js-confuser 1.5.7 → 1.5.9

package/CHANGELOG.md

@@ -1,3 +1,54 @@
+# `1.5.9`
+Big update
+
+This updates comes with many bug fixes:
+
+- Fixed [#72](https://github.com/MichaelXF/js-confuser/issues/72)
+- - ES5 to handle Class Fields
+
+Note: The `ES5` option is not meant to replace Babel. It is only intended to undo ES6 features the obfuscator may have added to your code.
+
+- Fixed [#74](https://github.com/MichaelXF/js-confuser/issues/74)
+- - Anti Tooling to not break Symbols
+
+- Fixed [#75](https://github.com/MichaelXF/js-confuser/issues/75)
+- - Minify to properly handle Object constructors
+
+- Fixed [#76](https://github.com/MichaelXF/js-confuser/issues/76)
+- - Minify to not cause syntax errors when objects used `^`, `` ` ``, `[`, `]` as property keys
+
+- Fixed [#77](https://github.com/MichaelXF/js-confuser/issues/77)
+- - Dispatcher to not break code that uses generic names like `toString` and `hasOwnProperty`
+
+- Fixed [#78](https://github.com/MichaelXF/js-confuser/issues/78)
+- - Object Extraction to not error on objects with spread elements
+
+- Fixed [#79](https://github.com/MichaelXF/js-confuser/issues/79)
+- - JsConfuser now supports `BigInt` literals
+
+- Fixed [#80](https://github.com/MichaelXF/js-confuser/issues/80)
+- - Rename Variables to not break code that had `var` and `let` variables in the same scope
+
+- Fixed [#81](https://github.com/MichaelXF/js-confuser/issues/81)
+- - Control Flow Flattening to not break `typeof` expressions
+
+- Fixed [#82](https://github.com/MichaelXF/js-confuser/issues/82)
+- - String Concealing to not break class constructors
+
+# `1.5.8`
+Several fixes
+
+- Fixed [#46](https://github.com/MichaelXF/js-confuser/issues/46)
+- - Updated the validation on `lock` options
+
+- Fixed [#68](https://github.com/MichaelXF/js-confuser/issues/68)
+- - Name Recycling fixed to not break certain function declarations
+
+- Fixed [#69](https://github.com/MichaelXF/js-confuser/issues/69), [#70](https://github.com/MichaelXF/js-confuser/issues/70) and [#71](https://github.com/MichaelXF/js-confuser/issues/71)
+- - Import statements to be properly handled
+
+- Slight improvements to String Concealing
+
 # `1.5.7`
 Countermeasures function fixes
 

package/dist/index.js

@@ -37,6 +37,8 @@ var _object = require("./util/object");
 
 var _presets = _interopRequireDefault(require("./presets"));
 
+var _perf_hooks = require("perf_hooks");
+
 var assert = _interopRequireWildcard(require("assert"));
 
 var _options = require("./options");
@@ -103,7 +105,7 @@ var JsConfuser = async function (code, options) {
   return result;
 };
 
-var debugTransformations = async function debugTransformations(code, options) {
+const debugTransformations = async function (code, options) {
   (0, _options.validateOptions)(options);
   options = await (0, _options.correctOptions)(options);
   var frames = [];
@@ -121,21 +123,60 @@ var debugTransformations = async function debugTransformations(code, options) {
   await obfuscator.apply(tree, true);
   return frames;
 };
+/**
+ * This method is used by the obfuscator website to display a progress bar and additional information
+ * about the obfuscation.
+ *
+ * @param code - Source code to obfuscate
+ * @param options - Options
+ * @param callback - Progress callback, called after each transformation
+ * @returns
+ */
+
 
 exports.debugTransformations = debugTransformations;
 
