js-confuser 1.5.7 → 1.5.9

package/src/transforms/minify.ts

@@ -15,6 +15,7 @@ import {
   AssignmentExpression,
   VariableDeclarator,
   Identifier,
+  CallExpression,
 } from "../util/gen";
 import {
   getBlockBody,
@@ -22,11 +23,14 @@ import {
   isForInitialize,
   isLexContext,
   getFunction,
+  prepend,
+  append,
 } from "../util/insert";
 import { isValidIdentifier, isEquivalent } from "../util/compare";
 import { walk, isBlock } from "../traverse";
 import { ok } from "assert";
 import { isLexicalScope } from "../util/scope";
+import Template from "../templates/template";
 
 /**
  * Basic transformations to reduce code size.
@@ -37,12 +41,13 @@ import { isLexicalScope } from "../util/scope";
  * - `x['y']` **->** `x.y`
  */
 export default class Minify extends Transform {
-  variables: Map<Node, Location[]>;
+  /**
+   * A helper function that is introduced preserve function semantics
+   */
+  arrowFunctionName: string;
 
   constructor(o) {
     super(o, ObfuscateOrder.Minify);
-
-    this.variables = new Map();
   }
 
   match(object: Node, parents: Node[]) {
@@ -239,17 +244,42 @@ export default class Minify extends Transform {
         });
 
         if (canTransform) {
+          if (!this.arrowFunctionName) {
+            this.arrowFunctionName = this.getPlaceholder();
+
+            append(
+              parents[parents.length - 1] || object,
+              Template(`
+            function ${this.arrowFunctionName}(arrowFn){
+              return function(){ return arrowFn(...arguments) }
+            }
+            `).single()
+            );
+          }
+
+          const wrap = (object: Node) => {
+            return CallExpression(Identifier(this.arrowFunctionName), [
+              clone(object),
+            ]);
+          };
+
           if (object.type == "FunctionExpression") {
             object.type = "ArrowFunctionExpression";
+
+            this.replace(object, wrap(clone(object)));
           } else {
             var arrow = { ...clone(object), type: "ArrowFunctionExpression" };
             this.replace(
               object,
-              VariableDeclaration(VariableDeclarator(object.id.name, arrow))
+              VariableDeclaration(
+                VariableDeclarator(object.id.name, wrap(arrow))
+              )
             );
 
             var x = this.transform(arrow, []);
-            x();
+            if (typeof x === "function") {
+              x();
+            }
           }
         }
       };
@@ -442,6 +472,8 @@ export default class Minify extends Transform {
         }
 
         if (
+          object.consequent &&
+          object.consequent.body &&
           object.consequent.body.length == 1 &&
           object.alternate &&
           object.alternate.body.length == 1

package/src/transforms/rgf.ts

@@ -31,6 +31,7 @@ import {
   isFunction,
   prepend,
   getDefiningContext,
+  clone,
 } from "../util/insert";
 import { getRandomString } from "../util/random";
 import Transform from "./transform";
@@ -300,7 +301,8 @@ export default class RGF extends Transform {
                         [],
                         [
                           ReturnStatement(
-                            CallExpression(memberExpression, [
+                            // clone() is required!
+                            CallExpression(clone(memberExpression), [
                               Identifier(referenceArray),
                               SpreadElement(Identifier("arguments")),
                             ])
@@ -328,8 +330,6 @@ export default class RGF extends Transform {
 
       queue.forEach(([object, parents]) => {
         var name = object?.id?.name;
-        var hasName = !!name;
-        var params = object.params.map((x) => x.name) || [];
         var signature = referenceSignatures[names.get(name)];
 
         var embeddedName = name || this.getPlaceholder();
@@ -349,6 +349,7 @@ export default class RGF extends Transform {
           },
           eval: false,
           hideInitializingCode: false,
+          stringEncoding: false,
         });
         var transforms = Object.values(obfuscator.transforms).filter(
           (x) => x.priority > this.priority

package/src/transforms/stack.ts

@@ -55,7 +55,9 @@ export default class Stack extends Transform {
     return () => {
       // Uncaught SyntaxError: Getter must not have any formal parameters.
       // Uncaught SyntaxError: Setter must have exactly one formal parameter
-      var propIndex = parents.findIndex((x) => x.type == "Property");
+      var propIndex = parents.findIndex(
+        (x) => x.type === "Property" || x.type === "MethodDefinition"
+      );
       if (propIndex !== -1) {
         if (parents[propIndex].value === (parents[propIndex - 1] || object)) {
           if (parents[propIndex].kind !== "init" || parents[propIndex].method) {

