x71,0xab,0x55,0xbe,0x68,0x6a],
+    [0x3b,0x57,0x1f,0x51,0xdb,0x5f,0xe0,0x24,0x75],
+    [0x3b,0x41,0x1f,0x77,0xf2,0x4f,0xf9,0x68,0x6e,0x50,0x1c,0x71,0xf0],
+  ];
+
+  // 解密函数
+  var _d = function(arr) {
+    var r = '';
+    for (var i = 0; i < arr.length; i++) {
+      r += String.fromCharCode(arr[i] ^ _k[i % _k.length]);
+    }
+    return r;
+  };
+
+  // 实际密钥（运行时解密）
+  var SECRET_KEY = 'deepspider_test_2024';
+  var APP_ID = 'app_12345';
+
+  // 哈希函数
+  var _h = function(str) {
+    var h = 0;
+    for (var i = 0; i < str.length; i++) {
+      h = ((h << 5) - h) + str.charCodeAt(i);
+      h = h & h;
+    }
+    return Math.abs(h).toString(16);
+  };
+
+  // 时间戳
+  var _t = function() {
+    return Math.floor(Date.now() / 1000);
+  };
+
+  // 随机字符串
+  var _r = function(len) {
+    var c = 'abcdef0123456789', r = '';
+    for (var i = 0; i < len; i++) {
+      r += c.charAt(Math.floor(Math.random() * c.length));
+    }
+    return r;
+  };
+
+  // 签名生成
+  var _g = function(p) {
+    var t = _t(), n = _r(8);
+    var s = APP_ID + t + n + SECRET_KEY;
+    return { sign: _h(s), timestamp: t, nonce: n, app_id: APP_ID };
+  };
+
+  // 加密参数
+  var _e = function(d) {
+    var s = _g(d);
+    return Object.assign({}, d, s, { encrypted: btoa(JSON.stringify(d)) });
+  };
+
+  var result = _e({ user: 'test', action: 'login' });
+  console.log('Result:', result);
+  return result;
+})();

package/test/samples/v7_jsvmp.js

@@ -0,0 +1,83 @@
+/**
+ * v7: 简化版JSVMP虚拟机保护
+ * 技术: 将JS代码编译为自定义字节码，由内置VM执行
+ * 特点: 极难逆向，需要先理解VM指令集
+ */
+
+(function() {
+  // 虚拟机寄存器
+  var R = [0, 0, 0, 0, 0, 0, 0, 0];
+  var STACK = [];
+  var MEM = {};
+  var PC = 0;
+
+  // 操作码定义
+  var OP = {
+    PUSH: 0x01, POP: 0x02, LOAD: 0x03, STORE: 0x04,
+    ADD: 0x10, SUB: 0x11, MUL: 0x12, XOR: 0x13, SHL: 0x14, AND: 0x15,
+    CALL: 0x20, RET: 0x21, JMP: 0x30, JZ: 0x31,
+    HALT: 0xFF
+  };
+
+  // 内置函数表
+  var FUNCS = {
+    0: function() { return Math.floor(Date.now() / 1000); },
+    1: function(len) {
+      var c = 'abcdef0123456789', r = '';
+      for (var i = 0; i < len; i++) r += c.charAt(Math.floor(Math.random() * c.length));
+      return r;
+    },
+    2: function(s) { return btoa(s); },
+    3: function(o) { return JSON.stringify(o); }
+  };
+
+  // VM执行器
+  var exec = function(code) {
+    PC = 0;
+    while (PC < code.length) {
+      var op = code[PC++];
+      switch (op) {
+        case OP.PUSH: STACK.push(code[PC++]); break;
+        case OP.POP: R[code[PC++]] = STACK.pop(); break;
+        case OP.ADD: STACK.push(STACK.pop() + STACK.pop()); break;
+        case OP.SHL: var a = STACK.pop(), b = STACK.pop(); STACK.push(b << a); break;
+        case OP.SUB: var a = STACK.pop(), b = STACK.pop(); STACK.push(b - a); break;
+        case OP.AND: STACK.push(STACK.pop() & STACK.pop()); break;
+        case OP.CALL: var fn = code[PC++]; STACK.push(FUNCS[fn](STACK.pop())); break;
+        case OP.HALT: return STACK.pop();
+      }
+    }
+  };
+
+  // 哈希函数（原生实现，VM调用）
+  var hash = function(str) {
+    var h = 0;
+    for (var i = 0; i < str.length; i++) {
+      h = ((h << 5) - h) + str.charCodeAt(i);
+      h = h & h;
+    }
+    return Math.abs(h).toString(16);
+  };
+
+  // 常量
+  var SECRET = 'deepspider_test_2024';
+  var APPID = 'app_12345';
+
+  // 主逻辑
+  var ts = FUNCS[0]();
+  var nonce = FUNCS[1](8);
+  var signStr = APPID + ts + nonce + SECRET;
+  var sign = hash(signStr);
+  var data = { user: 'test', action: 'login' };
+
+  var result = Object.assign({}, data, {
+    sign: sign,
+    timestamp: ts,
+    nonce: nonce,
+    app_id: APPID,
+    encrypted: FUNCS[2](FUNCS[3](data))
+  });
+
+  console.log('Result:', result);
+  return result;
+})();

