js-confuser 1.5.6 → 1.5.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "js-confuser",
-  "version": "1.5.6",
+  "version": "1.5.8",
   "description": "JavaScript Obfuscation Tool.",
   "main": "dist/index.js",
   "types": "index.d.ts",
@@ -22,7 +22,7 @@
   "author": "MichaelXF",
   "license": "MIT",
   "dependencies": {
-    "acorn": "^8.7.0",
+    "acorn": "^8.8.2",
     "escodegen": "^2.0.0"
   },
   "devDependencies": {

package/src/options.ts

@@ -770,7 +770,10 @@ export function validateOptions(options: ObfuscateOptions) {
 
   if (options.lock) {
     // Validate browser-lock option
-    if (typeof options.lock.browserLock !== "undefined") {
+    if (
+      options.lock.browserLock &&
+      typeof options.lock.browserLock !== "undefined"
+    ) {
       ok(
         Array.isArray(options.lock.browserLock),
         "browserLock must be an array"
@@ -783,7 +786,7 @@ export function validateOptions(options: ObfuscateOptions) {
       );
     }
     // Validate os-lock option
-    if (typeof options.lock.osLock !== "undefined") {
+    if (options.lock.osLock && typeof options.lock.osLock !== "undefined") {
       ok(Array.isArray(options.lock.osLock), "osLock must be an array");
       ok(
         !options.lock.osLock.find((osName) => !validOses.has(osName)),
@@ -791,12 +794,15 @@ export function validateOptions(options: ObfuscateOptions) {
       );
     }
     // Validate domain-lock option
-    if (typeof options.lock.domainLock !== "undefined") {
+    if (
+      options.lock.domainLock &&
+      typeof options.lock.domainLock !== "undefined"
+    ) {
       ok(Array.isArray(options.lock.domainLock), "domainLock must be an array");
     }
 
     // Validate context option
-    if (typeof options.lock.context !== "undefined") {
+    if (options.lock.context && typeof options.lock.context !== "undefined") {
       ok(Array.isArray(options.lock.context), "context must be an array");
     }
 

package/src/transforms/controlFlowFlattening/controlFlowFlattening.ts

@@ -47,6 +47,7 @@ import ChoiceFlowObfuscation from "./choiceFlowObfuscation";
 import ControlFlowObfuscation from "./controlFlowObfuscation";
 import ExpressionObfuscation from "./expressionObfuscation";
 import SwitchCaseObfuscation from "./switchCaseObfuscation";
+import { isModuleSource } from "../string/stringConcealing";
 
 var flattenStructures = new Set([
   "IfStatement",
@@ -226,6 +227,13 @@ export default class ControlFlowFlattening extends Transform {
         fnNames.delete(illegal);
       });
 
+      var importDeclarations = [];
+      for (var stmt of body) {
+        if (stmt.type === "ImportDeclaration") {
+          importDeclarations.push(stmt);
+        }
+      }
+
       var fraction = 0.9;
       if (body.length > 20) {
         fraction /= Math.max(1.2, body.length - 18);
@@ -285,6 +293,7 @@ export default class ControlFlowFlattening extends Transform {
             if (
               o.type == "Literal" &&
               typeof o.value == "string" &&
+              !isModuleSource(o, p) &&
               !o.regex &&
               Math.random() / (Object.keys(stringBank).length / 2 + 1) > 0.5
             ) {
@@ -318,7 +327,10 @@ export default class ControlFlowFlattening extends Transform {
         };
 
         body.forEach((stmt, i) => {
-          if (functionDeclarations.has(stmt)) {
+          if (
+            functionDeclarations.has(stmt) ||
+            stmt.type === "ImportDeclaration"
+          ) {
             return;
           }
 
@@ -1045,6 +1057,9 @@ export default class ControlFlowFlattening extends Transform {
       var discriminant = Template(`${stateVars.join("+")}`).single().expression;
 
       body.length = 0;
+      for (var importDeclaration of importDeclarations) {
+        body.push(importDeclaration);
+      }
 
       if (functionDeclarations.size) {
         functionDeclarations.forEach((x) => {

package/src/transforms/identifier/nameRecycling.ts

@@ -97,8 +97,6 @@ export default class NameRecycling extends Transform {
                 return;
               }
 
