js-confuser 1.5.8 → 1.6.0

package/src/transforms/string/stringCompression.ts

@@ -17,6 +17,7 @@ import {
 import { append, prepend } from "../../util/insert";
 import Transform from "../transform";
 import { isModuleSource } from "./stringConcealing";
+import { chance } from "../../util/random";
 function LZ_encode(c) {
   ok(c);
   var x = "charCodeAt",
@@ -83,7 +84,7 @@ export default class StringCompression extends Transform {
   map: Map<string, number>;
   ignore: Set<string>;
   string: string;
-  delimiter = "1";
+  delimiter = "|";
 
   fnName: string;
 
@@ -110,7 +111,11 @@ export default class StringCompression extends Transform {
 
     var encoded = LZ_encode(this.string);
     if (LZ_decode(encoded) !== this.string) {
-      this.error(new Error("String failed to be decoded"));
+      this.error(
+        new Error(
+          "String failed to be decoded. Try disabling the 'stringCompression' option."
+        )
+      );
     }
 
     var getStringParamName = this.getPlaceholder();
@@ -195,37 +200,41 @@ export default class StringCompression extends Transform {
       return;
     }
 
-    if (!ComputeProbabilityMap(object.value, (x) => x)) {
+    if (
+      !ComputeProbabilityMap(
+        this.options.stringCompression,
+        (x) => x,
+        object.value
+      )
+    ) {
       return;
     }
 
+    // HARD CODED LIMIT of 10,000 (after 1,000 elements)
+    if (this.map.size > 1000 && !chance(this.map.size / 100)) return;
+
     var index = this.map.get(object.value);
+
+    // New string, add it!
     if (typeof index !== "number") {
+      // Ensure the string gets properly decoded
       if (LZ_decode(LZ_encode(object.value)) !== object.value) {
         this.ignore.add(object.value);
         return;
       }
 
-      var before = this.string;
-
       index = this.map.size;
       this.map.set(object.value, index);
       this.string += object.value + this.delimiter;
-
-      // allow rollback if string becomes corrupted
-      if (LZ_decode(LZ_encode(this.string)) !== this.string) {
-        this.string = before;
-        this.map.delete(object.value);
-        this.ignore.add(object.value);
-        return;
-      }
     }
     ok(typeof index === "number");
 
-    this.replaceIdentifierOrLiteral(
-      object,
-      CallExpression(Identifier(this.fnName), [Literal(index)]),
-      parents
-    );
+    return () => {
+      this.replaceIdentifierOrLiteral(
+        object,
+        CallExpression(Identifier(this.fnName), [Literal(index)]),
+        parents
+      );
+    };
   }
 }

package/src/transforms/string/stringConcealing.ts

@@ -13,14 +13,20 @@ import {
   Node,
   ObjectExpression,
   Property,
-  ThisExpression,
   VariableDeclaration,
   VariableDeclarator,
 } from "../../util/gen";
 import { append, prepend } from "../../util/insert";
-import { choice, getRandomInteger, getRandomString } from "../../util/random";
+import {
+  chance,
+  choice,
+  getRandomInteger,
+  getRandomString,
+} from "../../util/random";
 import Transform from "../transform";
 import Encoding from "./encoding";
+import { ComputeProbabilityMap } from "../../probability";
+import { BufferToStringTemplate } from "../../templates/bufferToString";
 
 export function isModuleSource(object: Node, parents: Node[]) {
   if (!parents[0]) {
@@ -89,13 +95,23 @@ export default class StringConcealing extends Transform {
     super.apply(tree);
 
     var cacheName = this.getPlaceholder();
+    var bufferToStringName = this.getPlaceholder();
+
+    // This helper functions convert UInt8 Array to UTf-string
+    prepend(
+      tree,
+      ...BufferToStringTemplate.compile({ name: bufferToStringName })
+    );
 
     Object.keys(this.encoding).forEach((type) => {
       var { template } = Encoding[type];
       var decodeFn = this.getPlaceholder();
       var getterFn = this.encoding[type];
 
