js-confuser 1.6.0 → 1.7.1

package/src/options.ts

@@ -141,39 +141,6 @@ export interface ObfuscateOptions {
     "hexadecimal" | "randomized" | "zeroWidth" | "mangled" | "number"
   >;
 
-  /**
-   * ### `nameRecycling`
-   *
-   * (Experimental feature)
-   *
-   * Attempts to reuse released names.
-   *
-   * - Potency Medium
-   * - Resilience High
-   * - Cost Low
-   *
-   * ```js
-   * // Input
-   * function percentage(x) {
-   *   var multiplied = x * 100;
-   *   var floored = Math.floor(multiplied);
-   *   var output = floored + "%"
-   *   return output;
-   * }
-   *
-   * // Output
-   * function percentage(x) {
-   *   var multiplied = x * 100;
-   *   var floored = Math.floor(multiplied);
-   *   multiplied = floored + "%";
-   *   return multiplied;
-   * }
-   * ```
-   *
-   * [See all settings here](https://github.com/MichaelXF/js-confuser/blob/master/README.md#options)
-   */
-  nameRecycling?: ProbabilityMap<boolean>;
-
   /**
    * ### `controlFlowFlattening`
    *
@@ -286,48 +253,15 @@ export interface ObfuscateOptions {
    */
   dispatcher?: ProbabilityMap<boolean>;
 
-  /**
-   * ### `eval`
-   *
-   * #### **`Security Warning`**
-   *
-   * From [MDN](<(https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval)**>): Executing JavaScript from a string is an enormous security risk. It is far too easy
-   * for a bad actor to run arbitrary code when you use eval(). Never use eval()!
-   *
-   * Wraps defined functions within eval statements.
-   *
-   * - **`false`** - Avoids using the `eval` function. _Default_.
-   * - **`true`** - Wraps function's code into an `eval` statement.
-   *
-   * ```js
-   * // Output.js
-   * var Q4r1__ = {
-   *   Oo$Oz8t: eval(
-   *     "(function(YjVpAp){var gniSBq6=kHmsJrhOO;switch(gniSBq6){case'RW11Hj5x':return console;}});"
-   *   ),
-   * };
-   * Q4r1__.Oo$Oz8t("RW11Hj5x");
-   * ```
-   *
-   * [See all settings here](https://github.com/MichaelXF/js-confuser/blob/master/README.md#options)
-   */
-  eval?: ProbabilityMap<boolean>;
-
   /**
    * ### `rgf`
    *
    * RGF (Runtime-Generated-Functions) uses the [`new Function(code...)`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/Function) syntax to construct executable code from strings. (`"all"/true/false`)
    *
-   * - **This can break your code. This is also as dangerous as `eval`.**
+   * - **This can break your code.
    * - **Due to the security concerns of arbitrary code execution, you must enable this yourself.**
    * - The arbitrary code is also obfuscated.
    *
-   * | Mode | Description |
-   * | --- | --- |
-   * | `"all"` | Recursively applies to every scope (slow) |
-   * | `true` | Applies to the top level only |
-   * | `false` | Feature disabled |
-   *
    * ```js
    * // Input
    * function log(x){
@@ -342,7 +276,7 @@ export interface ObfuscateOptions {
    *
    * [See all settings here](https://github.com/MichaelXF/js-confuser/blob/master/README.md#options)
    */
-  rgf?: ProbabilityMap<boolean | "all">;
+  rgf?: ProbabilityMap<boolean>;
 
   /**
    * ### `stack`
@@ -472,20 +406,6 @@ export interface ObfuscateOptions {
      */
     context?: string[];
 
