js-confuser 1.5.7 → 1.5.9

package/dist/util/compare.js

@@ -59,8 +59,8 @@ function isValidIdentifier(name) {
     return false;
   }
 
-  var x = name.match(/^[A-z$_][A-z0-9$_]*/);
-  return x && x[0] == name;
+  var x = name.match(/^[A-Za-z$_][A-Za-z0-9$_]*/);
+  return !!(x && x[0] == name);
 }
 
 function isInsideType(type, object, parents) {

package/dist/util/insert.js

@@ -139,8 +139,12 @@ function getDefiningContext(o, p) {
     var variableDeclaration = p.find(x => x.type == "VariableDeclaration");
     (0, _assert.ok)(variableDeclaration);
 
-    if (variableDeclaration.kind === "let") {
-      return getLexContext(o, p);
+    if (variableDeclaration.kind === "let" || variableDeclaration.kind === "const") {
+      var context = getVarContext(o, p);
+
+      if (context && context.type === "Program") {
+        return getLexContext(o, p);
+      }
     }
   }
 
@@ -287,15 +291,21 @@ function prepend(block) {
   }
 
   if (block.type == "Program") {
-    var decs = 0;
+    var moveBy = 0;
     block.body.forEach((stmt, i) => {
       if (stmt.type == "ImportDeclaration") {
-        if (decs == i) {
-          decs++;
+        if (moveBy == i) {
+          moveBy++;
+        }
+      }
+
+      if (stmt.type === "ExpressionStatement" && typeof stmt.directive === "string") {
+        if (moveBy == i) {
+          moveBy++;
         }
       }
     });
-    block.body.splice(decs, 0, ...nodes);
+    block.body.splice(moveBy, 0, ...nodes);
   } else {
     getBlockBody(block).unshift(...nodes);
   }
@@ -351,6 +361,10 @@ function isForInitialize(o, p) {
   (0, _identifiers.validateChain)(o, p);
   var forIndex = p.findIndex(x => x.type == "ForStatement" || x.type == "ForInStatement" || x.type == "ForOfStatement");
 
+  if (p.slice(0, forIndex).find(x => ["ArrowFunctionExpression", "BlockStatement"].includes(x.type))) {
+    return false;
+  }
+
   if (forIndex !== -1) {
     if (p[forIndex].type == "ForStatement") {
       if (p[forIndex].init == (p[forIndex - 1] || o)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "js-confuser",
-  "version": "1.5.7",
+  "version": "1.5.9",
   "description": "JavaScript Obfuscation Tool.",
   "main": "dist/index.js",
   "types": "index.d.ts",
@@ -22,7 +22,7 @@
   "author": "MichaelXF",
   "license": "MIT",
   "dependencies": {
-    "acorn": "^8.7.0",
+    "acorn": "^8.8.2",
     "escodegen": "^2.0.0"
   },
   "devDependencies": {

package/src/index.ts

@@ -4,6 +4,7 @@ import Obfuscator from "./obfuscator";
 import Transform from "./transforms/transform";
 import { remove$Properties } from "./util/object";
 import presets from "./presets";
+import { performance } from "perf_hooks";
 
 import * as assert from "assert";
 import { correctOptions, ObfuscateOptions, validateOptions } from "./options";
@@ -85,8 +86,8 @@ var JsConfuser: IJsConfuser = async function (
   return result;
 } as any;
 
-export var debugTransformations: IJsConfuserDebugTransformations =
-  async function debugTransformations(
+export const debugTransformations: IJsConfuserDebugTransformations =
+  async function (
     code: string,
     options: ObfuscateOptions
   ): Promise<{ name: string; code: string; ms: number }[]> {
@@ -115,28 +116,65 @@ export var debugTransformations: IJsConfuserDebugTransformations =
     return frames;
   };
 
-export var debugObfuscation: IJsConfuserDebugObfuscation =
-  async function debugTransformations(
-    code: string,
-    options: ObfuscateOptions,
-    callback: (name: string, complete: number, totalTransforms: number) => void
-  ): Promise<string> {
-    validateOptions(options);
-    options = await correctOptions(options);
+/**
+ * This method is used by the obfuscator website to display a progress bar and additional information
+ * about the obfuscation.
+ *
+ * @param code - Source code to obfuscate
+ * @param options - Options
+ * @param callback - Progress callback, called after each transformation
+ * @returns
+ */
+export const debugObfuscation: IJsConfuserDebugObfuscation = async function (
+  code: string,
+  options: ObfuscateOptions,
+  callback: (name: string, complete: number, totalTransforms: number) => void
+) {
+  const startTime = performance.now();
 
