deepspider 0.2.11 → 0.3.0

package/test/samples/v7_jsvmp.js

@@ -1,83 +0,0 @@
-/**
- * v7: 简化版JSVMP虚拟机保护
- * 技术: 将JS代码编译为自定义字节码，由内置VM执行
- * 特点: 极难逆向，需要先理解VM指令集
- */
-
-(function() {
-  // 虚拟机寄存器
-  var R = [0, 0, 0, 0, 0, 0, 0, 0];
-  var STACK = [];
-  var MEM = {};
-  var PC = 0;
-
-  // 操作码定义
-  var OP = {
-    PUSH: 0x01, POP: 0x02, LOAD: 0x03, STORE: 0x04,
-    ADD: 0x10, SUB: 0x11, MUL: 0x12, XOR: 0x13, SHL: 0x14, AND: 0x15,
-    CALL: 0x20, RET: 0x21, JMP: 0x30, JZ: 0x31,
-    HALT: 0xFF
-  };
-
-  // 内置函数表
-  var FUNCS = {
-    0: function() { return Math.floor(Date.now() / 1000); },
-    1: function(len) {
-      var c = 'abcdef0123456789', r = '';
-      for (var i = 0; i < len; i++) r += c.charAt(Math.floor(Math.random() * c.length));
-      return r;
-    },
-    2: function(s) { return btoa(s); },
-    3: function(o) { return JSON.stringify(o); }
-  };
-
-  // VM执行器
-  var exec = function(code) {
-    PC = 0;
-    while (PC < code.length) {
-      var op = code[PC++];
-      switch (op) {
-        case OP.PUSH: STACK.push(code[PC++]); break;
-        case OP.POP: R[code[PC++]] = STACK.pop(); break;
-        case OP.ADD: STACK.push(STACK.pop() + STACK.pop()); break;
-        case OP.SHL: var a = STACK.pop(), b = STACK.pop(); STACK.push(b << a); break;
-        case OP.SUB: var a = STACK.pop(), b = STACK.pop(); STACK.push(b - a); break;
-        case OP.AND: STACK.push(STACK.pop() & STACK.pop()); break;
-        case OP.CALL: var fn = code[PC++]; STACK.push(FUNCS[fn](STACK.pop())); break;
-        case OP.HALT: return STACK.pop();
-      }
-    }
-  };
-
-  // 哈希函数（原生实现，VM调用）
-  var hash = function(str) {
-    var h = 0;
-    for (var i = 0; i < str.length; i++) {
-      h = ((h << 5) - h) + str.charCodeAt(i);
-      h = h & h;
-    }
-    return Math.abs(h).toString(16);
-  };
-
-  // 常量
-  var SECRET = 'deepspider_test_2024';
-  var APPID = 'app_12345';
-
-  // 主逻辑
-  var ts = FUNCS[0]();
-  var nonce = FUNCS[1](8);
-  var signStr = APPID + ts + nonce + SECRET;
-  var sign = hash(signStr);
-  var data = { user: 'test', action: 'login' };
-
-  var result = Object.assign({}, data, {
-    sign: sign,
-    timestamp: ts,
-    nonce: nonce,
-    app_id: APPID,
-    encrypted: FUNCS[2](FUNCS[3](data))
-  });
-
-  console.log('Result:', result);
-  return result;
-})();