-var debugObfuscation = async function debugTransformations(code, options, callback) {
+const debugObfuscation = async function (code, options, callback) {
+  const startTime = _perf_hooks.performance.now();
+
   (0, _options.validateOptions)(options);
   options = await (0, _options.correctOptions)(options);
+
+  const beforeParseTime = _perf_hooks.performance.now();
+
   var tree = (0, _parser.parseSync)(code);
+  const parseTime = _perf_hooks.performance.now() - beforeParseTime;
   var obfuscator = new _obfuscator.default(options);
   var totalTransforms = obfuscator.array.length;
+  var transformationTimes = Object.create(null);
+
+  var currentTransformTime = _perf_hooks.performance.now();
+
   obfuscator.on("debug", (name, tree, i) => {
+    var nowTime = _perf_hooks.performance.now();
+
+    transformationTimes[name] = nowTime - currentTransformTime;
+    currentTransformTime = nowTime;
     callback(name, i, totalTransforms);
   });
   await obfuscator.apply(tree, true);
-  var output = (0, _compiler.default)(tree, options);
-  return output;
+
+  const beforeCompileTime = _perf_hooks.performance.now();
+
+  var output = await (0, _compiler.default)(tree, options);
+  const compileTime = _perf_hooks.performance.now() - beforeCompileTime;
+
+  const endTime = _perf_hooks.performance.now();
+
+  return {
+    obfuscated: output,
+    transformationTimes: transformationTimes,
+    obfuscationTime: endTime - startTime,
+    parseTime: parseTime,
+    compileTime: compileTime,
+    totalTransforms: totalTransforms,
+    totalPossibleTransforms: obfuscator.totalPossibleTransforms
+  };
 };
 
 exports.debugObfuscation = debugObfuscation;

package/dist/obfuscator.js

@@ -94,18 +94,23 @@ class Obfuscator extends _events.EventEmitter {
 
     _defineProperty(this, "generated", void 0);
 
+    _defineProperty(this, "totalPossibleTransforms", void 0);
+
     this.varCount = 0;
     this.transforms = Object.create(null);
     this.generated = new Set();
+    this.totalPossibleTransforms = 0;
     this.push(new _preparation.default(this));
     this.push(new _renameLabels.default(this));
 
     const test = function (map) {
-      if ((0, _probability.isProbabilityMapProbable)(map)) {
-        for (var _len = arguments.length, transformers = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
-          transformers[_key - 1] = arguments[_key];
-        }
+      for (var _len = arguments.length, transformers = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
+        transformers[_key - 1] = arguments[_key];
+      }
 
+      _this.totalPossibleTransforms += transformers.length;
+
+      if ((0, _probability.isProbabilityMapProbable)(map)) {
         // options.verbose && console.log("+ Added " + transformer.name);
         transformers.forEach(Transformer => _this.push(new Transformer(_this)));
       } else {// options.verbose && console.log("- Skipped adding " + transformer.name);
@@ -137,7 +142,7 @@ class Obfuscator extends _events.EventEmitter {
     test(options.stack, _stack.default);
     test(true, _antiTooling.default);
     test(options.hideInitializingCode, _hideInitializingCode.default);
-    test(options.hexadecimalNumbers, _hexadecimalNumbers.default);
+    test(true, _hexadecimalNumbers.default); // BigInt support is included
 
     if (options.lock && Object.keys(options.lock).filter(x => x == "domainLock" ? options.lock.domainLock && options.lock.domainLock.length : options.lock[x]).length) {
       test(true, _lock.default);

package/dist/options.js

@@ -40,24 +40,24 @@ function validateOptions(options) {
 
   if (options.lock) {
     // Validate browser-lock option
-    if (typeof options.lock.browserLock !== "undefined") {
+    if (options.lock.browserLock && typeof options.lock.browserLock !== "undefined") {
       (0, _assert.ok)(Array.isArray(options.lock.browserLock), "browserLock must be an array");
       (0, _assert.ok)(!options.lock.browserLock.find(browserName => !validBrowsers.has(browserName)), 'Invalid browser name. Allowed: "firefox", "chrome", "iexplorer", "edge", "safari", "opera"');
     } // Validate os-lock option
 
 
-    if (typeof options.lock.osLock !== "undefined") {
+    if (options.lock.osLock && typeof options.lock.osLock !== "undefined") {
       (0, _assert.ok)(Array.isArray(options.lock.osLock), "osLock must be an array");
       (0, _assert.ok)(!options.lock.osLock.find(osName => !validOses.has(osName)), 'Invalid OS name. Allowed: "windows", "linux", "osx", "ios", "android"');
     } // Validate domain-lock option
 
 
-    if (typeof options.lock.domainLock !== "undefined") {
+    if (options.lock.domainLock && typeof options.lock.domainLock !== "undefined") {
       (0, _assert.ok)(Array.isArray(options.lock.domainLock), "domainLock must be an array");
     } // Validate context option
 