-    /**
-     * ### `lock.nativeFunctions`
-     *
-     * Set of global functions that are native. Such as `require`, `fetch`. If these variables are modified the program crashes.
-     * Set to `true` to use the default set of native functions. (`string[]/true/false`)
-     *
-     * - Potency Low
-     * - Resilience Medium
-     * - Cost Medium
-     *
-     * [See all settings here](https://github.com/MichaelXF/js-confuser/blob/master/README.md#options)
-     */
-    nativeFunctions?: string[] | Set<string> | boolean;
-
     /**
      * ### `lock.startDate`
      *
@@ -678,7 +598,6 @@ const validProperties = new Set([
   "renameVariables",
   "renameGlobals",
   "identifierGenerator",
-  "nameRecycling",
   "controlFlowFlattening",
   "globalConcealing",
   "stringCompression",
@@ -687,7 +606,6 @@ const validProperties = new Set([
   "stringSplitting",
   "duplicateLiteralsRemoval",
   "dispatcher",
-  "eval",
   "rgf",
   "objectExtraction",
   "flatten",
@@ -868,6 +786,10 @@ export async function correctOptions(
         "alert",
         "confirm",
         "location",
+        "btoa",
+        "atob",
+        "unescape",
+        "encodeURIComponent",
       ].forEach((x) => options.globalVariables.add(x));
     } else {
       // node
@@ -876,6 +798,8 @@ export async function correctOptions(
         "Buffer",
         "require",
         "process",
+        "exports",
+        "module",
         "__dirname",
         "__filename",
       ].forEach((x) => options.globalVariables.add(x));
@@ -887,6 +811,7 @@ export async function correctOptions(
       "parseInt",
       "parseFloat",
       "Math",
+      "JSON",
       "Promise",
       "String",
       "Boolean",
@@ -906,8 +831,6 @@ export async function correctOptions(
       "setImmediate",
       "clearImmediate",
       "queueMicrotask",
-      "exports",
-      "module",
       "isNaN",
       "isFinite",
       "Set",

package/src/presets.ts

@@ -17,7 +17,7 @@ import { ObfuscateOptions } from "./options";
  * 10. Minified output
  *
  * ## **`Disabled features`**
- * - `eval` Use at your own risk!
+ * - `rgf` Use at your own risk!
  *
  * ### Potential Issues
  * 1. *String Encoding* can corrupt files. Disable `stringEncoding` manually if this happens.
@@ -51,7 +51,6 @@ const highPreset: ObfuscateOptions = {
   stringSplitting: 0.75,
 
   // Use at own risk
-  eval: false,
   rgf: false,
 };
 
@@ -66,9 +65,9 @@ const mediumPreset: ObfuscateOptions = {
   calculator: true,
   compact: true,
   hexadecimalNumbers: true,
-  controlFlowFlattening: 0.5,
+  controlFlowFlattening: 0.25,
   deadCode: 0.025,
-  dispatcher: 0.75,
+  dispatcher: 0.5,
   duplicateLiteralsRemoval: 0.5,
   globalConcealing: true,
   identifierGenerator: "randomized",
@@ -95,10 +94,10 @@ const lowPreset: ObfuscateOptions = {
   calculator: true,
   compact: true,
   hexadecimalNumbers: true,
-  controlFlowFlattening: 0.25,
+  controlFlowFlattening: 0.1,
   deadCode: 0.01,
-  dispatcher: 0.5,
-  duplicateLiteralsRemoval: true,
+  dispatcher: 0.25,
+  duplicateLiteralsRemoval: 0.5,
   identifierGenerator: "randomized",
   minify: true,
   movedDeclarations: true,

package/src/templates/crash.ts

@@ -3,7 +3,7 @@ import Template from "./template";
 export const CrashTemplate1 = Template(`
 var {var} = "a";
 while(1){
-    {var} = {var} += "a";    //add as much as the browser can handle
+    {var} = {var} += "a";
 }
 `);
 
@@ -40,16 +40,16 @@ try {
       });
       
       {$1}();
-} catch ( e ) {
-    while(e ? e : !e){
-        var b;
-        var c = 0;
-        (e ? !e : e) ? (function(e){
-            c = e ? 0 : !e ? 1 : 0;
-        })(e) : b = 1;
+} catch ( {$1}e ) {
+    while({$1}e ? {$1}e : !{$1}e){
+        var {$1}b;
+        var {$1}c = 0;
+        ({$1}e ? !{$1}e : {$1}e) ? (function({$1}e){
+            {$1}c = {$1}e ? 0 : !{$1}e ? 1 : 0;
+        })({$1}e) : {$1}b = 1;
 
