js-confuser 1.7.2 → 2.0.0-alpha.0

package/src/order.ts

@@ -1,16 +1,16 @@
 /**
  * Describes the order of transformations.
  */
-export enum ObfuscateOrder {
+export enum Order {
   Preparation = 0,
 
   ObjectExtraction = 1,
 
   Flatten = 2,
 
-  RGF = 3,
+  Lock = 3,
 
-  Lock = 4, // Includes Integrity & Anti Debug
+  RGF = 4,
 
   Dispatcher = 6,
 
@@ -18,10 +18,6 @@ export enum ObfuscateOrder {
 
   Calculator = 9,
 
-  ControlFlowFlattening = 10,
-
-  Eval = 11,
-
   GlobalConcealing = 12,
 
   OpaquePredicates = 13,
@@ -32,25 +28,29 @@ export enum ObfuscateOrder {
 
   StringCompression = 18,
 
-  Stack = 20,
+  VariableMasking = 20,
 
   DuplicateLiteralsRemoval = 22,
 
-  Shuffle = 24,
+  Shuffle = 23,
+
+  ControlFlowFlattening = 24,
 
-  NameRecycling = 25,
+  MovedDeclarations = 25,
 
-  MovedDeclarations = 26,
+  FunctionOutlining = 26,
 
   RenameLabels = 27,
 
   Minify = 28,
 
-  AntiTooling = 29,
+  AstScrambler = 29,
 
   RenameVariables = 30,
 
-  ES5 = 31,
-
   Finalizer = 35,
+
+  Pack = 36,
+
+  Integrity = 37, // Must run last
 }

package/src/presets.ts

@@ -1,27 +1,17 @@
 import { ObfuscateOptions } from "./options";
 
 /**
- * - High Obfuscation preset.
- * - **Average 90% performance reduction.**
+ * - High Obfuscation preset
  *
- * ## **`Enabled features`**
- * 1. Variable renaming
- * 2. Control flow obfuscation
- * 3. String concealing
- * 4. Opaque predicates
- * 5. Dead code
- * 6. Dispatcher
- * 7. Moved declarations
- * 8. Object extraction
- * 9. Global concealing
- * 10. Minified output
+ * **This preset is unsafe and may break your code.**
  *
- * ## **`Disabled features`**
- * - `rgf` Use at your own risk!
+ * Security risks:
  *
- * ### Potential Issues
- * 1. *String Encoding* can corrupt files. Disable `stringEncoding` manually if this happens.
- * 2. *Dead Code* can bloat file size. Reduce or disable `deadCode`.
+ * - Function constructor (`Pack`)
+ * - Escapes strict-mode constraints (`Pack`)
+ * - Use of `with` statement (`Control Flow Flattening`)
+ * - Object.prototype pollution (`Opaque Predicates`)
+ * - Bloats file size (`Dead Code` and `String Compression` can add up to 50kb)
  */
 const highPreset: ObfuscateOptions = {
   target: "node",
@@ -30,8 +20,8 @@ const highPreset: ObfuscateOptions = {
   calculator: true,
   compact: true,
   hexadecimalNumbers: true,
-  controlFlowFlattening: 0.75,
-  deadCode: 0.2,
+  controlFlowFlattening: 0.5,
+  deadCode: 0.25,
   dispatcher: true,
   duplicateLiteralsRemoval: 0.75,
   flatten: true,
@@ -43,20 +33,33 @@ const highPreset: ObfuscateOptions = {
   opaquePredicates: 0.75,
   renameVariables: true,
   renameGlobals: true,
-  shuffle: { hash: 0.5, true: 0.5 },
-  stack: true,
+  shuffle: true,
+  variableMasking: 0.75,
   stringConcealing: true,
   stringCompression: true,
   stringEncoding: true,
   stringSplitting: 0.75,
+  astScrambler: true,
+
+  // Experimental
+  // functionOutlining: false,
 
-  // Use at own risk
-  rgf: false,
+  // Security risks
+  pack: true,
 };
 