 
-    if (typeof options.lock.context !== "undefined") {
+    if (options.lock.context && typeof options.lock.context !== "undefined") {
       (0, _assert.ok)(Array.isArray(options.lock.context), "context must be an array");
     } // Validate start-date option
 
@@ -109,8 +109,7 @@ async function correctOptions(options) {
 
   if (options.lock && options.lock.selfDefending) {
     options.compact = true; // self defending forcibly enables this
-  } // options.globalVariables was never used.
-  // GlobalConcealing implicitly determines a global to be a variable referenced but never defined or modified.
+  } // options.globalVariables outlines generic globals that should be present in the execution context
 
 
   if (!options.hasOwnProperty("globalVariables")) {
@@ -124,7 +123,7 @@ async function correctOptions(options) {
       ["global", "Buffer", "require", "process", "__dirname", "__filename"].forEach(x => options.globalVariables.add(x));
     }
 
-    ["globalThis", "console", "parseInt", "parseFloat", "Math", "Promise", "String", "Boolean", "Function", "Object", "Array", "Proxy", "Error", "setTimeout", "clearTimeout", "setInterval", "clearInterval", "setImmediate", "clearImmediate", "queueMicrotask", "exports", "module", "isNaN", "isFinite"].forEach(x => options.globalVariables.add(x));
+    ["globalThis", "console", "parseInt", "parseFloat", "Math", "Promise", "String", "Boolean", "Function", "Object", "Array", "Proxy", "Error", "TypeError", "ReferenceError", "RangeError", "EvalError", "setTimeout", "clearTimeout", "setInterval", "clearInterval", "setImmediate", "clearImmediate", "queueMicrotask", "exports", "module", "isNaN", "isFinite", "Set", "Map", "WeakSet", "WeakMap", "Symbol"].forEach(x => options.globalVariables.add(x));
   }
 
   return options;

package/dist/order.js

@@ -33,9 +33,9 @@ exports.ObfuscateOrder = ObfuscateOrder;
   ObfuscateOrder[ObfuscateOrder["Shuffle"] = 24] = "Shuffle";
   ObfuscateOrder[ObfuscateOrder["NameRecycling"] = 25] = "NameRecycling";
   ObfuscateOrder[ObfuscateOrder["MovedDeclarations"] = 26] = "MovedDeclarations";
-  ObfuscateOrder[ObfuscateOrder["RenameVariables"] = 27] = "RenameVariables";
-  ObfuscateOrder[ObfuscateOrder["RenameLabels"] = 28] = "RenameLabels";
-  ObfuscateOrder[ObfuscateOrder["Minify"] = 30] = "Minify";
+  ObfuscateOrder[ObfuscateOrder["RenameLabels"] = 27] = "RenameLabels";
+  ObfuscateOrder[ObfuscateOrder["Minify"] = 28] = "Minify";
+  ObfuscateOrder[ObfuscateOrder["RenameVariables"] = 30] = "RenameVariables";
   ObfuscateOrder[ObfuscateOrder["ES5"] = 31] = "ES5";
   ObfuscateOrder[ObfuscateOrder["StringEncoding"] = 32] = "StringEncoding";
   ObfuscateOrder[ObfuscateOrder["AntiTooling"] = 34] = "AntiTooling";

package/dist/transforms/antiTooling.js

@@ -50,7 +50,7 @@ class AntiTooling extends _transform.default {
         if (flattened.length > 1) {
           flattened[0] = { ...flattened[0]
           };
-          this.replace(exprs[0], (0, _gen.ExpressionStatement)((0, _gen.UnaryExpression)((0, _random.choice)(["typeof", "void", "~", "!", "+"]), (0, _gen.SequenceExpression)(flattened))));
+          this.replace(exprs[0], (0, _gen.ExpressionStatement)((0, _gen.UnaryExpression)((0, _random.choice)(["typeof", "void", "!"]), (0, _gen.SequenceExpression)(flattened))));
           deleteExprs.push(...exprs.slice(1));
         }
 

package/dist/transforms/controlFlowFlattening/controlFlowFlattening.js

@@ -31,6 +31,8 @@ var _expressionObfuscation = _interopRequireDefault(require("./expressionObfusca
 
 var _switchCaseObfuscation = _interopRequireDefault(require("./switchCaseObfuscation"));
 
