js-confuser-vm 0.1.0 → 0.1.1

package/src/runtime.ts

@@ -8,18 +8,27 @@ const TIMING_CHECKS = false;
 // The text above is not included in the compiled output - for type intellisense only
 // @START
 
+function base64ToBytes(s) {
+  return typeof Buffer !== "undefined"
+    ? Buffer.from(s, "base64")
+    : Uint8Array.from(atob(s), function (c) {
+        return c.charCodeAt(0);
+      });
+}
+
 function decodeBytecode(s) {
   if (!ENCODE_BYTECODE) return s;
 
-  var b =
-    typeof Buffer !== "undefined"
-      ? Buffer.from(s, "base64")
-      : Uint8Array.from(atob(s), function (c) {
-          return c.charCodeAt(0);
-        });
-  // Each slot is a u16 stored as 2 little-endian bytes.
-  var r = new Uint16Array(b.length / 2);
-  for (var i = 0; i < r.length; i++) r[i] = b[i * 2] | (b[i * 2 + 1] << 8);
+  var b = base64ToBytes(s);
+  // Each slot is a u32 stored as 4 little-endian bytes.
+  var r = new Uint32Array(b.length / 4);
+  for (var i = 0; i < r.length; i++)
+    r[i] =
+      (b[i * 4] |
+        (b[i * 4 + 1] << 8) |
+        (b[i * 4 + 2] << 16) |
+        (b[i * 4 + 3] << 24)) >>>
+      0;
   return r;
 }
 
@@ -100,7 +109,6 @@ function VM(bytecode, mainStartPc, mainRegCount, constants, globals) {
     0,
     0,
   );
-  this._internals = {};
 }
 
 // Consume the next slot from the flat bytecode stream and advance the PC.
@@ -138,12 +146,7 @@ VM.prototype._constant = function (idxIn, keyIn) {
   if (!key) return v;
   if (typeof v === "number") return v ^ key;
   // String: base64-decode to u16 LE byte pairs, then XOR each code with (key+i).
-  var b =
-    typeof Buffer !== "undefined"
-      ? Buffer.from(v, "base64")
-      : Uint8Array.from(atob(v), function (c) {
-          return c.charCodeAt(0);
-        });
+  var b = base64ToBytes(v);
   var out = "";
   for (var i = 0; i < b.length / 2; i++) {
     var code = b[i * 2] | (b[i * 2 + 1] << 8); // u16 LE
@@ -212,6 +215,7 @@ VM.prototype.run = function () {
     try {
       var regs = this._regs;
       var base = frame._base;
+
       /* @SWITCH */
       switch (op) {
         case OP.LOAD_CONST: {
@@ -257,8 +261,7 @@ VM.prototype.run = function () {
         }
 
         case OP.STORE_GLOBAL: {
-          // nameIdx and key are consumed inline so the concealConstants runtime
-          // transform can rewrite this._constant() consistently.
+          // globals[globalName] = regs[src]
           this.globals[this._constant()] = regs[base + this._operand()];
           break;
         }
@@ -283,13 +286,14 @@ VM.prototype.run = function () {
           var obj = regs[base + this._operand()];
           var key = regs[base + this._operand()];
           var val = regs[base + this._operand()];
-          // Reflect.set performs [[Set]] without throwing on failure,
-          // correctly simulating sloppy-mode assignment from a strict-mode host.
+          // Reflect.set performs [[Set]] without throwing on failure (non-strict mode behavior)
           Reflect.set(obj, key, val);
           break;
         }
 
         case OP.DELETE_PROP: {
+          // regs[dst] = delete regs[obj][regs[key]]
+          // The delete operator returns true if successful which is most cases
           var dst = this._operand();
           var obj = regs[base + this._operand()];
           var key = regs[base + this._operand()];
@@ -297,7 +301,7 @@ VM.prototype.run = function () {
           break;
         }
 
-        // ── Arithmetic  (dst, src1, src2) ────────────────────────────────────
+        // Arithmetic  (dst, src1, src2)
         case OP.ADD: {
           var dst = this._operand();
           var a = regs[base + this._operand()];
@@ -365,7 +369,7 @@ VM.prototype.run = function () {
           break;
         }
 