-    var tree = parseSync(code);
-    var obfuscator = new Obfuscator(options);
-    var totalTransforms = obfuscator.array.length;
+  validateOptions(options);
+  options = await correctOptions(options);
 
-    obfuscator.on("debug", (name: string, tree: Node, i: number) => {
-      callback(name, i, totalTransforms);
-    });
+  const beforeParseTime = performance.now();
 
-    await obfuscator.apply(tree, true);
+  var tree = parseSync(code);
+
+  const parseTime = performance.now() - beforeParseTime;
+
+  var obfuscator = new Obfuscator(options);
+  var totalTransforms = obfuscator.array.length;
+
+  var transformationTimes = Object.create(null);
+  var currentTransformTime = performance.now();
+
+  obfuscator.on("debug", (name: string, tree: Node, i: number) => {
+    var nowTime = performance.now();
+    transformationTimes[name] = nowTime - currentTransformTime;
+    currentTransformTime = nowTime;
+
+    callback(name, i, totalTransforms);
+  });
+
+  await obfuscator.apply(tree, true);
+
+  const beforeCompileTime = performance.now();
+
+  var output = await compileJs(tree, options);
+
+  const compileTime = performance.now() - beforeCompileTime;
+
+  const endTime = performance.now();
 
-    var output = compileJs(tree, options);
-    return output;
+  return {
+    obfuscated: output,
+    transformationTimes: transformationTimes,
+    obfuscationTime: endTime - startTime,
+    parseTime: parseTime,
+    compileTime: compileTime,
+    totalTransforms: totalTransforms,
+    totalPossibleTransforms: obfuscator.totalPossibleTransforms,
   };
+};
 
 JsConfuser.obfuscate = obfuscate;
 JsConfuser.obfuscateAST = obfuscateAST;

package/src/obfuscator.ts

@@ -47,17 +47,22 @@ export default class Obfuscator extends EventEmitter {
   state: "transform" | "eval" = "transform";
   generated: Set<string>;
 
+  totalPossibleTransforms: number;
+
   constructor(public options: ObfuscateOptions) {
     super();
 
     this.varCount = 0;
     this.transforms = Object.create(null);
     this.generated = new Set();
+    this.totalPossibleTransforms = 0;
 
     this.push(new Preparation(this));
     this.push(new RenameLabels(this));
 
     const test = <T>(map: ProbabilityMap<T>, ...transformers: any[]) => {
+      this.totalPossibleTransforms += transformers.length;
+
       if (isProbabilityMapProbable(map)) {
         // options.verbose && console.log("+ Added " + transformer.name);
 
@@ -97,7 +102,7 @@ export default class Obfuscator extends EventEmitter {
     test(options.stack, Stack);
     test(true, AntiTooling);
     test(options.hideInitializingCode, HideInitializingCode);
-    test(options.hexadecimalNumbers, HexadecimalNumbers);
+    test(true, HexadecimalNumbers); // BigInt support is included
 
     if (
       options.lock &&

package/src/options.ts

@@ -770,7 +770,10 @@ export function validateOptions(options: ObfuscateOptions) {
 
   if (options.lock) {
     // Validate browser-lock option
-    if (typeof options.lock.browserLock !== "undefined") {
+    if (
+      options.lock.browserLock &&
+      typeof options.lock.browserLock !== "undefined"
+    ) {
       ok(
         Array.isArray(options.lock.browserLock),
         "browserLock must be an array"
@@ -783,7 +786,7 @@ export function validateOptions(options: ObfuscateOptions) {
       );
     }
     // Validate os-lock option
-    if (typeof options.lock.osLock !== "undefined") {
+    if (options.lock.osLock && typeof options.lock.osLock !== "undefined") {
       ok(Array.isArray(options.lock.osLock), "osLock must be an array");
       ok(
         !options.lock.osLock.find((osName) => !validOses.has(osName)),
@@ -791,12 +794,15 @@ export function validateOptions(options: ObfuscateOptions) {
       );
     }
     // Validate domain-lock option
-    if (typeof options.lock.domainLock !== "undefined") {
+    if (
+      options.lock.domainLock &&
+      typeof options.lock.domainLock !== "undefined"
+    ) {
       ok(Array.isArray(options.lock.domainLock), "domainLock must be an array");
     }
 
     // Validate context option
-    if (typeof options.lock.context !== "undefined") {
+    if (options.lock.context && typeof options.lock.context !== "undefined") {
       ok(Array.isArray(options.lock.context), "context must be an array");
     }
 
@@ -861,8 +867,7 @@ export async function correctOptions(
     options.compact = true; // self defending forcibly enables this
   }
 