package/test/samples/v8_anti_debug.js

@@ -1,79 +0,0 @@
-/**
- * v8: 反调试 + 环境检测 + 代码自校验
- * 技术: 检测调试器、控制台、代码篡改
- * 特点: 动态检测运行环境，防止调试分析
- */
-
-(function() {
-  // 反调试检测
-  var _antiDebug = function() {
-    var start = Date.now();
-    debugger;
-    if (Date.now() - start > 100) {
-      return true;
-    }
-    return false;
-  };
-
-  // 控制台检测
-  var _consoleCheck = function() {
-    var el = new Image();
-    Object.defineProperty(el, 'id', {
-      get: function() {
-        throw new Error('Console opened');
-      }
-    });
-    return false;
-  };
-
-  // 代码自校验
-  var _selfCheck = function(fn) {
-    var code = fn.toString();
-    var h = 0;
-    for (var i = 0; i < code.length; i++) {
-      h = ((h << 5) - h) + code.charCodeAt(i);
-      h = h & h;
-    }
-    return Math.abs(h).toString(16);
-  };
-
-  // 环境检测
-  var _envCheck = function() {
-    if (typeof window === 'undefined') return false;
-    if (window.outerWidth - window.innerWidth > 160) return false;
-    return true;
-  };
-
-  // 核心逻辑
-  var SECRET = 'deepspider_test_2024';
-  var APPID = 'app_12345';
-
-  var hash = function(str) {
-    var h = 0;
-    for (var i = 0; i < str.length; i++) {
-      h = ((h << 5) - h) + str.charCodeAt(i);
-      h = h & h;
-    }
-    return Math.abs(h).toString(16);
-  };
-
-  var ts = function() { return Math.floor(Date.now() / 1000); };
-
-  var rand = function(len) {
-    var c = 'abcdef0123456789', r = '';
-    for (var i = 0; i < len; i++) r += c.charAt(Math.floor(Math.random() * c.length));
-    return r;
-  };
-
-  var t = ts(), n = rand(8);
-  var signStr = APPID + t + n + SECRET;
-  var data = { user: 'test', action: 'login' };
-
-  var result = Object.assign({}, data, {
-    sign: hash(signStr), timestamp: t, nonce: n, app_id: APPID,
-    encrypted: btoa(JSON.stringify(data))
-  });
-
-  console.log('Result:', result);
-  return result;
-})();

package/test/samples/v9_proxy_trap.js

@@ -1,49 +0,0 @@
-/**
- * v9: Proxy代理陷阱混淆
- * 技术: 使用Proxy拦截属性访问，隐藏真实逻辑
- * 特点: 动态属性解析，静态分析困难
- */
-
-(function() {
-  var _secret = 'deepspider_test_2024';
-  var _appid = 'app_12345';
-
-  // 混淆的函数映射
-  var _funcs = {
-    'a': function(s) {
-      var h = 0;
-      for (var i = 0; i < s.length; i++) {
-        h = ((h << 5) - h) + s.charCodeAt(i);
-        h = h & h;
-      }
-      return Math.abs(h).toString(16);
-    },
-    'b': function() { return Math.floor(Date.now() / 1000); },
-    'c': function(l) {
-      var c = 'abcdef0123456789', r = '';
-      for (var i = 0; i < l; i++) r += c.charAt(Math.floor(Math.random() * c.length));
-      return r;
-    }
-  };
-
-  // Proxy陷阱处理器
-  var handler = {
-    get: function(t, p) {
-      if (p in _funcs) return _funcs[p];
-      return t[p];
-    }
-  };
-
-  var _ = new Proxy({}, handler);
-  var t = _.b(), n = _.c(8);
-  var s = _appid + t + n + _secret;
-  var data = { user: 'test', action: 'login' };
-
-  var result = Object.assign({}, data, {
-    sign: _.a(s), timestamp: t, nonce: n,
-    app_id: _appid, encrypted: btoa(JSON.stringify(data))
-  });
-
-  console.log('Result:', result);
-  return result;
-})();