-      append(tree, template.single({ name: decodeFn }));
+      append(
+        tree,
+        template.single({ name: decodeFn, bufferToString: bufferToStringName })
+      );
 
       append(
         tree,
@@ -165,10 +181,24 @@ export default class StringConcealing extends Transform {
         return;
       }
 
+      // Allow user to choose which strings get changed
+      if (
+        !ComputeProbabilityMap(
+          this.options.stringConcealing,
+          (x) => x,
+          object.value
+        )
+      ) {
+        return;
+      }
+
+      // HARD CODED LIMIT of 10,000 (after 1,000 elements)
+      if (this.set.size > 1000 && !chance(this.set.size / 100)) return;
+
       var types = Object.keys(this.encoding);
 
       var type = choice(types);
-      if (!type || (!this.hasAllEncodings && Math.random() > 0.9)) {
+      if (!type || (!this.hasAllEncodings && chance(10))) {
         var allowed = Object.keys(Encoding).filter(
           (type) => !this.encoding[type]
         );
@@ -211,23 +241,23 @@ export default class StringConcealing extends Transform {
       var callExpr = CallExpression(Identifier(fnName), [Literal(index)]);
 
       // use `.apply` to fool automated de-obfuscators
-      if (Math.random() > 0.5) {
+      if (chance(10)) {
         callExpr = CallExpression(
-          MemberExpression(Identifier(fnName), Identifier("apply"), false),
-          [ThisExpression(), ArrayExpression([Literal(index)])]
+          MemberExpression(Identifier(fnName), Literal("apply"), true),
+          [Identifier("undefined"), ArrayExpression([Literal(index)])]
         );
       }
 
       // use `.call`
-      else if (Math.random() > 0.5) {
+      else if (chance(10)) {
         callExpr = CallExpression(
-          MemberExpression(Identifier(fnName), Identifier("call"), false),
-          [ThisExpression(), Literal(index)]
+          MemberExpression(Identifier(fnName), Literal("call"), true),
+          [Identifier("undefined"), Literal(index)]
         );
       }
 
       var referenceType = "call";
-      if (parents.length && Math.random() < 0.5 / this.variablesMade) {
+      if (parents.length && chance(50 - this.variablesMade)) {
         referenceType = "constantReference";
       }
 

package/src/transforms/string/stringEncoding.ts

@@ -1,8 +1,9 @@
 import Transform from "../transform";
 import { choice } from "../../util/random";
-import { ObfuscateOrder } from "../../order";
 import { isDirective } from "../../util/compare";
 import { isModuleSource } from "./stringConcealing";
+import { ComputeProbabilityMap } from "../../probability";
+import { Identifier } from "../../util/gen";
 
 function pad(x: string, len: number): string {
   while (x.length < len) {
@@ -54,32 +55,30 @@ function toUnicodeRepresentation(str: string) {
  * - Cost Low
  */
 export default class StringEncoding extends Transform {
-  seen: Set<Node>;
-
   constructor(o) {
-    super(o, ObfuscateOrder.StringEncoding);
-  }
-
-  apply(tree) {
-    this.seen = new Set();
-    super.apply(tree);
+    super(o);
   }
 
   match(object, parents) {
     return (
       object.type == "Literal" &&
       typeof object.value === "string" &&
+      object.value.length > 0 &&
       !isModuleSource(object, parents) &&
       !isDirective(object, parents)
     );
   }
 
   transform(object, parents) {
-    // Todo fix circular json problems
-    if (this.seen.has(object)) {
+    // Allow percentages
+    if (
+      !ComputeProbabilityMap(
+        this.options.stringEncoding,
+        (x) => x,
+        object.value
+      )
+    )
       return;
-    }
-    this.seen.add(object);
 
     var type = choice(["hexadecimal", "unicode"]);
 
@@ -87,10 +86,11 @@ export default class StringEncoding extends Transform {
       type == "hexadecimal" ? toHexRepresentation : toUnicodeRepresentation
     )(object.value);
 
-    // escodegen tries to escape backslashes, here is a work-around
-    this.replace(object, {
-      type: "Identifier",
-      name: `'${escapedString}'`,
-    });
+    return () => {
+      if (object.type !== "Literal") return;
+
+      // ESCodeGen tries to escape backslashes, here is a work-around
+      this.replace(object, Identifier(`'${escapedString}'`));
+    };
   }
 }

package/src/transforms/transform.ts

@@ -74,11 +74,6 @@ export default class Transform {
    */
   after: Transform[];
 