-        // ── Comparison  (dst, src1, src2) ─────────────────────────────────────
+        // Comparison  (dst, src1, src2)
         case OP.LT: {
           var dst = this._operand();
           var a = regs[base + this._operand()];
@@ -421,13 +425,14 @@ VM.prototype.run = function () {
           break;
         }
         case OP.INSTANCEOF: {
+          // regs[dst] = regs[obj] instanceof regs[ctor]
           var dst = this._operand();
           var obj = regs[base + this._operand()];
           var ctor = regs[base + this._operand()];
           if (typeof ctor === "function") {
             regs[base + dst] = obj instanceof ctor;
           } else {
-            // VM Closure - walk prototype chain for identity with ctor.prototype.
+            // TODO: Why is this needed?
             var proto = ctor.prototype;
             var target = Object.getPrototypeOf(obj);
             var result = false;
@@ -443,7 +448,7 @@ VM.prototype.run = function () {
           break;
         }
 
-        // ── Unary  (dst, src) ─────────────────────────────────────────────────
+        // Unary  (dst, src)
         case OP.UNARY_NEG: {
           var dst = this._operand();
           regs[base + dst] = -regs[base + this._operand()];
@@ -471,12 +476,13 @@ VM.prototype.run = function () {
         }
         case OP.VOID: {
           var dst = this._operand();
-          this._operand(); // consume src — evaluated for side-effects by compiler
+          this._operand(); // consumes argument (intended)
           regs[base + dst] = undefined;
           break;
         }
         case OP.TYPEOF_SAFE: {
-          // dst, nameConstIdx — safe typeof for potentially-undeclared globals.
+          // regs[dst] = typeof window[name]
+          // Never throws ReferenceError, instead returns undefined for undeclared variables
           var dst = this._operand();
           var name = this._constant();
           var val = Object.prototype.hasOwnProperty.call(this.globals, name)
@@ -486,7 +492,7 @@ VM.prototype.run = function () {
           break;
         }
 
-        // ── Control flow ──────────────────────────────────────────────────────
+        // Control flow
         case OP.JUMP:
           frame._pc = this._operand();
           break;
@@ -506,7 +512,7 @@ VM.prototype.run = function () {
           break;
         }
 
-        // ── Calls ─────────────────────────────────────────────────────────────
+        // Calls
         case OP.CALL: {
           // dst, calleeReg, argc, [argReg...]
           var dst = this._operand();
@@ -528,8 +534,14 @@ VM.prototype.run = function () {
               dst,
               newBase,
             );
-            for (var i = 0; i < args.length && i < closure.fn.regCount; i++) {
-              this._regs[newBase + i] = args[i];
+            if (closure.fn.hasRest) {
+              var restSlot = closure.fn.paramCount - 1;
+              for (var i = 0; i < restSlot; i++)
+                this._regs[newBase + i] = i < args.length ? args[i] : undefined;
+              this._regs[newBase + restSlot] = args.slice(restSlot);
+            } else {
+              for (var i = 0; i < args.length && i < closure.fn.regCount; i++)
+                this._regs[newBase + i] = args[i];
             }
             if (closure.fn.paramCount < closure.fn.regCount) {
               this._regs[newBase + closure.fn.paramCount] = args;
@@ -564,8 +576,14 @@ VM.prototype.run = function () {
               dst,
               newBase,
             );
-            for (var i = 0; i < args.length && i < closure.fn.regCount; i++) {
-              this._regs[newBase + i] = args[i];
+            if (closure.fn.hasRest) {
+              var restSlot = closure.fn.paramCount - 1;
+              for (var i = 0; i < restSlot; i++)
+                this._regs[newBase + i] = i < args.length ? args[i] : undefined;
+              this._regs[newBase + restSlot] = args.slice(restSlot);
+            } else {
+              for (var i = 0; i < args.length && i < closure.fn.regCount; i++)
+                this._regs[newBase + i] = args[i];
             }
             if (closure.fn.paramCount < closure.fn.regCount) {
               this._regs[newBase + closure.fn.paramCount] = args;
@@ -593,8 +611,14 @@ VM.prototype.run = function () {
             this._ensureRegisterWindow(newBase, closure.fn.regCount);
             this._regsTop = newBase + closure.fn.regCount;
             var f = new Frame(closure, frame._pc, frame, newObj, dst, newBase);
-            for (var i = 0; i < args.length && i < closure.fn.regCount; i++) {
-              this._regs[newBase + i] = args[i];
+            if (closure.fn.hasRest) {
+              var restSlot = closure.fn.paramCount - 1;
+              for (var i = 0; i < restSlot; i++)
+                this._regs[newBase + i] = i < args.length ? args[i] : undefined;
+              this._regs[newBase + restSlot] = args.slice(restSlot);
+            } else {
+              for (var i = 0; i < args.length && i < closure.fn.regCount; i++)
+                this._regs[newBase + i] = args[i];
             }
             if (closure.fn.paramCount < closure.fn.regCount) {
               this._regs[newBase + closure.fn.paramCount] = args;
@@ -613,11 +637,16 @@ VM.prototype.run = function () {
         case OP.RETURN: {
           var retVal = regs[base + this._operand()];
           this._closeUpvaluesFor(frame); // must happen before frame is abandoned
+
+          // Zero out callee's register window to limit exposing runtime values
+          var hi = frame._base + frame.closure.fn.regCount;
+          for (var i = frame._base as number; i < hi; i++)
+            this._regs[i] = undefined;
           this._regsTop = frame._base;
 