package/src/transforms/string/stringConcealing.ts

@@ -6,22 +6,18 @@ import { isDirective } from "../../util/compare";
 import {
   ArrayExpression,
   CallExpression,
-  ConditionalExpression,
-  FunctionDeclaration,
   FunctionExpression,
   Identifier,
-  IfStatement,
   Literal,
   MemberExpression,
   Node,
-  ReturnStatement,
-  SequenceExpression,
+  ObjectExpression,
+  Property,
   ThisExpression,
-  UpdateExpression,
   VariableDeclaration,
   VariableDeclarator,
 } from "../../util/gen";
-import { append, isLexContext, isVarContext, prepend } from "../../util/insert";
+import { append, prepend } from "../../util/insert";
 import { choice, getRandomInteger, getRandomString } from "../../util/random";
 import Transform from "../transform";
 import Encoding from "./encoding";
@@ -65,6 +61,7 @@ export default class StringConcealing extends Transform {
   ignore = new Set<string>();
   variablesMade = 1;
   encoding: { [type: string]: string } = Object.create(null);
+  gen: ReturnType<Transform["getGenerator"]>;
 
   hasAllEncodings: boolean;
 
@@ -75,11 +72,12 @@ export default class StringConcealing extends Transform {
     this.index = Object.create(null);
     this.arrayExpression = ArrayExpression([]);
     this.hasAllEncodings = false;
+    this.gen = this.getGenerator();
 
     // Pad array with useless strings
-    var dead = getRandomInteger(4, 10);
+    var dead = getRandomInteger(5, 15);
     for (var i = 0; i < dead; i++) {
-      var str = getRandomString(getRandomInteger(4, 20));
+      var str = getRandomString(getRandomInteger(5, 40));
       var fn = this.transform(Literal(str), []);
       if (fn) {
         fn();
@@ -134,7 +132,7 @@ export default class StringConcealing extends Transform {
                   VariableDeclarator("a", this.arrayExpression)
                 ),
                 Template(
-                  `return (${flowIntegrity} ? a.pop() : ${flowIntegrity}++, a)`
+                  `return (${flowIntegrity} ? a["pop"]() : ${flowIntegrity}++, a)`
                 ).single(),
               ]
             ),
@@ -159,7 +157,11 @@ export default class StringConcealing extends Transform {
   transform(object: Node, parents: Node[]) {
     return () => {
       // Empty strings are discarded
-      if (!object.value || this.ignore.has(object.value)) {
+      if (
+        !object.value ||
+        this.ignore.has(object.value) ||
+        object.value.length == 0
+      ) {
         return;
       }
 
@@ -188,69 +190,131 @@ export default class StringConcealing extends Transform {
       var encoded = encoder.encode(object.value);
       if (encoder.decode(encoded) != object.value) {
         this.ignore.add(object.value);
-        this.warn(object.value.slice(0, 100));
+        this.warn(type, object.value.slice(0, 100));
         return;
       }
 
-      // Fix 1. weird undefined error
-      if (object.value && object.value.length > 0) {
-        var index = -1;
-        if (!this.set.has(object.value)) {
-          this.arrayExpression.elements.push(Literal(encoded));
-          index = this.arrayExpression.elements.length - 1;
-          this.index[object.value] = [index, fnName];
+      var index = -1;
+      if (!this.set.has(object.value)) {
+        this.arrayExpression.elements.push(Literal(encoded));
+        index = this.arrayExpression.elements.length - 1;
+        this.index[object.value] = [index, fnName];
 
-          this.set.add(object.value);
-        } else {
-          [index, fnName] = this.index[object.value];
-          ok(typeof index === "number");
-        }
+        this.set.add(object.value);
+      } else {
+        [index, fnName] = this.index[object.value];
+        ok(typeof index === "number");
+      }
 
-        ok(index != -1, "index == -1");
+      ok(index != -1, "index == -1");
 
-        var callExpr = CallExpression(Identifier(fnName), [Literal(index)]);
+      var callExpr = CallExpression(Identifier(fnName), [Literal(index)]);
 