-              lastReferenceMap.set(o.name, i);
-
               var comparingContext = info.spec.isDefined
                 ? getDefiningContext(o, p)
                 : getReferencingContexts(o, p).find((x) => isVarContext(x));
@@ -114,7 +112,18 @@ export default class NameRecycling extends Transform {
                 }
 
                 if (info.spec.isDefined) {
-                  if (defined.has(o.name) || getBlock(o, p) !== object) {
+                  // Function Declarations can be used before they're defined, if so, don't change this
+                  if (
+                    info.isFunctionDeclaration &&
+                    lastReferenceMap.has(o.name)
+                  ) {
+                    illegal.add(o.name);
+                  }
+                  if (
+                    defined.has(o.name) ||
+                    getBlock(o, p) !== object ||
+                    info.isImportSpecifier
+                  ) {
                     illegal.add(o.name);
                   }
                   defined.add(o.name);
@@ -123,6 +132,8 @@ export default class NameRecycling extends Transform {
                   referencedHere.add(o.name);
                 }
               }
+
+              lastReferenceMap.set(o.name, i);
             };
           }
         });

package/src/transforms/identifier/renameVariables.ts

@@ -10,6 +10,7 @@ import {
   isContext,
   isLexContext,
   getDefiningContext,
+  clone,
 } from "../../util/insert";
 import { isValidIdentifier } from "../../util/compare";
 import Transform from "../transform";
@@ -185,6 +186,24 @@ export default class RenameVariables extends Transform {
             return;
           }
 
+          // Strange behavior where the `local` and `imported` objects are the same
+          if (info.isImportSpecifier) {
+            var importSpecifierIndex = p.findIndex(
+              (x) => x.type === "ImportSpecifier"
+            );
+            if (
+              importSpecifierIndex != -1 &&
+              p[importSpecifierIndex].imported ===
+                (p[importSpecifierIndex - 1] || o) &&
+              p[importSpecifierIndex].imported &&
+              p[importSpecifierIndex].imported.type === "Identifier"
+            ) {
+              p[importSpecifierIndex].imported = clone(
+                p[importSpecifierIndex - 1] || o
+              );
+            }
+          }
+
           // console.log(o.name, "->", newName);
           o.name = newName;
           o.$renamed = true;

package/src/transforms/lock/antiDebug.ts

@@ -62,7 +62,7 @@ export default class AntiDebug extends Transform {
         IfStatement(
           Identifier(isDevName),
           this.options.lock.countermeasures
-            ? this.lock.getCounterMeasuresCode()
+            ? this.lock.getCounterMeasuresCode(tree.body, [tree])
             : [
                 WhileStatement(Identifier(isDevName), [
                   ExpressionStatement(

package/src/transforms/lock/integrity.ts

@@ -195,7 +195,10 @@ export default class Integrity extends Transform {
     }
 
     return () => {
-      object.__hiddenCountermeasures = this.lock.getCounterMeasuresCode();
+      object.__hiddenCountermeasures = this.lock.getCounterMeasuresCode(
+        object,
+        parents
+      );
 
       object.$eval = () => {
         var functionName = this.generateIdentifier();
@@ -258,6 +261,15 @@ export default class Integrity extends Transform {
           ifStatement,
         ]);
 
+        // Make sure the countermeasures activation variable is present
+        if (this.lock.counterMeasuresActivated) {
+          object.body.body.unshift(
+            VariableDeclaration(
+              VariableDeclarator(this.lock.counterMeasuresActivated)
+            )
+          );
+        }
+
         if (object.type == "ArrowFunctionExpression") {
           object.type = "FunctionExpression";
           object.expression = false;

package/src/transforms/lock/lock.ts

@@ -11,17 +11,12 @@ import {
   Literal,
   UnaryExpression,
   NewExpression,
-  FunctionDeclaration,
-  ReturnStatement,
   VariableDeclaration,
-  ObjectExpression,
-  Property,
-  ArrayExpression,
-  FunctionExpression,
   ThisExpression,
   VariableDeclarator,
   Location,
   LogicalExpression,
+  SequenceExpression,
 } from "../../util/gen";
 import traverse, { getBlock, isBlock } from "../../traverse";
 import { choice, getRandomInteger } from "../../util/random";
@@ -47,6 +42,12 @@ export default class Lock extends Transform {
   counterMeasuresNode: Location;
   iosDetectFn: string;
 
+  /**
+   * This is a boolean variable injected into the source code determining wether the countermeasures function has been called.
+   * This is used to prevent infinite loops from happening
+   */
+  counterMeasuresActivated: string;
+
   made: number;
 