           if (this._frameStack.length === 0) return retVal; // main script returning
 
-          // new-call rule: primitive return -> discard, use the constructed object instead
+          // NewExpression: When invoking from the 'new' keyword, the newly constructed object is returned instead (if the original function doesn't return an object)
           if (frame._newObj !== null) {
             if (typeof retVal !== "object" || retVal === null)
               retVal = frame._newObj;
@@ -632,14 +661,15 @@ VM.prototype.run = function () {
         case OP.THROW:
           throw regs[base + this._operand()];
 
-        // ── Closures ──────────────────────────────────────────────────────────
+        // Closures
         case OP.MAKE_CLOSURE: {
-          // dst, startPc, paramCount, regCount, uvCount, [isLocal, idx, ...]
+          // dst, startPc, paramCount, regCount, uvCount, hasRest, [isLocal, idx, ...]
           var dst = this._operand();
           var startPc = this._operand();
           var paramCount = this._operand();
           var regCount = this._operand();
           var uvCount = this._operand();
+          var hasRest = this._operand(); // 1 if last param is a rest element
 
           var uvDescs = new Array(uvCount);
           for (var i = 0; i < uvCount; i++) {
@@ -653,6 +683,7 @@ VM.prototype.run = function () {
             regCount: regCount,
             startPc: startPc,
             upvalueDescriptors: uvDescs,
+            hasRest: hasRest,
           };
 
           var closure = new Closure(fn);
@@ -688,8 +719,14 @@ VM.prototype.run = function () {
                 0,
               );
               sub._currentFrame = f;
-              for (var i = 0; i < args.length && i < c.fn.regCount; i++) {
-                sub._regs[i] = args[i];
+              if (c.fn.hasRest) {
+                var restSlot = c.fn.paramCount - 1;
+                for (var i = 0; i < restSlot; i++)
+                  sub._regs[i] = i < args.length ? args[i] : undefined;
+                sub._regs[restSlot] = args.slice(restSlot);
+              } else {
+                for (var i = 0; i < args.length && i < c.fn.regCount; i++)
+                  sub._regs[i] = args[i];
               }
               if (c.fn.paramCount < c.fn.regCount) {
                 sub._regs[c.fn.paramCount] = args;
@@ -703,7 +740,7 @@ VM.prototype.run = function () {
           break;
         }
 
-        // ── Collections ───────────────────────────────────────────────────────
+        // Collections
         case OP.BUILD_ARRAY: {
           // dst, count, [elemReg...]
           var dst = this._operand();
@@ -729,7 +766,7 @@ VM.prototype.run = function () {
           break;
         }
 
-        // ── Property definitions (getters / setters) ──────────────────────────
+        // Object methods (getters / setters)
         case OP.DEFINE_GETTER: {
           // obj, key, fn
           var obj = regs[base + this._operand()];
@@ -825,7 +862,7 @@ VM.prototype.run = function () {
           break;
         }
 