 /**
- * - Medium Obfuscation preset.
- * - Average 50% performance reduction.
+ * - Medium Obfuscation preset
+ *
+ * **This preset is unsafe and may break your code.**
+ *
+ * Security risks:
+ *
+ * - Function constructor (`Pack`)
+ * - Escapes strict-mode constraints (`Pack`)
+ * - Use of `with` statement (`Control Flow Flattening`)
+ * - Object.prototype pollution (`Opaque Predicates`)
+ * - Bloats file size (`Dead Code` can add up to 50kb)
  */
 const mediumPreset: ObfuscateOptions = {
   target: "node",
@@ -66,7 +69,7 @@ const mediumPreset: ObfuscateOptions = {
   compact: true,
   hexadecimalNumbers: true,
   controlFlowFlattening: 0.25,
-  deadCode: 0.025,
+  deadCode: 0.1,
   dispatcher: 0.5,
   duplicateLiteralsRemoval: 0.5,
   globalConcealing: true,
@@ -74,18 +77,21 @@ const mediumPreset: ObfuscateOptions = {
   minify: true,
   movedDeclarations: true,
   objectExtraction: true,
-  opaquePredicates: 0.5,
   renameVariables: true,
   renameGlobals: true,
   shuffle: true,
-  stack: 0.5,
+  variableMasking: 0.5,
   stringConcealing: true,
   stringSplitting: 0.25,
+  astScrambler: true,
+  pack: true,
 };
 
 /**
- * - Low Obfuscation preset.
- * - Average 30% performance reduction.
+ * - Low Obfuscation preset
+ *
+ * A balanced preset that provides basic obfuscation.
+ *
  */
 const lowPreset: ObfuscateOptions = {
   target: "node",
@@ -94,18 +100,17 @@ const lowPreset: ObfuscateOptions = {
   calculator: true,
   compact: true,
   hexadecimalNumbers: true,
-  controlFlowFlattening: 0.1,
-  deadCode: 0.01,
+  deadCode: 0.05,
   dispatcher: 0.25,
   duplicateLiteralsRemoval: 0.5,
   identifierGenerator: "randomized",
   minify: true,
   movedDeclarations: true,
   objectExtraction: true,
-  opaquePredicates: 0.1,
   renameVariables: true,
   renameGlobals: true,
   stringConcealing: true,
+  astScrambler: true,
 };
 
 /**

package/src/probability.ts

@@ -1,55 +1,37 @@
 import { ok } from "assert";
-import { createObject } from "./util/object";
-
-type Stringed<V> = (V extends string ? V : never) | "true" | "false";
-
-/**
- * Configurable probabilities for obfuscator options.
- * - **`false`** = this feature is disabled
- * - **`true`** = this feature is enabled, use default mode
- * - **`0.5`** = 50% chance
- * - **`"mode"`** = enabled, use specified mode
- * - **`["mode1", "mode2"]`** - enabled, choose random mode each occurrence
- * - **`{"mode1": 0.5, "mode2": 0.5}`** - enabled, choose based on specified probabilities
- * - **`{"mode1": 50, "mode2": 50}`** - enabled, each is divided based on total
- * - **`function(x){ return "custom_implementation" }`** - enabled, use specified function
- */
-export type ProbabilityMap<T> =
-  | false
-  | true
-  | number
-  | T
-  | T[]
-  | { [key in Stringed<T>]?: number }
-  | ((...params: any[]) => any);
+import { createObject } from "./utils/object-utils";
+import { ProbabilityMap } from "./options";
 
 /**
  * Evaluates a ProbabilityMap.
  * @param map The setting object.
- * @param runner Custom function to determine return value
  * @param customFnArgs Args given to user-implemented function, such as a variable name.
  */
-export function ComputeProbabilityMap<T>(
-  map: ProbabilityMap<T>,
-  runner: (mode?: T) => any = (x?: T) => x,
-  ...customFnArgs: any[]
-): any {
+export function computeProbabilityMap<
+  T,
+  F extends (...args: any[]) => any = (...args: any[]) => any
+>(
+  map: ProbabilityMap<T, F>,
+  ...customImplementationArgs: F extends (...args: infer P) => any ? P : never
+): boolean | string {
   if (!map) {
-    return runner();
+    return false;
   }
   if (map === true || map === 1) {
-    return runner(true as any);
+    return true;
   }
   if (typeof map === "number") {
-    return runner((Math.random() < map) as any);
+    return Math.random() < map;
   }
 