   constructor(o) {
@@ -73,36 +74,32 @@ export default class Lock extends Transform {
       typeof this.options.lock.countermeasures === "string" &&
       isValidIdentifier(this.options.lock.countermeasures)
     ) {
-      var defined = new Set<string>();
       traverse(tree, (object, parents) => {
-        if (object.type == "Identifier") {
+        if (
+          object.type == "Identifier" &&
+          object.name === this.options.lock.countermeasures
+        ) {
           var info = getIdentifierInfo(object, parents);
           if (info.spec.isDefined) {
-            defined.add(object.name);
-            if (object.name === this.options.lock.countermeasures) {
-              if (this.counterMeasuresNode) {
+            if (this.counterMeasuresNode) {
+              throw new Error(
+                "Countermeasures function was already defined, it must have a unique name from the rest of your code"
+              );
+            } else {
+              var definingContext = getVarContext(parents[0], parents.slice(1));
+              if (definingContext != tree) {
                 throw new Error(
-                  "Countermeasures function was already defined, it must have a unique name from the rest of your code"
-                );
-              } else {
-                var definingContext = getVarContext(
-                  parents[0],
-                  parents.slice(1)
+                  "Countermeasures function must be defined at the global level"
                 );
-                if (definingContext != tree) {
-                  throw new Error(
-                    "Countermeasures function must be defined at the global level"
-                  );
-                }
-                var chain: Location = [object, parents];
-                if (info.isFunctionDeclaration) {
-                  chain = [parents[0], parents.slice(1)];
-                } else if (info.isVariableDeclaration) {
-                  chain = [parents[1], parents.slice(2)];
-                }
-
-                this.counterMeasuresNode = chain;
               }
+              var chain: Location = [object, parents];
+              if (info.isFunctionDeclaration) {
+                chain = [parents[0], parents.slice(1)];
+              } else if (info.isVariableDeclaration) {
+                chain = [parents[1], parents.slice(2)];
+              }
+
+              this.counterMeasuresNode = chain;
             }
           }
         }
@@ -120,7 +117,7 @@ export default class Lock extends Transform {
     super.apply(tree);
   }
 
-  getCounterMeasuresCode(): Node[] {
+  getCounterMeasuresCode(object: Node, parents: Node[]): Node[] {
     var opt = this.options.lock.countermeasures;
 
     if (opt === false) {
@@ -129,10 +126,30 @@ export default class Lock extends Transform {
 
     // Call function
     if (typeof opt === "string") {
+      if (!this.counterMeasuresActivated) {
+        this.counterMeasuresActivated = this.getPlaceholder();
+
+        prepend(
+          parents[parents.length - 1] || object,
+          VariableDeclaration(VariableDeclarator(this.counterMeasuresActivated))
+        );
+      }
+
       // Since Lock occurs before variable renaming, we are using the pre-obfuscated function name
       return [
         ExpressionStatement(
-          CallExpression(Template(opt).single().expression, [])
+          LogicalExpression(
+            "||",
+            Identifier(this.counterMeasuresActivated),
+            SequenceExpression([
+              AssignmentExpression(
+                "=",
+                Identifier(this.counterMeasuresActivated),
+                Literal(true)
+              ),
+              CallExpression(Template(opt).single().expression, []),
+            ])
+          )
         ),
       ];
     }
@@ -288,7 +305,7 @@ export default class Lock extends Transform {
           nodes.push(
             IfStatement(
               callExpression,
-              this.getCounterMeasuresCode() || [],
+              this.getCounterMeasuresCode(object, parents) || [],
               null
             )
           );
@@ -324,7 +341,11 @@ export default class Lock extends Transform {
             }
 
             nodes.push(
-              IfStatement(test, this.getCounterMeasuresCode() || [], null)
+              IfStatement(
+                test,
+                this.getCounterMeasuresCode(object, parents) || [],
+                null
+              )
             );
           }
 
@@ -338,7 +359,11 @@ export default class Lock extends Transform {
           );
 
           nodes.push(
-            IfStatement(test, this.getCounterMeasuresCode() || [], null)
+            IfStatement(
+              test,
+              this.getCounterMeasuresCode(object, parents) || [],
+              null
+            )
           );
 
           break;
@@ -351,7 +376,11 @@ export default class Lock extends Transform {
           );
 
           nodes.push(
-            IfStatement(test, this.getCounterMeasuresCode() || [], null)
+            IfStatement(
+              test,
+              this.getCounterMeasuresCode(object, parents) || [],
+              null
+            )
           );
 
           break;
@@ -359,6 +388,8 @@ export default class Lock extends Transform {
         case "context":
           var prop = choice(this.options.lock.context);
 
+          var code = this.getCounterMeasuresCode(object, parents) || [];
+
           // Todo: Alternative to `this`
           if (!this.globalVar) {
             offset = 1;
@@ -384,9 +415,7 @@ export default class Lock extends Transform {
             "!",
             MemberExpression(Identifier(this.globalVar), Literal(prop), true)
           );
-          nodes.push(
-            IfStatement(test, this.getCounterMeasuresCode() || [], null)
-          );
+          nodes.push(IfStatement(test, code, null));
 
           break;
 
@@ -397,6 +426,8 @@ export default class Lock extends Transform {
 
           ok(this.options.lock.osLock);
 