-        if(b&&c){break;}
-        if(b){continue;}
+        if({$1}b&&{$1}c){break;}
+        if({$1}b){continue;}
     }
 }
 `);

package/src/templates/functionLength.ts

@@ -0,0 +1,14 @@
+import Template from "./template";
+
+/**
+ * Helper function to set `function.length` property.
+ */
+export const FunctionLengthTemplate = Template(`
+function {name}(functionObject, functionLength){
+  Object["defineProperty"](functionObject, "length", {
+    "value": functionLength,
+    "configurable": true
+  });
+  return functionObject;
+}
+`);

package/src/transforms/dispatcher.ts

@@ -68,6 +68,8 @@ import Template from "../templates/template";
  * 3. using `this`
  */
 export default class Dispatcher extends Transform {
+  // Debug mode preserves function names
+  isDebug = false;
   count: number;
 
   constructor(o) {
@@ -155,6 +157,16 @@ export default class Dispatcher extends Transform {
                     return "EXIT";
                   }
                 }
+
+                // Avoid functions with function expressions as they have a different scope
+                if (
+                  (oo.type === "FunctionExpression" ||
+                    oo.type === "ArrowFunctionExpression") &&
+                  pp.find((x) => x == o.params)
+                ) {
+                  illegalFnNames.add(name);
+                  return "EXIT";
+                }
               });
 
               functionDeclarations[name] = [o, p];
@@ -196,7 +208,9 @@ export default class Dispatcher extends Transform {
         // map original name->new game
         var gen = this.getGenerator();
         Object.keys(functionDeclarations).forEach((name) => {
-          newFnNames[name] = gen.generate();
+          newFnNames[name] = this.isDebug
+            ? "_dispatcher_" + this.count + "_" + name
+            : gen.generate();
         });
         // set containing new name
         var set = new Set(Object.keys(newFnNames));

package/src/transforms/extraction/duplicateLiteralsRemoval.ts

@@ -13,15 +13,9 @@ import {
   BinaryExpression,
   FunctionDeclaration,
   ThisExpression,
-  FunctionExpression,
+  ConditionalExpression,
 } from "../../util/gen";
-import {
-  append,
-  clone,
-  getLexContext,
-  isLexContext,
-  prepend,
-} from "../../util/insert";
+import { append, clone, prepend } from "../../util/insert";
 import { isDirective, isPrimitive } from "../../util/compare";
 
 import { ObfuscateOrder } from "../../order";
@@ -29,6 +23,8 @@ import { isModuleSource } from "../string/stringConcealing";
 import { ComputeProbabilityMap } from "../../probability";
 import { ok } from "assert";
 import { chance, choice, getRandomInteger } from "../../util/random";
+import { getBlock } from "../../traverse";
+import { getIdentifierInfo } from "../../util/identifiers";
 