   if (typeof map === "function") {
-    return (map as any)(...customFnArgs);
+    return (map as Function)(...customImplementationArgs);
   }
+
   if (typeof map === "string") {
-    return runner(map);
+    return map;
   }
+
   var asObject: { [mode: string]: number } = {};
   if (Array.isArray(map)) {
     map.forEach((x: any) => {
@@ -70,7 +52,7 @@ export function ComputeProbabilityMap<T>(
   var count = 0;
   var winner = null;
   Object.keys(percentages).forEach((key) => {
-    var x = parseFloat(percentages[key]);
+    var x = Number(percentages[key]);
 
     if (ticket >= count && ticket < count + x) {
       winner = key;
@@ -78,7 +60,7 @@ export function ComputeProbabilityMap<T>(
     count += x;
   });
 
-  return runner(winner);
+  return winner;
 }
 
 /**
@@ -111,6 +93,9 @@ export function isProbabilityMapProbable<T>(map: ProbabilityMap<T>): boolean {
     }
   }
   if (typeof map === "object") {
+    if (map instanceof Date) return true;
+    if (map instanceof RegExp) return true;
+
     var keys = Object.keys(map);
     ok(
       keys.length != 0,

package/src/templates/{bufferToString.ts → bufferToStringTemplate.ts}

@@ -1,57 +1,7 @@
-import {
-  placeholderVariablePrefix,
-  predictableFunctionTag,
-} from "../constants";
 import Template from "./template";
 
-export const GetGlobalTemplate = Template(`
-  function ${placeholderVariablePrefix}CFG__getGlobalThis${predictableFunctionTag}(){
-    return globalThis
-  }
-
-  function ${placeholderVariablePrefix}CFG__getGlobal${predictableFunctionTag}(){
-    return global
-  }
-
-  function ${placeholderVariablePrefix}CFG__getWindow${predictableFunctionTag}(){
-    return window
-  }
-
-  function ${placeholderVariablePrefix}CFG__getThisFunction${predictableFunctionTag}(){
-    return new Function("return this")()
-  }
-
-  function {getGlobalFnName}(array = [
-    ${placeholderVariablePrefix}CFG__getGlobalThis${predictableFunctionTag},
-    ${placeholderVariablePrefix}CFG__getGlobal${predictableFunctionTag},
-    ${placeholderVariablePrefix}CFG__getWindow${predictableFunctionTag},
-    ${placeholderVariablePrefix}CFG__getThisFunction${predictableFunctionTag}
-  ]){
-    var bestMatch
-    var itemsToSearch = []
-    try {
-      bestMatch = Object
-      itemsToSearch["push"](("")["__proto__"]["constructor"]["name"])
-    } catch(e) {
-
-    }
-    A: for(var i = 0; i < array["length"]; i++) {
-      try {
-        bestMatch = array[i]()
-        for(var j = 0; j < itemsToSearch["length"]; j++) {
-          if(typeof bestMatch[itemsToSearch[j]] === "undefined") continue A;
-        }
-        return bestMatch
-      } catch(e) {}
-    }
-
-		return bestMatch || this;
-  }
-`);
-
-export const BufferToStringTemplate = Template(`
-
-  ${GetGlobalTemplate.source}
+export const BufferToStringTemplate = new Template(`
+  {GetGlobalTemplate}
 
   var __globalObject = {getGlobalFnName}() || {};
   var __TextDecoder = __globalObject["TextDecoder"];
@@ -66,7 +16,8 @@ export const BufferToStringTemplate = Template(`
     var result = [];
 
     return function (array) {
-        var codePt, byte1;
+        var codePt;
+        var byte1;
         var buffLen = array["length"];
 
         result["length"] = 0;
@@ -94,7 +45,7 @@ export const BufferToStringTemplate = Template(`
     };
   })();
 
-  function {name}(buffer){
+  function {BufferToString}(buffer){
     if(typeof __TextDecoder !== "undefined" && __TextDecoder) {
       return new __TextDecoder()["decode"](new __Uint8Array(buffer));
     } else if(typeof __Buffer !== "undefined" && __Buffer) {