+var _stringConcealing = require("../string/stringConcealing");
+
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
 function _defineProperty(obj, key, value) { if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
@@ -181,6 +183,14 @@ class ControlFlowFlattening extends _transform.default {
       illegalFnNames.forEach(illegal => {
         fnNames.delete(illegal);
       });
+      var importDeclarations = [];
+
+      for (var stmt of body) {
+        if (stmt.type === "ImportDeclaration") {
+          importDeclarations.push(stmt);
+        }
+      }
+
       var fraction = 0.9;
 
       if (body.length > 20) {
@@ -237,7 +247,7 @@ class ControlFlowFlattening extends _transform.default {
             body: [...currentBody]
           });
           (0, _traverse.walk)(currentBody, [], (o, p) => {
-            if (o.type == "Literal" && typeof o.value == "string" && !o.regex && Math.random() / (Object.keys(stringBank).length / 2 + 1) > 0.5) {
+            if (o.type == "Literal" && typeof o.value == "string" && !(0, _stringConcealing.isModuleSource)(o, p) && !o.regex && Math.random() / (Object.keys(stringBank).length / 2 + 1) > 0.5) {
               needsStringBankVar = true;
 
               if (!stringBankByLabels[currentLabel]) {
@@ -260,7 +270,7 @@ class ControlFlowFlattening extends _transform.default {
         };
 
         body.forEach((stmt, i) => {
-          if (functionDeclarations.has(stmt)) {
+          if (functionDeclarations.has(stmt) || stmt.type === "ImportDeclaration") {
             return;
           }
 
@@ -708,6 +718,10 @@ class ControlFlowFlattening extends _transform.default {
       var discriminant = (0, _template.default)("".concat(stateVars.join("+"))).single().expression;
       body.length = 0;
 
+      for (var importDeclaration of importDeclarations) {
+        body.push(importDeclaration);
+      }
+
       if (functionDeclarations.size) {
         functionDeclarations.forEach(x => {
           if (!x.id || illegalFnNames.has(x.id.name)) {

package/dist/transforms/controlFlowFlattening/expressionObfuscation.js

@@ -30,7 +30,8 @@ class ExpressionObfuscation extends _transform.default {
         if (stmt.type == "ExpressionStatement") {
           var expr = stmt.expression;
 
-          if (expr.type == "UnaryExpression" && exprs.length) {
+          if (expr.type == "UnaryExpression" && !(expr.operator === "typeof" && expr.argument.type === "Identifier") && exprs.length // typeof is special
+          ) {
             expr.argument = (0, _gen.SequenceExpression)([...exprs, { ...expr.argument
             }]);
             deleteExprs.push(...exprs);
@@ -42,7 +43,8 @@ class ExpressionObfuscation extends _transform.default {
           if (exprs.length) {
             if (stmt.type == "IfStatement") {
               if (stmt.test.type == "BinaryExpression" && stmt.test.operator !== "**") {
-                if (stmt.test.left.type == "UnaryExpression") {
+                if (stmt.test.left.type == "UnaryExpression" && !(stmt.test.left.operator === "typeof" && stmt.test.left.argument.type === "Identifier") // typeof is special
+                ) {
                   stmt.test.left.argument = (0, _gen.SequenceExpression)([...exprs, { ...stmt.test.left.argument
                   }]);
                 } else {

package/dist/transforms/dispatcher.js

@@ -80,12 +80,12 @@ class Dispatcher extends _transform.default {
         } // Map of FunctionDeclarations
 
 
-        var functionDeclarations = {}; // Array of Identifier nodes
+        var functionDeclarations = Object.create(null); // Array of Identifier nodes
 
         var identifiers = [];
         var illegalFnNames = new Set(); // New Names for Functions
 
-        var newFnNames = {}; // [old name]: randomized name
+        var newFnNames = Object.create(null); // [old name]: randomized name
 
         var context = (0, _insert.isVarContext)(object) ? object : (0, _insert.getVarContext)(object, parents);
         (0, _traverse.walk)(object, parents, (o, p) => {
@@ -264,7 +264,7 @@ class Dispatcher extends _transform.default {
 
             var newName = newFnNames[o.name];
 