-  // options.globalVariables was never used.
-  // GlobalConcealing implicitly determines a global to be a variable referenced but never defined or modified.
+  // options.globalVariables outlines generic globals that should be present in the execution context
   if (!options.hasOwnProperty("globalVariables")) {
     options.globalVariables = new Set([]);
 
@@ -902,6 +907,10 @@ export async function correctOptions(
       "Array",
       "Proxy",
       "Error",
+      "TypeError",
+      "ReferenceError",
+      "RangeError",
+      "EvalError",
       "setTimeout",
       "clearTimeout",
       "setInterval",
@@ -913,6 +922,11 @@ export async function correctOptions(
       "module",
       "isNaN",
       "isFinite",
+      "Set",
+      "Map",
+      "WeakSet",
+      "WeakMap",
+      "Symbol",
     ].forEach((x) => options.globalVariables.add(x));
   }
 

package/src/order.ts

@@ -44,11 +44,11 @@ export enum ObfuscateOrder {
 
   MovedDeclarations = 26,
 
-  RenameVariables = 27,
+  RenameLabels = 27,
 
-  RenameLabels = 28,
+  Minify = 28,
 
-  Minify = 30,
+  RenameVariables = 30,
 
   ES5 = 31,
 

package/src/transforms/antiTooling.ts

@@ -45,7 +45,7 @@ export default class AntiTooling extends Transform {
             exprs[0],
             ExpressionStatement(
               UnaryExpression(
-                choice(["typeof", "void", "~", "!", "+"]),
+                choice(["typeof", "void", "!"]),
                 SequenceExpression(flattened)
               )
             )

package/src/transforms/controlFlowFlattening/controlFlowFlattening.ts

@@ -47,6 +47,7 @@ import ChoiceFlowObfuscation from "./choiceFlowObfuscation";
 import ControlFlowObfuscation from "./controlFlowObfuscation";
 import ExpressionObfuscation from "./expressionObfuscation";
 import SwitchCaseObfuscation from "./switchCaseObfuscation";
+import { isModuleSource } from "../string/stringConcealing";
 
 var flattenStructures = new Set([
   "IfStatement",
@@ -226,6 +227,13 @@ export default class ControlFlowFlattening extends Transform {
         fnNames.delete(illegal);
       });
 
+      var importDeclarations = [];
+      for (var stmt of body) {
+        if (stmt.type === "ImportDeclaration") {
+          importDeclarations.push(stmt);
+        }
+      }
+
       var fraction = 0.9;
       if (body.length > 20) {
         fraction /= Math.max(1.2, body.length - 18);
@@ -285,6 +293,7 @@ export default class ControlFlowFlattening extends Transform {
             if (
               o.type == "Literal" &&
               typeof o.value == "string" &&
+              !isModuleSource(o, p) &&
               !o.regex &&
               Math.random() / (Object.keys(stringBank).length / 2 + 1) > 0.5
             ) {
@@ -318,7 +327,10 @@ export default class ControlFlowFlattening extends Transform {
         };
 
         body.forEach((stmt, i) => {
-          if (functionDeclarations.has(stmt)) {
+          if (
+            functionDeclarations.has(stmt) ||
+            stmt.type === "ImportDeclaration"
+          ) {
             return;
           }
 
@@ -1045,6 +1057,9 @@ export default class ControlFlowFlattening extends Transform {
       var discriminant = Template(`${stateVars.join("+")}`).single().expression;
 
       body.length = 0;
+      for (var importDeclaration of importDeclarations) {
+        body.push(importDeclaration);
+      }
 
       if (functionDeclarations.size) {
         functionDeclarations.forEach((x) => {

package/src/transforms/controlFlowFlattening/expressionObfuscation.ts

@@ -20,7 +20,13 @@ export default class ExpressionObfuscation extends Transform {
         if (stmt.type == "ExpressionStatement") {
           var expr = stmt.expression;
 
-          if (expr.type == "UnaryExpression" && exprs.length) {
+          if (
+            expr.type == "UnaryExpression" &&
+            !(
+              expr.operator === "typeof" && expr.argument.type === "Identifier"
+            ) &&
+            exprs.length // typeof is special
+          ) {
             expr.argument = SequenceExpression([
               ...exprs,
               { ...expr.argument },
@@ -38,7 +44,13 @@ export default class ExpressionObfuscation extends Transform {
                 stmt.test.type == "BinaryExpression" &&
                 stmt.test.operator !== "**"
               ) {
-                if (stmt.test.left.type == "UnaryExpression") {
+                if (
+                  stmt.test.left.type == "UnaryExpression" &&
+                  !(
+                    stmt.test.left.operator === "typeof" &&
+                    stmt.test.left.argument.type === "Identifier"
+                  ) // typeof is special
+                ) {
                   stmt.test.left.argument = SequenceExpression([
                     ...exprs,
                     { ...stmt.test.left.argument },

package/src/transforms/dispatcher.ts

@@ -97,14 +97,15 @@ export default class Dispatcher extends Transform {
         }
 