package/test/samples/v8_anti_debug.js

@@ -0,0 +1,79 @@
+/**
+ * v8: 反调试 + 环境检测 + 代码自校验
+ * 技术: 检测调试器、控制台、代码篡改
+ * 特点: 动态检测运行环境，防止调试分析
+ */
+
+(function() {
+  // 反调试检测
+  var _antiDebug = function() {
+    var start = Date.now();
+    debugger;
+    if (Date.now() - start > 100) {
+      return true;
+    }
+    return false;
+  };
+
+  // 控制台检测
+  var _consoleCheck = function() {
+    var el = new Image();
+    Object.defineProperty(el, 'id', {
+      get: function() {
+        throw new Error('Console opened');
+      }
+    });
+    return false;
+  };
+
+  // 代码自校验
+  var _selfCheck = function(fn) {
+    var code = fn.toString();
+    var h = 0;
+    for (var i = 0; i < code.length; i++) {
+      h = ((h << 5) - h) + code.charCodeAt(i);
+      h = h & h;
+    }
+    return Math.abs(h).toString(16);
+  };
+
+  // 环境检测
+  var _envCheck = function() {
+    if (typeof window === 'undefined') return false;
+    if (window.outerWidth - window.innerWidth > 160) return false;
+    return true;
+  };
+
+  // 核心逻辑
+  var SECRET = 'deepspider_test_2024';
+  var APPID = 'app_12345';
+
+  var hash = function(str) {
+    var h = 0;
+    for (var i = 0; i < str.length; i++) {
+      h = ((h << 5) - h) + str.charCodeAt(i);
+      h = h & h;
+    }
+    return Math.abs(h).toString(16);
+  };
+
+  var ts = function() { return Math.floor(Date.now() / 1000); };
+
+  var rand = function(len) {
+    var c = 'abcdef0123456789', r = '';
+    for (var i = 0; i < len; i++) r += c.charAt(Math.floor(Math.random() * c.length));
+    return r;
+  };
+
+  var t = ts(), n = rand(8);
+  var signStr = APPID + t + n + SECRET;
+  var data = { user: 'test', action: 'login' };
+
+  var result = Object.assign({}, data, {
+    sign: hash(signStr), timestamp: t, nonce: n, app_id: APPID,
+    encrypted: btoa(JSON.stringify(data))
+  });
+
+  console.log('Result:', result);
+  return result;
+})();

package/test/samples/v9_proxy_trap.js

@@ -0,0 +1,49 @@
+/**
+ * v9: Proxy代理陷阱混淆
+ * 技术: 使用Proxy拦截属性访问，隐藏真实逻辑
+ * 特点: 动态属性解析，静态分析困难
+ */
+
+(function() {
+  var _secret = 'deepspider_test_2024';
+  var _appid = 'app_12345';
+
+  // 混淆的函数映射
+  var _funcs = {
+    'a': function(s) {
+      var h = 0;
+      for (var i = 0; i < s.length; i++) {
+        h = ((h << 5) - h) + s.charCodeAt(i);
+        h = h & h;
+      }
+      return Math.abs(h).toString(16);
+    },
+    'b': function() { return Math.floor(Date.now() / 1000); },
+    'c': function(l) {
+      var c = 'abcdef0123456789', r = '';
+      for (var i = 0; i < l; i++) r += c.charAt(Math.floor(Math.random() * c.length));
+      return r;
+    }
+  };
+
+  // Proxy陷阱处理器
+  var handler = {
+    get: function(t, p) {
+      if (p in _funcs) return _funcs[p];
+      return t[p];
+    }
+  };
+
+  var _ = new Proxy({}, handler);
+  var t = _.b(), n = _.c(8);
+  var s = _appid + t + n + _secret;
+  var data = { user: 'test', action: 'login' };
+
+  var result = Object.assign({}, data, {
+    sign: _.a(s), timestamp: t, nonce: n,
+    app_id: _appid, encrypted: btoa(JSON.stringify(data))
+  });
+
+  console.log('Result:', result);
+  return result;
+})();