-        // ── Self-modifying bytecode ───────────────────────────────────────────
+        // Self-modifying bytecode
         case OP.PATCH: {
           // destPc, sliceStart, sliceEnd
           var destPc = this._operand();
@@ -838,10 +875,7 @@ VM.prototype.run = function () {
         }
 
         case OP.JUMP_REG: {
-          // Indirect jump: target PC is read from a register rather than a
-          // bytecode immediate. Used by the jumpDispatcher pass so that static
-          // analysis cannot determine the jump destination without tracking the
-          // register value (which contains an encoded PC resolved at runtime).
+          // Indirect jump: allows VM to jump based on runtime values.
           frame._pc = regs[base + this._operand()];
           break;
         }
@@ -857,9 +891,8 @@ VM.prototype.run = function () {
           );
       }
     } catch (err) {
-      // Exception handler unwinding (CPython-style frame walk, Lua-style upvalue close).
-      // Walk from the current frame upward until we find a frame that has an open
-      // exception handler (TRY_SETUP without a matching TRY_END).
+      // Exception handler unwinding
+      // Walk from the current frame upward until we find a frame that has an open exception handler (TRY_SETUP without a matching TRY_END).
       // For every frame we abandon along the way, close its captured upvalues.
       var handledFrame = null;
       var searchFrame = this._currentFrame;
@@ -876,7 +909,7 @@ VM.prototype.run = function () {
         this._currentFrame = searchFrame;
       }
 
-      if (!handledFrame) throw err; // no handler anywhere — propagate to host
+      if (!handledFrame) throw err; // if there's no handler, propagate back to host
 
       var h = handledFrame._handlerStack.pop();
       // Discard any call-frames that were pushed inside the try body.
@@ -891,7 +924,7 @@ VM.prototype.run = function () {
   }
 };
 
-// Boot
+/* @BOOT */ // <- This comment can't be removed!
 var globals: any = {}; // global object for globals
 
 // Always pull built-ins from globalThis so eval() scoping can't shadow them

package/src/template.ts

@@ -47,7 +47,7 @@
 
 import { Compiler } from "./compiler.ts";
 import { DEFAULT_OPTIONS } from "./options.ts";
-import type { Bytecode, Instruction } from "./types.ts";
+import type { Bytecode, Instruction, RegisterOperand } from "./types.ts";
 
 export class Template {
   private readonly _source: string;
@@ -138,4 +138,128 @@ export class Template {
 