 /**
  * [Duplicate Literals Removal](https://docs.jscrambler.com/code-integrity/documentation/transformations/duplicate-literals-removal) replaces duplicate literals with a variable name.
@@ -49,20 +45,25 @@ import { chance, choice, getRandomInteger } from "../../util/random";
  * ```
  */
 export default class DuplicateLiteralsRemoval extends Transform {
+  // The array holding all the duplicate literals
   arrayName: string;
+  // The array expression node to be inserted into the program
   arrayExpression: Node;
+
+  /**
+   * Literals in the array
+   */
   map: Map<string, number>;
-  first: Map<string, Location | null>;
 
   /**
-   * getter fn name -> accumulative shift
+   * Literals are saved here the first time they are seen.
    */
-  fnShifts: Map<string, number>;
+  first: Map<string, Location>;
 
   /**
-   * lex context -> getter fn name
+   * Block -> { functionName, indexShift }
    */
-  fnGetters: Map<Node, string>;
+  functions: Map<Node, { functionName: string; indexShift: number }>;
 
   constructor(o) {
     super(o, ObfuscateOrder.DuplicateLiteralsRemoval);
@@ -70,14 +71,14 @@ export default class DuplicateLiteralsRemoval extends Transform {
     this.map = new Map();
     this.first = new Map();
 
-    this.fnShifts = new Map();
-    this.fnGetters = new Map();
+    this.functions = new Map();
   }
 
   apply(tree) {
     super.apply(tree);
 
-    if (this.arrayName && this.arrayExpression.elements.length) {
+    if (this.arrayName && this.arrayExpression.elements.length > 0) {
+      // This function simply returns the array
       var getArrayFn = this.getPlaceholder();
       append(
         tree,
@@ -88,22 +89,79 @@ export default class DuplicateLiteralsRemoval extends Transform {
         )
       );
 
+      // This variable holds the array
       prepend(
         tree,
         VariableDeclaration(
           VariableDeclarator(
             this.arrayName,
             CallExpression(
-              MemberExpression(
-                Identifier(getArrayFn),
-                Identifier("call"),
-                false
-              ),
+              MemberExpression(Identifier(getArrayFn), Literal("call"), true),
               [ThisExpression()]
             )
           )
         )
       );
+
+      // Create all the functions needed
+      for (var blockNode of this.functions.keys()) {
+        var { functionName, indexShift } = this.functions.get(blockNode);
+
+        var propertyNode: Node = BinaryExpression(
+          "-",
+          Identifier("index_param"),
+          Literal(indexShift)
+        );
+
+        var indexRangeInclusive = [
+          0 + indexShift - 1,
+          this.map.size + indexShift,
+        ];
+
+        // The function uses mangling to hide the index being accessed
+        var mangleCount = getRandomInteger(1, 10);
+        for (var i = 0; i < mangleCount; i++) {
+          var operator = choice([">", "<"]);
+          var compareValue = choice(indexRangeInclusive);
+
+          var test = BinaryExpression(
+            operator,
+            Identifier("index_param"),
+            Literal(compareValue)
+          );
+
+          var alternate = BinaryExpression(
+            "-",
+            Identifier("index_param"),
+            Literal(getRandomInteger(-100, 100))
+          );
+
+          var testValue =
+            (operator === ">" && compareValue === indexRangeInclusive[0]) ||
+            (operator === "<" && compareValue === indexRangeInclusive[1]);
+
+          propertyNode = ConditionalExpression(
+            test,
+            testValue ? propertyNode : alternate,
+            !testValue ? propertyNode : alternate
+          );
+        }
+
+        var returnArgument = MemberExpression(
+          Identifier(this.arrayName),
+          propertyNode,
+          true
+        );
+
+        prepend(
+          blockNode,
+          FunctionDeclaration(
+            functionName,
+            [Identifier("index_param")],
+            [ReturnStatement(returnArgument)]
+          )
+        );
+      }
     }
   }
 
@@ -122,109 +180,52 @@ export default class DuplicateLiteralsRemoval extends Transform {
    * @param parents
    * @param index
    */
-  toCaller(object: Node, parents: Node[], index: number) {
-    // get all the getters defined here or higher
-    var getterNames = [object, ...parents]
-      .map((x) => this.fnGetters.get(x))
-      .filter((x) => x);
-
-    // use random getter function
-    var getterName = choice(getterNames);
-
-    // get this literals context
-    var lexContext = getLexContext(object, parents);
-
-    var hasGetterHere = this.fnGetters.has(lexContext);
-
-    // create one if none are available (or by random chance if none are here locally)
-    var shouldCreateNew =
-      !getterName || (!hasGetterHere && Math.random() > 0.9);
-
-    if (shouldCreateNew) {
-      ok(!this.fnGetters.has(lexContext));
-
-      var lexContextIndex = parents.findIndex(
-        (x) => x !== lexContext && isLexContext(x)
-      );
-      var basedOn =
-        lexContextIndex !== -1
-          ? choice(
-              parents
-                .slice(lexContextIndex + 1)
-                .map((x) => this.fnGetters.get(x))
-                .filter((x) => x)
-            )
-          : null;
-
-      var body = [];
-      var thisShift = getRandomInteger(-250, 250);
-      // the name of the getter
-      getterName = this.getPlaceholder() + "_dLR_" + this.fnGetters.size;
-
-      if (basedOn) {
-        var shift = this.fnShifts.get(basedOn);
-        ok(typeof shift === "number");
-
-        body = [
-          ReturnStatement(
-            CallExpression(Identifier(basedOn), [
-              BinaryExpression("+", Identifier("index"), Literal(thisShift)),