-        // use `.apply` to fool automated de-obfuscators
-        if (Math.random() > 0.5) {
-          callExpr = CallExpression(
-            MemberExpression(Identifier(fnName), Identifier("apply"), false),
-            [ThisExpression(), ArrayExpression([Literal(index)])]
-          );
-        }
+      // use `.apply` to fool automated de-obfuscators
+      if (Math.random() > 0.5) {
+        callExpr = CallExpression(
+          MemberExpression(Identifier(fnName), Identifier("apply"), false),
+          [Identifier("undefined"), ArrayExpression([Literal(index)])]
+        );
+      }
+
+      // use `.call`
+      else if (Math.random() > 0.5) {
+        callExpr = CallExpression(
+          MemberExpression(Identifier(fnName), Identifier("call"), false),
+          [Identifier("undefined"), Literal(index)]
+        );
+      }
+
+      var referenceType = "call";
+      if (parents.length && Math.random() < 0.5 / this.variablesMade) {
+        referenceType = "constantReference";
+      }
+
+      var newExpr: Node = callExpr;
+
+      if (referenceType === "constantReference") {
+        // Define the string earlier, reference the name here
+        this.variablesMade++;
 
-        // use `.call`
-        else if (Math.random() > 0.5) {
-          callExpr = CallExpression(
-            MemberExpression(Identifier(fnName), Identifier("call"), false),
-            [ThisExpression(), Literal(index)]
-          );
+        var constantReferenceType = choice(["variable", "array", "object"]);
+
+        var place = choice(parents.filter((node) => isBlock(node)));
+        if (!place) {
+          this.error(new Error("No lexical block to insert code"));
         }
 
-        var constantReference =
-          parents.length && Math.random() > 0.5 / this.variablesMade;
+        switch (constantReferenceType) {
+          case "variable":
+            var name = this.getPlaceholder();
+
+            prepend(
+              place,
+              VariableDeclaration(VariableDeclarator(name, callExpr))
+            );
+
+            newExpr = Identifier(name);
+            break;
+          case "array":
+            if (!place.$stringConcealingArray) {
+              place.$stringConcealingArray = ArrayExpression([]);
+              place.$stringConcealingArrayName = this.getPlaceholder();
 
-        if (constantReference) {
-          // Define the string earlier, reference the name here
+              prepend(
+                place,
+                VariableDeclaration(
+                  VariableDeclarator(
+                    place.$stringConcealingArrayName,
+                    place.$stringConcealingArray
+                  )
+                )
+              );
+            }
 
-          var name = this.getPlaceholder();
+            var arrayIndex = place.$stringConcealingArray.elements.length;
 
-          var place = choice(parents.filter((node) => isBlock(node)));
-          if (!place) {
-            this.error(Error("No lexical block to insert code"));
-          }
+            place.$stringConcealingArray.elements.push(callExpr);
 
-          place.body.unshift(
-            VariableDeclaration(VariableDeclarator(name, callExpr))
-          );
+            var memberExpression = MemberExpression(
+              Identifier(place.$stringConcealingArrayName),
+              Literal(arrayIndex),
+              true
+            );
 
-          this.replaceIdentifierOrLiteral(object, Identifier(name), parents);
+            newExpr = memberExpression;
+            break;
+          case "object":
+            if (!place.$stringConcealingObject) {
+              place.$stringConcealingObject = ObjectExpression([]);
+              place.$stringConcealingObjectName = this.getPlaceholder();
 
-          this.variablesMade++;
-        } else {
-          // Direct call to the getter function
-          this.replaceIdentifierOrLiteral(object, callExpr, parents);
+              prepend(
+                place,
+                VariableDeclaration(
+                  VariableDeclarator(
+                    place.$stringConcealingObjectName,
+                    place.$stringConcealingObject
+                  )
+                )
+              );
+            }
+
+            var propName = this.gen.generate();
+            var property = Property(Literal(propName), callExpr, true);
+            place.$stringConcealingObject.properties.push(property);
+
+            var memberExpression = MemberExpression(
+              Identifier(place.$stringConcealingObjectName),
+              Literal(propName),
+              true
+            );
+
+            newExpr = memberExpression;
+            break;
         }
       }
+
+      this.replaceIdentifierOrLiteral(object, newExpr, parents);
     };
   }
 }

package/src/transforms/transform.ts

@@ -407,7 +407,7 @@ export default class Transform {
   }
 
   /**
-   * Verbose logging for warning/importing messages.
+   * Verbose logging for warning/important messages.
    * @param messages
    */
   warn(...messages: any[]) {