         // Map of FunctionDeclarations
-        var functionDeclarations: { [name: string]: Location } = {};
+        var functionDeclarations: { [name: string]: Location } =
+          Object.create(null);
 
         // Array of Identifier nodes
         var identifiers: Location[] = [];
         var illegalFnNames: Set<string> = new Set();
 
         // New Names for Functions
-        var newFnNames: { [name: string]: string } = {}; // [old name]: randomized name
+        var newFnNames: { [name: string]: string } = Object.create(null); // [old name]: randomized name
 
         var context = isVarContext(object)
           ? object
@@ -469,7 +470,7 @@ export default class Dispatcher extends Transform {
             }
 
             var newName = newFnNames[o.name];
-            if (!newName) {
+            if (!newName || typeof newName !== "string") {
               return;
             }
 

package/src/transforms/es5/antiClass.ts

@@ -110,7 +110,16 @@ export default class AntiClass extends Transform {
           );
         }
 
-        if (
+        // Support class fields
+        if (methodDefinition.type === "PropertyDefinition") {
+          var assignmentExpression = AssignmentExpression(
+            "=",
+            key,
+            value || Identifier("undefined")
+          );
+
+          pushingTo.push(ExpressionStatement(assignmentExpression));
+        } else if (
           methodDefinition.kind == "constructor" ||
           methodDefinition.kind == "method"
         ) {

package/src/transforms/es5/antiDestructuring.ts

@@ -266,7 +266,7 @@ export default class AntiDestructuring extends Transform {
         ]);
 
         if (object.type == "VariableDeclarator") {
-          var i = getIndexDirect(object, parents);
+          var i = getIndexDirect(object, parents[0]);
 
           var extra = Array.from(names).map((x) => {
             return {

package/src/transforms/eval.ts

@@ -28,6 +28,24 @@ export default class Eval extends Transform {
   }
 
   transform(object, parents) {
+    // Don't apply to getter/setters or class methods
+    if (parents[0]) {
+      if (
+        parents[0].type === "MethodDefinition" &&
+        parents[0].value === object
+      ) {
+        return;
+      }
+
+      if (
+        parents[0].type === "Property" &&
+        parents[0].value === object &&
+        (parents[0].kind !== "init" || parents[0].method)
+      ) {
+        return;
+      }
+    }
+
     if (
       !ComputeProbabilityMap(
         this.options.eval,

package/src/transforms/extraction/duplicateLiteralsRemoval.ts

@@ -159,7 +159,7 @@ export default class DuplicateLiteralsRemoval extends Transform {
       var body = [];
       var thisShift = getRandomInteger(-250, 250);
       // the name of the getter
-      getterName = this.getPlaceholder();
+      getterName = this.getPlaceholder() + "_dLR_" + this.fnGetters.size;
 
       if (basedOn) {
         var shift = this.fnShifts.get(basedOn);
@@ -268,20 +268,20 @@ export default class DuplicateLiteralsRemoval extends Transform {
           this.arrayExpression = ArrayExpression([]);
         }
 
-        var first = this.first.get(value);
-        if (first) {
+        var firstLocation = this.first.get(value);
+        if (firstLocation) {
           this.first.set(value, null);
           var index = this.map.size;
 
           ok(!this.map.has(value));
           this.map.set(value, index);
 
-          this.toCaller(first[0], first[1], index);
-
           var pushing = clone(object);
           this.arrayExpression.elements.push(pushing);
 
           ok(this.arrayExpression.elements[index] === pushing);
+
+          this.toCaller(firstLocation[0], firstLocation[1], index);
         }
 
         var index = this.map.get(value);

package/src/transforms/extraction/objectExtraction.ts

@@ -100,11 +100,18 @@ export default class ObjectExtraction extends Transform {
               );
 
               if (nonInitOrComputed) {
-                this.log(
-                  name +
-                    " has non-init/computed property: " +
-                    nonInitOrComputed.key.name || nonInitOrComputed.key.value
-                );
+                if (nonInitOrComputed.key) {
+                  this.log(
+                    name +
+                      " has non-init/computed property: " +
+                      nonInitOrComputed.key.name || nonInitOrComputed.key.value
+                  );
+                } else {
+                  this.log(
+                    name + " has spread-element or other type of property"
+                  );
+                }
+
                 illegal.add(name);
                 return;
               } else {