-            ])
-          ),
-        ];
+  transformLiteral(object: Node, parents: Node[], index: number) {
+    var blockNode = choice(parents.filter((x) => this.functions.has(x)));
+
+    // Create initial function if none exist
+    if (this.functions.size === 0) {
+      var root = parents[parents.length - 1];
+      var rootFunctionName = this.getPlaceholder() + "_dLR_0";
+      this.functions.set(root, {
+        functionName: rootFunctionName,
+        indexShift: getRandomInteger(-100, 100),
+      });
+
+      blockNode = root;
+    }
 
-        this.fnShifts.set(getterName, shift + thisShift);
-      } else {
-        // from scratch
-
-        body = [
-          ReturnStatement(
-            MemberExpression(
-              Identifier(this.arrayName),
-              BinaryExpression("+", Identifier("index"), Literal(thisShift)),
-              true
-            )
-          ),
-        ];
+    // If no function here exist, possibly create new chained function
+    var block = getBlock(object, parents);
+    if (!this.functions.has(block) && chance(50 - this.functions.size)) {
+      var newFunctionName =
+        this.getPlaceholder() + "_dLR_" + this.functions.size;
 
-        this.fnShifts.set(getterName, thisShift);
-      }
+      this.functions.set(block, {
+        functionName: newFunctionName,
+        indexShift: getRandomInteger(-100, 100),
+      });
 
-      this.fnGetters.set(lexContext, getterName);
-
-      prepend(
-        lexContext,
-        VariableDeclaration(
-          VariableDeclarator(
-            getterName,
-            CallExpression(
-              FunctionExpression(
-                [],
-                [
-                  ReturnStatement(
-                    FunctionExpression([Identifier("index")], body)
-                  ),
-                ]
-              ),
-              []
-            )
-          )
-        )
-      );
+      blockNode = block;
     }
 
-    var theShift = this.fnShifts.get(getterName);
+    // Derive the function to call from the selected blockNode
+    var { functionName, indexShift } = this.functions.get(blockNode);
 
-    this.replaceIdentifierOrLiteral(
-      object,
-      CallExpression(Identifier(getterName), [Literal(index - theShift)]),
-      parents
-    );
+    // Call the function given it's indexShift
+    var callExpression = CallExpression(Identifier(functionName), [
+      Literal(index + indexShift),
+    ]);
+
+    this.replaceIdentifierOrLiteral(object, callExpression, parents);
   }
 
   transform(object: Node, parents: Node[]) {
     return () => {
-      var value = object.value;
+      if (object.type === "Identifier") {
+        var info = getIdentifierInfo(object, parents);
+        if (info.isLabel || info.spec.isDefined) return;
+      }
       if (object.regex) {
         return;
       }
@@ -234,7 +235,7 @@ export default class DuplicateLiteralsRemoval extends Transform {
       }
 
       // HARD CODED LIMIT of 10,000 (after 1,000 elements)
-      if (this.map.size > 1000 && !chance(this.map.size / 100)) return;
+      if (this.map.size > 1000 && chance(this.map.size / 100)) return;
 
       if (
         this.arrayName &&
@@ -244,11 +245,11 @@ export default class DuplicateLiteralsRemoval extends Transform {
         return;
       }
 
-      var value;
+      var stringValue;
       if (object.type == "Literal") {
-        value = typeof object.value + ":" + object.value;
+        stringValue = typeof object.value + ":" + object.value;
         if (object.value === null) {
-          value = "null:null";
+          stringValue = "null:null";
         } else {
           // Skip empty strings
           if (typeof object.value === "string" && !object.value) {
@@ -256,42 +257,46 @@ export default class DuplicateLiteralsRemoval extends Transform {
           }
         }
       } else if (object.type == "Identifier") {
-        value = "identifier:" + object.name;
+        stringValue = "identifier:" + object.name;
       } else {
         throw new Error("Unsupported primitive type: " + object.type);
       }
 
-      ok(value);
+      ok(stringValue);
 
-      if (!this.first.has(value) && !this.map.has(value)) {
-        this.first.set(value, [object, parents]);
-      } else {
+      if (this.map.has(stringValue) || this.first.has(stringValue)) {
+        // Create the array if not already made
         if (!this.arrayName) {
           this.arrayName = this.getPlaceholder();
           this.arrayExpression = ArrayExpression([]);
         }
 
-        var firstLocation = this.first.get(value);
+        // Delete with first location
+        var firstLocation = this.first.get(stringValue);
         if (firstLocation) {
-          this.first.set(value, null);
           var index = this.map.size;
 
-          ok(!this.map.has(value));
-          this.map.set(value, index);
+          ok(!this.map.has(stringValue));
+          this.map.set(stringValue, index);
+          this.first.delete(stringValue);
 
           var pushing = clone(object);
           this.arrayExpression.elements.push(pushing);
 
           ok(this.arrayExpression.elements[index] === pushing);
 
-          this.toCaller(firstLocation[0], firstLocation[1], index);
+          this.transformLiteral(firstLocation[0], firstLocation[1], index);
         }
 
-        var index = this.map.get(value);
+        var index = this.map.get(stringValue);
         ok(typeof index === "number");
 
-        this.toCaller(object, parents, index);
+        this.transformLiteral(object, parents, index);
+        return;
       }
+
+      // Save this, maybe a duplicate will be found.
+      this.first.set(stringValue, [object, parents]);
     };
   }
 }