package/test/samples.test.js

@@ -1,96 +0,0 @@
-/**
- * DeepSpider 综合测试 - 测试所有混淆样本
- */
-
-import { ASTAnalyzer } from '../src/analyzer/ASTAnalyzer.js';
-import { CallStackAnalyzer } from '../src/analyzer/CallStackAnalyzer.js';
-import { EncryptionAnalyzer } from '../src/analyzer/EncryptionAnalyzer.js';
-import { Deobfuscator } from '../src/analyzer/Deobfuscator.js';
-import fs from 'fs';
-import path from 'path';
-import { fileURLToPath } from 'url';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const samplesDir = path.join(__dirname, 'samples');
-
-// 获取所有样本文件
-const sampleFiles = fs.readdirSync(samplesDir)
-  .filter(f => f.endsWith('.js') && f.startsWith('v'))
-  .sort();
-
-console.log('=== DeepSpider 综合测试 ===\n');
-console.log(`发现 ${sampleFiles.length} 个测试样本\n`);
-
-// 初始化分析器
-const deob = new Deobfuscator();
-const astAnalyzer = new ASTAnalyzer();
-const encAnalyzer = new EncryptionAnalyzer();
-
-// 导入沙箱工具
-import { sandboxExecute, sandboxReset } from '../src/agent/tools/sandbox.js';
-
-// 测试结果统计
-const results = {
-  total: sampleFiles.length,
-  detected: 0,
-  executed: 0,
-  failed: []
-};
-
-// 逐个测试样本
-for (const file of sampleFiles) {
-  const filePath = path.join(samplesDir, file);
-  const code = fs.readFileSync(filePath, 'utf-8');
-
-  console.log(`\n【${file}】`);
-  console.log('-'.repeat(40));
-
-  // 1. 混淆器识别
-  const obType = deob.detectObfuscator(code);
-  const codeType = deob._detectType(code);
-  console.log(`混淆器: ${obType} | 类型: ${codeType}`);
-  if (obType !== 'unknown') results.detected++;
-
-  // 2. 函数提取
-  const funcs = astAnalyzer.extractFunctions(code);
-  console.log(`函数数: ${funcs.length}`);
-
-  // 3. 加密检测
-  const crypto = encAnalyzer.analyze(code);
-  if (crypto.detectedAlgorithms.length > 0) {
-    console.log(`加密算法: ${crypto.detectedAlgorithms.map(a => a.name).join(', ')}`);
-  }
-
-  // 4. 沙箱执行
-  const execResultStr = await sandboxExecute.invoke({ code, timeout: 3000 });
-  const execResult = JSON.parse(execResultStr);
-  if (execResult.success) {
-    console.log(`执行: ✅ 成功`);
-    results.executed++;
-  } else {
-    console.log(`执行: ❌ ${execResult.errorType || 'error'}`);
-    if (execResult.missingEnv?.length > 0) {
-      console.log(`缺失: ${execResult.missingEnv.slice(0, 3).join(', ')}...`);
-    }
-    results.failed.push({ file, error: execResult.error });
-  }
-
-  // 重置沙箱
-  await sandboxReset.invoke({});
-}
-
-// 输出统计
-console.log('\n' + '='.repeat(50));
-console.log('【测试统计】');
-console.log(`总样本: ${results.total}`);
-console.log(`识别成功: ${results.detected}/${results.total}`);
-console.log(`执行成功: ${results.executed}/${results.total}`);
-
-if (results.failed.length > 0) {
-  console.log('\n【失败详情】');
-  results.failed.forEach(f => {
-    console.log(`  ${f.file}: ${f.error?.slice(0, 50)}...`);
-  });
-}
-
-console.log('\n=== 测试完成 ===');

package/test/webcrack.test.js

@@ -1,55 +0,0 @@
-/**
- * webcrack 集成测试
- */
-
-import { unpackBundle, analyzeBundle } from '../src/agent/tools/webcrack.js';
-
-// 模拟一个简单的 Webpack bundle
-const sampleBundle = `
-(function(modules) {
-  var installedModules = {};
-  function __webpack_require__(moduleId) {
-    if(installedModules[moduleId]) return installedModules[moduleId].exports;
-    var module = installedModules[moduleId] = { exports: {} };
-    modules[moduleId].call(module.exports, module, module.exports, __webpack_require__);
-    return module.exports;
-  }
-  return __webpack_require__(0);
-})([
-  function(module, exports, __webpack_require__) {
-    var utils = __webpack_require__(1);
-    console.log(utils.hello());
-  },
-  function(module, exports) {
-    module.exports = {
-      hello: function() { return "Hello World"; }
-    };
-  }
-]);
-`;
-
-async function test() {
-  console.log('=== webcrack 集成测试 ===\n');
-
-  // 测试 analyze_bundle
-  console.log('1. 测试 analyze_bundle...');
-  const analysisResult = await analyzeBundle.invoke({ code: sampleBundle });
-  const analysis = JSON.parse(analysisResult);
-  console.log('   Bundle 类型:', analysis.bundleType);
-  console.log('   模块数量:', analysis.moduleCount);
-  console.log('   成功:', analysis.success);
-
-  // 测试 unpack_bundle
-  console.log('\n2. 测试 unpack_bundle...');
-  const unpackResult = await unpackBundle.invoke({ code: sampleBundle });
-  const unpacked = JSON.parse(unpackResult);
-  console.log('   成功:', unpacked.success);
-  console.log('   模块数量:', unpacked.moduleCount);
-  if (unpacked.code) {
-    console.log('   解包后代码长度:', unpacked.code.length);
-  }
-
-  console.log('\n=== 测试完成 ===');
-}
-
-test().catch(console.error);