package/src/traverse.ts

@@ -39,16 +39,9 @@ export type ExitCallback = () => void;
 export function walk(
   object: Node | Node[],
   parents: Node[],
-  onEnter: EnterCallback,
-  seen = new Set<Node>()
+  onEnter: EnterCallback
 ): "EXIT" | void {
   if (typeof object === "object" && object) {
-    if (seen.has(object as any)) {
-      console.log(object);
-      throw new Error("Already seen: " + (object as any).type);
-    }
-    seen.add(object as any);
-
     var newParents: Node[] = [object as Node, ...parents];
 
     if (!Array.isArray(object)) {

package/src/types.ts

@@ -119,4 +119,12 @@ export type IJsConfuserDebugObfuscation = (
   code: string,
   options: ObfuscateOptions,
   callback: (name: string, complete: number, totalTransforms: number) => void
-) => Promise<string>;
+) => Promise<{
+  obfuscated: string;
+  transformationTimes: { [transformName: string]: number };
+  parseTime: number;
+  compileTime: number;
+  obfuscationTime: number;
+  totalTransforms: number;
+  totalPossibleTransforms: number;
+}>;

package/src/util/compare.ts

@@ -53,8 +53,8 @@ export function isValidIdentifier(name: string): boolean {
     return false;
   }
 
-  var x = name.match(/^[A-z$_][A-z0-9$_]*/);
-  return x && x[0] == name;
+  var x = name.match(/^[A-Za-z$_][A-Za-z0-9$_]*/);
+  return !!(x && x[0] == name);
 }
 
 export function isInsideType(

package/src/util/insert.ts

@@ -113,8 +113,14 @@ export function getDefiningContext(o: Node, p: Node[]): Node {
     var variableDeclaration = p.find((x) => x.type == "VariableDeclaration");
     ok(variableDeclaration);
 
-    if (variableDeclaration.kind === "let") {
-      return getLexContext(o, p);
+    if (
+      variableDeclaration.kind === "let" ||
+      variableDeclaration.kind === "const"
+    ) {
+      var context = getVarContext(o, p);
+      if (context && context.type === "Program") {
+        return getLexContext(o, p);
+      }
     }
   }
 
@@ -178,7 +184,7 @@ export function getBlockBody(block: Node): Node[] {
   return getBlockBody(block.body);
 }
 
-export function getIndexDirect(object: Node, parent: Node[]): string {
+export function getIndexDirect(object: Node, parent: Node): string {
   return Object.keys(parent).find((x) => parent[x] == object);
 }
 
@@ -255,16 +261,25 @@ export function prepend(block: Node, ...nodes: Node[]) {
   ok(!Array.isArray(block), "block should not be array");
 
   if (block.type == "Program") {
-    var decs = 0;
+    var moveBy = 0;
     block.body.forEach((stmt, i) => {
       if (stmt.type == "ImportDeclaration") {
-        if (decs == i) {
-          decs++;
+        if (moveBy == i) {
+          moveBy++;
+        }
+      }
+
+      if (
+        stmt.type === "ExpressionStatement" &&
+        typeof stmt.directive === "string"
+      ) {
+        if (moveBy == i) {
+          moveBy++;
         }
       }
     });
 
-    block.body.splice(decs, 0, ...nodes);
+    block.body.splice(moveBy, 0, ...nodes);
   } else {
     getBlockBody(block).unshift(...nodes);
   }
@@ -313,7 +328,10 @@ export function clone<T>(object: T): T {
  * @param p
  * @returns
  */
-export function isForInitialize(o, p): "initializer" | "left-hand" | false {
+export function isForInitialize(
+  o: Node,
+  p: Node[]
+): "initializer" | "left-hand" | false {
   validateChain(o, p);
 
   var forIndex = p.findIndex(
@@ -322,6 +340,17 @@ export function isForInitialize(o, p): "initializer" | "left-hand" | false {
       x.type == "ForInStatement" ||
       x.type == "ForOfStatement"
   );
+
+  if (
+    p
+      .slice(0, forIndex)
+      .find((x) =>
+        ["ArrowFunctionExpression", "BlockStatement"].includes(x.type)
+      )
+  ) {
+    return false;
+  }
+
   if (forIndex !== -1) {
     if (p[forIndex].type == "ForStatement") {
       if (p[forIndex].init == (p[forIndex - 1] || o)) {

package/test/code/ES6.src.js

@@ -73,3 +73,17 @@ for (var x of [3, 3, 5]) {
   sum += x;
 }
 expect(sum).toStrictEqual(11);
+
+// Variant #12 More complex for-loop initializer
+var outside = 12;
+for (
+  var myFunction = function () {
+    return outside;
+  };
+  false;
+
+) {}
+
+var TEST_OUTPUT = myFunction();
+
+expect(TEST_OUTPUT).toStrictEqual(12);