-  /**
-   * Transformations to run at the same time (can cause conflicts so use sparingly)
-   */
-  concurrent: Transform[];
-
   constructor(obfuscator, priority: number = -1) {
     ok(obfuscator instanceof Obfuscator, "obfuscator should be an Obfuscator");
 
@@ -89,8 +84,6 @@ export default class Transform {
 
     this.before = [];
     this.after = [];
-
-    this.concurrent = [];
   }
 
   /**
@@ -120,14 +113,11 @@ export default class Transform {
      */
     this.before.forEach((x) => x.apply(tree));
 
+    /**
+     * Run this transformation
+     */
     traverse(tree, (object, parents) => {
-      var fns = [];
-      fns.push(this.input(object, parents));
-
-      // Fix 1. Increase performance with multiple transforms on one iteration.
-      this.concurrent.forEach((x) => fns.push(x.input(object, parents)));
-
-      return () => fns.forEach((x) => x && x());
+      return this.input(object, parents);
     });
 
     /**
@@ -191,18 +181,18 @@ export default class Transform {
 
   /**
    * Returns an independent name generator with it's own counter.
-   * @param offset
+   * @param overrideMode - Override the user's `identifierGenerator` option
    * @returns
    */
-  getGenerator(offset = 0) {
-    var count = offset;
+  getGenerator(overrideMode?: string) {
+    var count = 0;
     var identifiers = new Set();
     return {
       generate: () => {
-        var retValue;
+        var retValue: string;
         do {
           count++;
-          retValue = this.generateIdentifier(-1, count);
+          retValue = this.generateIdentifier(-1, count, overrideMode);
         } while (identifiers.has(retValue));
 
         identifiers.add(retValue);
@@ -217,7 +207,11 @@ export default class Transform {
    * @param length Default length is 6 to 10 characters.
    * @returns **`string`**
    */
-  generateIdentifier(length: number = -1, count = -1): string {
+  generateIdentifier(
+    length: number = -1,
+    count = -1,
+    overrideMode?: string
+  ): string {
     if (length == -1) {
       length = getRandomInteger(6, 8);
     }
@@ -233,7 +227,7 @@ export default class Transform {
     var identifier;
     do {
       identifier = ComputeProbabilityMap(
-        this.options.identifierGenerator,
+        overrideMode || this.options.identifierGenerator,
         (mode = "randomized") => {
           switch (mode) {
             case "randomized":

package/src/traverse.ts

@@ -39,21 +39,14 @@ export type ExitCallback = () => void;
 export function walk(
   object: Node | Node[],
   parents: Node[],
-  onEnter: EnterCallback,
-  seen = new Set<Node>()
+  onEnter: EnterCallback
 ): "EXIT" | void {
   if (typeof object === "object" && object) {
-    if (seen.has(object as any)) {
-      console.log(object);
-      throw new Error("Already seen: " + (object as any).type);
-    }
-    seen.add(object as any);
-
     var newParents: Node[] = [object as Node, ...parents];
 
-    if (!Array.isArray(object)) {
-      validateChain(object, parents);
-    }
+    // if (!Array.isArray(object)) {
+    //   validateChain(object, parents);
+    // }
 
     // 1. Call `onEnter` function and remember any onExit callback returned
     var onExit = onEnter(object as Node, parents);
@@ -66,7 +59,6 @@ export function walk(
           return "EXIT";
         }
       }
-      copy.forEach((x) => {});
     } else {
       var keys = Object.keys(object);
       for (var key of keys) {
@@ -106,3 +98,23 @@ export function walk(
 export default function traverse(tree, onEnter: EnterCallback) {
   walk(tree, [], onEnter);
 }
+
+/**
+ * This is debugging function used to test for circular references.
+ */
+export function assertNoCircular(object) {
+  var seen = new Set();
+
+  traverse(object, (node, nodeParents) => {
+    if (node && typeof node === "object") {
+      if (seen.has(node)) {
+        console.log(nodeParents);
+        console.log(node);
+
+        throw new Error("FOUND CIRCULAR REFERENCE");
+      }
+
+      seen.add(node);
+    }
+  });
+}