-            if (!newName) {
+            if (!newName || typeof newName !== "string") {
               return;
             }
 

package/dist/transforms/es5/antiClass.js

@@ -85,9 +85,13 @@ class AntiClass extends _transform.default {
               this.replace(o, (0, _gen.Identifier)(superName));
             }
           });
-        }
+        } // Support class fields
+
 
-        if (methodDefinition.kind == "constructor" || methodDefinition.kind == "method") {
+        if (methodDefinition.type === "PropertyDefinition") {
+          var assignmentExpression = (0, _gen.AssignmentExpression)("=", key, value || (0, _gen.Identifier)("undefined"));
+          pushingTo.push((0, _gen.ExpressionStatement)(assignmentExpression));
+        } else if (methodDefinition.kind == "constructor" || methodDefinition.kind == "method") {
           pushingTo.push((0, _gen.ExpressionStatement)((0, _gen.AssignmentExpression)("=", key, value)));
         } else if (methodDefinition.kind == "get" || methodDefinition.kind == "set") {
           var id = (0, _gen.Identifier)(methodDefinition.kind == "get" ? "getters" : "setters");

package/dist/transforms/es5/antiDestructuring.js

@@ -189,7 +189,7 @@ class AntiDestructuring extends _transform.default {
         var seq = (0, _gen.SequenceExpression)([(0, _gen.AssignmentExpression)("=", (0, _gen.Identifier)(temp), (0, _insert.clone)(extracting) || (0, _gen.Identifier)("undefined")), ...exprs]);
 
         if (object.type == "VariableDeclarator") {
-          var i = (0, _insert.getIndexDirect)(object, parents);
+          var i = (0, _insert.getIndexDirect)(object, parents[0]);
           var extra = Array.from(names).map(x => {
             return {
               type: "VariableDeclarator",

package/dist/transforms/eval.js

@@ -31,6 +31,17 @@ class Eval extends _transform.default {
   }
 
   transform(object, parents) {
+    // Don't apply to getter/setters or class methods
+    if (parents[0]) {
+      if (parents[0].type === "MethodDefinition" && parents[0].value === object) {
+        return;
+      }
+
+      if (parents[0].type === "Property" && parents[0].value === object && (parents[0].kind !== "init" || parents[0].method)) {
+        return;
+      }
+    }
+
     if (!(0, _probability.ComputeProbabilityMap)(this.options.eval, x => x, object.id && object.id.name)) {
       return;
     }

package/dist/transforms/extraction/duplicateLiteralsRemoval.js

@@ -113,7 +113,7 @@ class DuplicateLiteralsRemoval extends _transform.default {
       var body = [];
       var thisShift = (0, _random.getRandomInteger)(-250, 250); // the name of the getter
 
-      getterName = this.getPlaceholder();
+      getterName = this.getPlaceholder() + "_dLR_" + this.fnGetters.size;
 
       if (basedOn) {
         var shift = this.fnShifts.get(basedOn);
@@ -179,17 +179,17 @@ class DuplicateLiteralsRemoval extends _transform.default {
           this.arrayExpression = (0, _gen.ArrayExpression)([]);
         }
 
-        var first = this.first.get(value);
+        var firstLocation = this.first.get(value);
 
-        if (first) {
+        if (firstLocation) {
           this.first.set(value, null);
           var index = this.map.size;
           (0, _assert.ok)(!this.map.has(value));
           this.map.set(value, index);
-          this.toCaller(first[0], first[1], index);
           var pushing = (0, _insert.clone)(object);
           this.arrayExpression.elements.push(pushing);
           (0, _assert.ok)(this.arrayExpression.elements[index] === pushing);
+          this.toCaller(firstLocation[0], firstLocation[1], index);
         }
 
         var index = this.map.get(value);

package/dist/transforms/extraction/objectExtraction.js

@@ -97,7 +97,12 @@ class ObjectExtraction extends _transform.default {
               var nonInitOrComputed = object.properties.find(x => x.kind !== "init" || x.computed);
 
               if (nonInitOrComputed) {
-                this.log(name + " has non-init/computed property: " + nonInitOrComputed.key.name || nonInitOrComputed.key.value);
+                if (nonInitOrComputed.key) {
+                  this.log(name + " has non-init/computed property: " + nonInitOrComputed.key.name || nonInitOrComputed.key.value);
+                } else {
+                  this.log(name + " has spread-element or other type of property");
+                }
+
                 illegal.add(name);
                 return;
               } else {