package/test/code/NewFeatures.test.ts

@@ -0,0 +1,19 @@
+import JsConfuser from "../../src/index";
+
+// https://github.com/MichaelXF/js-confuser/issues/79
+test("Variant #1: Support BigInt Literals (1n)", async () => {
+  var code = `
+  TEST_OUTPUT = 1n;
+  `;
+
+  var output = await JsConfuser(code, {
+    target: "node",
+    renameVariables: true,
+  });
+
+  var TEST_OUTPUT;
+  eval(output);
+
+  expect(typeof TEST_OUTPUT).toStrictEqual("bigint");
+  expect(TEST_OUTPUT).toStrictEqual(1n);
+});

package/test/index.test.ts

@@ -230,7 +230,19 @@ describe("debugObfuscation", () => {
       callback
     );
 
-    expect(typeof output).toStrictEqual("string");
+    expect(typeof output).toStrictEqual("object");
+    expect(typeof output.obfuscated).toStrictEqual("string");
+    expect(typeof output.obfuscationTime).toStrictEqual("number");
+    expect(typeof output.compileTime).toStrictEqual("number");
+    expect(typeof output.parseTime).toStrictEqual("number");
+    expect(typeof output.totalPossibleTransforms).toStrictEqual("number");
+    expect(typeof output.totalTransforms).toStrictEqual("number");
+    expect(typeof output.transformationTimes).toStrictEqual("object");
+    expect(typeof output.transformationTimes.RenameVariables).toStrictEqual(
+      "number"
+    );
+
+    eval(output.obfuscated);
     expect(called).toStrictEqual(true);
   });
 });

package/test/transforms/antiTooling.test.ts

@@ -0,0 +1,30 @@
+import JsConfuser from "../../src/index";
+
+// https://github.com/MichaelXF/js-confuser/issues/74
+test("Variant #1: Don't break Symbols", async () => {
+  if (typeof Symbol !== "undefined") {
+    for (var i = 0; i < 6; i++) {
+      var output = await JsConfuser(
+        `
+  
+      var sym1 = Symbol();
+    
+      if (true) {
+        sym1;
+        sym1;
+        sym1;
+      }
+  
+      TEST_OUTPUT = sym1;
+    
+      `,
+        { target: "node", renameVariables: true }
+      );
+
+      var TEST_OUTPUT;
+
+      eval(output);
+      expect(typeof TEST_OUTPUT).toStrictEqual("symbol");
+    }
+  }
+});

package/test/transforms/controlFlowFlattening/controlFlowFlattening.test.ts

@@ -672,3 +672,61 @@ test("Variant #20: Don't apply when functions are redefined", async () => {
   eval(output);
   expect(TEST_ARRAY).toStrictEqual([0, 0, 0]);
 });
+
+// https://github.com/MichaelXF/js-confuser/issues/70
+test("Variant #21: Don't move Import Declarations", async () => {
+  var output = await JsConfuser(
+    `
+    import {createHash} from "crypto";
+    var inputString = "Hash this string";
+    var hashed = createHash("sha256").update(inputString).digest("hex");
+    TEST_OUTPUT = hashed;
+  `,
+    {
+      target: "node",
+      controlFlowFlattening: true,
+    }
+  );
+
+  // Ensure Control Flow FLattening was applied
+  expect(output).toContain("switch");
+
+  // Ensure the import declaration wasn't moved
+  expect(output.startsWith("import")).toStrictEqual(true);
+
+  // Convert to runnable code
+  output = output.replace(
+    `import{createHash}from'crypto';`,
+    "const {createHash}=require('crypto');"
+  );
+
+  var TEST_OUTPUT = "";
+
+  eval(output);
+
+  expect(TEST_OUTPUT).toStrictEqual(
+    "1cac63f39fd68d8c531f27b807610fb3d50f0fc3f186995767fb6316e7200a3e"
+  );
+});
+
+// https://github.com/MichaelXF/js-confuser/issues/81
+test("Variant #22: Don't break typeof expression", async () => {
+  var output = await JsConfuser(
+    `
+    TEST_OUTPUT = false;
+    if(typeof nonExistentVariable === "undefined") {
+      TEST_OUTPUT = true;
+    }
+    `,
+    {
+      target: "node",
+      controlFlowFlattening: true,
+    }
+  );
+
+  var TEST_OUTPUT;
+
+  eval(output);
+
+  expect(TEST_OUTPUT).toStrictEqual(true);
+});