package/src/types.ts

@@ -118,5 +118,14 @@ export type IJsConfuserDebugTransformations = (
 export type IJsConfuserDebugObfuscation = (
   code: string,
   options: ObfuscateOptions,
-  callback: (name: string, complete: number, totalTransforms: number) => void
-) => Promise<string>;
+  callback: (name: string, complete: number, totalTransforms: number) => void,
+  performance: Performance
+) => Promise<{
+  obfuscated: string;
+  transformationTimes: { [transformName: string]: number };
+  parseTime: number;
+  compileTime: number;
+  obfuscationTime: number;
+  totalTransforms: number;
+  totalPossibleTransforms: number;
+}>;

package/src/util/compare.ts

@@ -53,8 +53,8 @@ export function isValidIdentifier(name: string): boolean {
     return false;
   }
 
-  var x = name.match(/^[A-z$_][A-z0-9$_]*/);
-  return x && x[0] == name;
+  var x = name.match(/^[A-Za-z$_][A-Za-z0-9$_]*/);
+  return !!(x && x[0] == name);
 }
 
 export function isInsideType(

package/src/util/gen.ts

@@ -557,6 +557,22 @@ export function ClassDeclaration(
   } as Node;
 }
 
+export function ClassExpression(
+  id: Node | null,
+  superClass: Node = null,
+  body: Node[] = []
+) {
+  return {
+    type: "ClassExpression",
+    id: id,
+    superClass: superClass,
+    body: {
+      type: "ClassBody",
+      body: body,
+    },
+  } as Node;
+}
+
 export function ThrowStatement(argument: Node) {
   return {
     type: "ThrowStatement",
@@ -607,7 +623,11 @@ export function CatchClause(param: Node = null, body) {
   };
 }
 
-export function TryStatement(body: Node[], handler: Node, finallyBody: Node[]) {
+export function TryStatement(
+  body: Node[],
+  handler: Node,
+  finallyBody?: Node[]
+) {
   ok(handler);
   ok(handler.type == "CatchClause");
   return {

package/src/util/insert.ts

@@ -113,8 +113,14 @@ export function getDefiningContext(o: Node, p: Node[]): Node {
     var variableDeclaration = p.find((x) => x.type == "VariableDeclaration");
     ok(variableDeclaration);
 
-    if (variableDeclaration.kind === "let") {
-      return getLexContext(o, p);
+    if (
+      variableDeclaration.kind === "let" ||
+      variableDeclaration.kind === "const"
+    ) {
+      var context = getVarContext(o, p);
+      if (context && context.type === "Program") {
+        return getLexContext(o, p);
+      }
     }
   }
 
@@ -178,7 +184,7 @@ export function getBlockBody(block: Node): Node[] {
   return getBlockBody(block.body);
 }
 
-export function getIndexDirect(object: Node, parent: Node[]): string {
+export function getIndexDirect(object: Node, parent: Node): string {
   return Object.keys(parent).find((x) => parent[x] == object);
 }
 
@@ -255,18 +261,38 @@ export function prepend(block: Node, ...nodes: Node[]) {
   ok(!Array.isArray(block), "block should not be array");
 
   if (block.type == "Program") {
-    var decs = 0;
+    var moveBy = 0;
     block.body.forEach((stmt, i) => {
       if (stmt.type == "ImportDeclaration") {
-        if (decs == i) {
-          decs++;
+        if (moveBy == i) {
+          moveBy++;
+        }
+      }
+
+      if (
+        stmt.type === "ExpressionStatement" &&
+        typeof stmt.directive === "string"
+      ) {
+        if (moveBy == i) {
+          moveBy++;
         }
       }
     });
 
-    block.body.splice(decs, 0, ...nodes);
+    block.body.splice(moveBy, 0, ...nodes);
+  } else if (block.type === "SwitchCase") {
+    block.consequent.unshift(...nodes);
   } else {
-    getBlockBody(block).unshift(...nodes);
+    var bodyArray = getBlockBody(block);
+
+    // Check for 'use strict'
+    if (bodyArray[0] && bodyArray[0].directive) {
+      // Insert under 'use strict' directive
+      bodyArray.splice(1, 0, ...nodes);
+    } else {
+      // Prepend at the top of the block
+      bodyArray.unshift(...nodes);
+    }
   }
 }
 