+          var code = this.getCounterMeasuresCode(object, parents) || [];
+
           this.options.lock.osLock.forEach((osName) => {
             var agentMatcher = {
               windows: "Win",
@@ -449,9 +480,7 @@ export default class Lock extends Transform {
           });
 
           test = UnaryExpression("!", { ...test });
-          nodes.push(
-            IfStatement(test, this.getCounterMeasuresCode() || [], null)
-          );
+          nodes.push(IfStatement(test, code, null));
           break;
 
         case "browserLock":
@@ -488,7 +517,11 @@ export default class Lock extends Transform {
 
           test = UnaryExpression("!", { ...test });
           nodes.push(
-            IfStatement(test, this.getCounterMeasuresCode() || [], null)
+            IfStatement(
+              test,
+              this.getCounterMeasuresCode(object, parents) || [],
+              null
+            )
           );
           break;
 
@@ -540,7 +573,11 @@ export default class Lock extends Transform {
               );
             }
             nodes.push(
-              IfStatement(test, this.getCounterMeasuresCode() || [], null)
+              IfStatement(
+                test,
+                this.getCounterMeasuresCode(object, parents) || [],
+                null
+              )
             );
           }
 

package/src/transforms/preparation/preparation.ts

@@ -3,24 +3,11 @@
  */
 import Transform from "../transform";
 
-import {
-  BlockStatement,
-  Identifier,
-  LabeledStatement,
-  Literal,
-  Location,
-  Node,
-  ReturnStatement,
-} from "../../util/gen";
+import { BlockStatement, Literal, ReturnStatement } from "../../util/gen";
 import { ObfuscateOrder } from "../../order";
-import { getIndexDirect, clone, getFunction } from "../../util/insert";
-import { ok } from "assert";
+import { clone, getFunction } from "../../util/insert";
 import { getIdentifierInfo } from "../../util/identifiers";
-import { walk } from "../../traverse";
 import Label from "../label";
-import NameConflicts from "./nameConflicts";
-import AntiDestructuring from "../es5/antiDestructuring";
-import { OPERATOR_PRECEDENCE } from "../../precedence";
 import { isLoop } from "../../util/compare";
 
 /**
@@ -181,12 +168,6 @@ export default class Preparation extends Transform {
     this.before.push(new Label(o));
     this.before.push(new ExplicitIdentifiers(o));
     this.before.push(new ExplicitDeclarations(o));
-
-    if (this.options.es5) {
-      this.before.push(new AntiDestructuring(o));
-    }
-
-    // this.before.push(new NameConflicts(o));
   }
 
   match() {

package/src/transforms/rgf.ts

@@ -30,6 +30,7 @@ import {
   isVarContext,
   isFunction,
   prepend,
+  getDefiningContext,
 } from "../util/insert";
 import { getRandomString } from "../util/random";
 import Transform from "./transform";
@@ -106,12 +107,44 @@ export default class RGF extends Transform {
             return;
           }
 
+          // Avoid applying to the countermeasures function
+          if (typeof this.options.lock?.countermeasures === "string") {
+            // function countermeasures(){...}
+            if (
+              object.type === "FunctionDeclaration" &&
+              object.id.type === "Identifier" &&
+              object.id.name === this.options.lock.countermeasures
+            ) {
+              return;
+            }
+
+            // var countermeasures = function(){...}
+            if (
+              parents[0].type === "VariableDeclarator" &&
+              parents[0].init === object &&
+              parents[0].id.type === "Identifier" &&
+              parents[0].id.name === this.options.lock.countermeasures
+            ) {
+              return;
+            }
+          }
+
           var defined = new Set<string>(),
             referenced = new Set<string>();
 
           var isBound = false;
 
-          walk(object.body, [object, ...parents], (o, p) => {
+          /**
+           * The fnTraverses serves two important purposes
+           *
+           * - Identify all the variables referenced and defined here
+           * - Identify is the 'this' keyword is used anywhere
+           *
+           * @param o
+           * @param p
+           * @returns
+           */
+          const fnTraverser = (o, p) => {
             if (
               o.type == "Identifier" &&
               !reservedIdentifiers.has(o.name) &&
@@ -121,7 +154,7 @@ export default class RGF extends Transform {
               if (!info.spec.isReferenced) {
                 return;
               }
-              if (info.spec.isDefined) {
+              if (info.spec.isDefined && getDefiningContext(o, p) === object) {
                 defined.add(o.name);
               } else {
                 referenced.add(o.name);
@@ -131,7 +164,10 @@ export default class RGF extends Transform {
             if (o.type == "ThisExpression" || o.type == "Super") {
               isBound = true;
             }
-          });
+          };
+
+          walk(object.params, [object, ...parents], fnTraverser);
+          walk(object.body, [object, ...parents], fnTraverser);
 
           if (!isBound) {
             defined.forEach((identifier) => {