     return { functions: innerDescs, bytecode: innerBytecode };
   }
+
+  // ── Inline compilation ───────────────────────────────────────────────────
+  /**
+   * Compile the template and return the **main scope** bytecode, with all
+   * register operands remapped to belong to `targetFnId`.  This allows
+   * bytecode transforms to express high-level JS control flow (while-loops,
+   * if-chains, variable declarations) via Template and splice the result
+   * directly into an existing function's instruction stream.
+   *
+   * The implicit trailing RETURN added by _compileFunctionDecl is stripped —
+   * inline code should flow into the surrounding bytecode, not return.
+   *
+   * @param variables       Substitution map for {name} placeholders.
+   * @param parentCompiler  The Compiler whose OP table, label counter, and
+   *                        fnDescriptors are shared.
+   * @param targetFnId      The function whose register file the template's
+   *                        registers should be remapped into.
+   * @param maxId           Live map of max register id per fnId — updated
+   *                        in-place as new registers are allocated.
+   *
+   * @returns
+   *   bytecode   — main-scope IR (no entry defineLabel, no trailing RETURN),
+   *                ready to splice into the target function's instruction stream.
+   *   registers  — mapping of JS variable names → remapped RegisterOperands,
+   *                so the caller can reference template-declared variables
+   *                (e.g. the `state` variable in CFF).
+   *   functions  — inner function descriptors (same as compile()).
+   *   innerBytecode — inner function bytecode blocks (same as compile()).
+   */
+  compileInline(
+    variables: Record<string, string | number>,
+    parentCompiler: Compiler,
+    targetFnId: number,
+    maxId: Map<number, number>,
+  ): {
+    bytecode: Bytecode;
+    registers: Map<string, RegisterOperand>;
+    functions: any[];
+    innerBytecode: Bytecode;
+  } {
+    const code = this._interpolate(variables);
+
+    const child = new Compiler({ ...DEFAULT_OPTIONS, randomizeOpcodes: false });
+    child.OP = { ...parentCompiler.OP };
+    child.OP_NAME = { ...parentCompiler.OP_NAME };
+    child.JUMP_OPS = new Set(parentCompiler.JUMP_OPS);
+    child._makeLabel = parentCompiler._makeLabel.bind(parentCompiler);
+
+    const startIdx = parentCompiler.fnDescriptors.length;
+    child.fnDescriptors = parentCompiler.fnDescriptors;
+
+    child.compile(code);
+
+    const mainDesc = parentCompiler.fnDescriptors[startIdx] as any;
+    const mainFnId: number = mainDesc._fnIdx;
+    const mainBc = mainDesc.bytecode as Bytecode;
+
+    // ── Remap registers from the template's main fnId → targetFnId ────────
+    // Build a mapping: old register id → new RegisterOperand in targetFnId.
+    const regRemap = new Map<number, RegisterOperand>();
+    const remapReg = (id: number): RegisterOperand => {
+      if (!regRemap.has(id)) {
+        const next = (maxId.get(targetFnId) ?? -1) + 1;
+        maxId.set(targetFnId, next);
+        regRemap.set(id, { type: "register", id: next, fnId: targetFnId });
+      }
+      return regRemap.get(id)!;
+    };
+
+    for (const instr of mainBc) {
+      for (let j = 1; j < instr.length; j++) {
+        const op = instr[j] as any;
+        if (op && typeof op === "object" && op.type === "register" && op.fnId === mainFnId) {
+          const mapped = remapReg(op.id);
+          op.id = mapped.id;
+          op.fnId = mapped.fnId;
+        }
+      }
+    }
+
+    // ── Build variable name → remapped register mapping ───────────────────
+    const registers = new Map<string, RegisterOperand>();
+    const locals: Map<string, RegisterOperand> = mainDesc.ctx.scope._locals;
+    for (const [name, reg] of locals) {
+      const mapped = regRemap.get(reg.id);
+      if (mapped) registers.set(name, mapped);
+    }
+
+    // ── Strip entry defineLabel and trailing implicit RETURN ───────────────
+    let bytecode = mainBc.filter((instr) => {
+      const op0 = instr[1] as any;
+      return !(
+        instr[0] === null &&
+        op0?.type === "defineLabel" &&
+        op0.label === mainDesc.entryLabel
+      );
+    });
+
+    // Remove trailing LOAD_CONST undefined + RETURN (implicit return added
+    // by _compileFunctionDecl).
+    const OP = parentCompiler.OP;
+    if (
+      bytecode.length >= 2 &&
+      bytecode[bytecode.length - 1][0] === OP.RETURN &&
+      bytecode[bytecode.length - 2][0] === OP.LOAD_CONST
+    ) {
+      bytecode = bytecode.slice(0, -2);
+    }
+
+    // ── Inner function bytecode (same as compile()) ───────────────────────
+    const innerDescs = parentCompiler.fnDescriptors.slice(startIdx + 1);
+    const innerBytecode: Bytecode = [];
+    for (const desc of innerDescs) {
+      innerBytecode.push([
+        null,
+        { type: "defineLabel", label: desc.entryLabel },
+      ] as Instruction);
+      for (const instr of (desc as any).bytecode as Bytecode) {
+        innerBytecode.push(instr);
+      }
+    }
+
+    return { bytecode, registers, functions: innerDescs, innerBytecode };
+  }
 }

package/src/transforms/bytecode/aliasedOpcodes.ts

@@ -1,5 +1,5 @@
 import type { Bytecode, InstrOperand, Instruction } from "../../types.ts";
-import { Compiler, SOURCE_NODE_SYM } from "../../compiler.ts";
+import { Compiler, OP_ORIGINAL, SOURCE_NODE_SYM } from "../../compiler.ts";
 import { nextFreeSlot } from "../../utils/op-utils.ts";
 import { shuffle } from "../../utils/random-utils.ts";
 
@@ -58,6 +58,9 @@ export function aliasedOpcodes(
     const arity = instr.length - 1;
     if (arity < 1) continue; // 0-operand opcodes have nothing to permute
 
+    const opName = compiler.OP_NAME[op];
+    if (!OP_ORIGINAL[opName]) continue; // only consider original ops, not already-specialized ones
+
     const existing = opStats.get(op);
     if (!existing) {
       opStats.set(op, { freq: 1, arity });