@@ -313,7 +339,10 @@ export function clone<T>(object: T): T {
  * @param p
  * @returns
  */
-export function isForInitialize(o, p): "initializer" | "left-hand" | false {
+export function isForInitialize(
+  o: Node,
+  p: Node[]
+): "initializer" | "left-hand" | false {
   validateChain(o, p);
 
   var forIndex = p.findIndex(
@@ -322,6 +351,17 @@ export function isForInitialize(o, p): "initializer" | "left-hand" | false {
       x.type == "ForInStatement" ||
       x.type == "ForOfStatement"
   );
+
+  if (
+    p
+      .slice(0, forIndex)
+      .find((x) =>
+        ["ArrowFunctionExpression", "BlockStatement"].includes(x.type)
+      )
+  ) {
+    return false;
+  }
+
   if (forIndex !== -1) {
     if (p[forIndex].type == "ForStatement") {
       if (p[forIndex].init == (p[forIndex - 1] || o)) {

package/src/util/random.ts

@@ -8,11 +8,24 @@ import {
   ArrayExpression,
 } from "./gen";
 
+/**
+ * Returns a random element from the given array
+ * @param choices Array of items
+ * @returns One of the items in the array at random
+ */
 export function choice<T>(choices: T[]): T {
   var index = Math.floor(Math.random() * choices.length);
   return choices[index];
 }
 
+/**
+ * Returns a true/false based on the percent chance (0%-100%)
+ * @param percentChance AS A PERCENTAGE 0 - 100%
+ */
+export function chance(percentChance: number): boolean {
+  return Math.random() < percentChance / 100;
+}
+
 /**
  * **Mutates the given array**
  * @param array

package/test/code/Cash.test.ts

@@ -4,7 +4,7 @@ import JsConfuser from "../../src/index";
 
 var CASH_JS = readFileSync(join(__dirname, "./Cash.src.js"), "utf-8");
 
-it("works with Cash.js on High Preset", async () => {
+test("Variant #1: Cash.js on High Preset (Strict Mode)", async () => {
   var output = await JsConfuser(CASH_JS, {
     target: "browser",
     preset: "high",

package/test/code/Dynamic.test.ts

@@ -1,10 +1,11 @@
 import { readFileSync, writeFileSync } from "fs";
 import { join } from "path";
 import JsConfuser from "../../src/index";
+import { ObfuscateOptions } from "../../src/options";
 
 var SOURCE_JS = readFileSync(join(__dirname, "./Dynamic.src.js"), "utf-8");
 
-it("works on High Preset", async () => {
+test.concurrent("Variant #1: Dynamic.src.js on High Preset", async () => {
   // `input` is an embedded variable, therefore globalConcealing must be turned off
   var output = await JsConfuser(SOURCE_JS, {
     target: "browser",
@@ -22,19 +23,20 @@ it("works on High Preset", async () => {
   expect(value).toStrictEqual(1738.1738);
 });
 
-it("work when doubly obfuscated with High Preset", async () => {
-  // `input` is an embedded variable, therefore globalConcealing must be turned off
-  var output = await JsConfuser(SOURCE_JS, {
+test.concurrent("Variant #2: Dynamic.src.js on 2x High Preset", async () => {
+  var options: ObfuscateOptions = {
     target: "node",
     preset: "high",
     globalConcealing: false,
-  });
+  };
 
-  var doublyObfuscated = await JsConfuser(output, {
-    target: "node",
-    preset: "high",
-    globalConcealing: false,
-  });
+  var output = await JsConfuser(SOURCE_JS, options);
+
+  // writeFileSync("./dev.error.1.js", output, "utf-8");
+
+  var doublyObfuscated = await JsConfuser(output, options);
+
+  // writeFileSync("./dev.error.2.js", doublyObfuscated, "utf-8");
 
   var value = "never_called";
   function input(x) {