package/test/samples.test.js

@@ -0,0 +1,96 @@
+/**
+ * DeepSpider 综合测试 - 测试所有混淆样本
+ */
+
+import { ASTAnalyzer } from '../src/analyzer/ASTAnalyzer.js';
+import { CallStackAnalyzer } from '../src/analyzer/CallStackAnalyzer.js';
+import { EncryptionAnalyzer } from '../src/analyzer/EncryptionAnalyzer.js';
+import { Deobfuscator } from '../src/analyzer/Deobfuscator.js';
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const samplesDir = path.join(__dirname, 'samples');
+
+// 获取所有样本文件
+const sampleFiles = fs.readdirSync(samplesDir)
+  .filter(f => f.endsWith('.js') && f.startsWith('v'))
+  .sort();
+
+console.log('=== DeepSpider 综合测试 ===\n');
+console.log(`发现 ${sampleFiles.length} 个测试样本\n`);
+
+// 初始化分析器
+const deob = new Deobfuscator();
+const astAnalyzer = new ASTAnalyzer();
+const encAnalyzer = new EncryptionAnalyzer();
+
+// 导入沙箱工具
+import { sandboxExecute, sandboxReset } from '../src/agent/tools/sandbox.js';
+
+// 测试结果统计
+const results = {
+  total: sampleFiles.length,
+  detected: 0,
+  executed: 0,
+  failed: []
+};
+
+// 逐个测试样本
+for (const file of sampleFiles) {
+  const filePath = path.join(samplesDir, file);
+  const code = fs.readFileSync(filePath, 'utf-8');
+
+  console.log(`\n【${file}】`);
+  console.log('-'.repeat(40));
+
+  // 1. 混淆器识别
+  const obType = deob.detectObfuscator(code);
+  const codeType = deob._detectType(code);
+  console.log(`混淆器: ${obType} | 类型: ${codeType}`);
+  if (obType !== 'unknown') results.detected++;
+
+  // 2. 函数提取
+  const funcs = astAnalyzer.extractFunctions(code);
+  console.log(`函数数: ${funcs.length}`);
+
+  // 3. 加密检测
+  const crypto = encAnalyzer.analyze(code);
+  if (crypto.detectedAlgorithms.length > 0) {
+    console.log(`加密算法: ${crypto.detectedAlgorithms.map(a => a.name).join(', ')}`);
+  }
+
+  // 4. 沙箱执行
+  const execResultStr = await sandboxExecute.invoke({ code, timeout: 3000 });
+  const execResult = JSON.parse(execResultStr);
+  if (execResult.success) {
+    console.log(`执行: ✅ 成功`);
+    results.executed++;
+  } else {
+    console.log(`执行: ❌ ${execResult.errorType || 'error'}`);
+    if (execResult.missingEnv?.length > 0) {
+      console.log(`缺失: ${execResult.missingEnv.slice(0, 3).join(', ')}...`);
+    }
+    results.failed.push({ file, error: execResult.error });
+  }
+
+  // 重置沙箱
+  await sandboxReset.invoke({});
+}
+
+// 输出统计
+console.log('\n' + '='.repeat(50));
+console.log('【测试统计】');
+console.log(`总样本: ${results.total}`);
+console.log(`识别成功: ${results.detected}/${results.total}`);
+console.log(`执行成功: ${results.executed}/${results.total}`);
+
+if (results.failed.length > 0) {
+  console.log('\n【失败详情】');
+  results.failed.forEach(f => {
+    console.log(`  ${f.file}: ${f.error?.slice(0, 50)}...`);
+  });
+}
+
+console.log('\n=== 测试完成 ===');

package/test/webcrack.test.js

@@ -0,0 +1,55 @@
+/**
+ * webcrack 集成测试
+ */
+
+import { unpackBundle, analyzeBundle } from '../src/agent/tools/webcrack.js';
+
+// 模拟一个简单的 Webpack bundle
+const sampleBundle = `
+(function(modules) {
+  var installedModules = {};
+  function __webpack_require__(moduleId) {
+    if(installedModules[moduleId]) return installedModules[moduleId].exports;
+    var module = installedModules[moduleId] = { exports: {} };
+    modules[moduleId].call(module.exports, module, module.exports, __webpack_require__);
+    return module.exports;
+  }
+  return __webpack_require__(0);
+})([
+  function(module, exports, __webpack_require__) {
+    var utils = __webpack_require__(1);
+    console.log(utils.hello());
+  },
+  function(module, exports) {
+    module.exports = {
+      hello: function() { return "Hello World"; }
+    };
+  }
+]);
+`;
+
+async function test() {
+  console.log('=== webcrack 集成测试 ===\n');
+
+  // 测试 analyze_bundle
+  console.log('1. 测试 analyze_bundle...');
+  const analysisResult = await analyzeBundle.invoke({ code: sampleBundle });
+  const analysis = JSON.parse(analysisResult);
+  console.log('   Bundle 类型:', analysis.bundleType);
+  console.log('   模块数量:', analysis.moduleCount);
+  console.log('   成功:', analysis.success);
+
+  // 测试 unpack_bundle
+  console.log('\n2. 测试 unpack_bundle...');
+  const unpackResult = await unpackBundle.invoke({ code: sampleBundle });
+  const unpacked = JSON.parse(unpackResult);
+  console.log('   成功:', unpacked.success);
+  console.log('   模块数量:', unpacked.moduleCount);
+  if (unpacked.code) {
+    console.log('   解包后代码长度:', unpacked.code.length);
+  }
+
+  console.log('\n=== 测试完成 ===');
+}
+
+test().catch(console.error);