js-confuser 1.7.2 → 2.0.0-alpha.0

package/src/transforms/identifier/globalConcealing.ts

@@ -1,214 +1,286 @@
+import * as t from "@babel/types";
+import { NodePath } from "@babel/core";
+import { NameGen } from "../../utils/NameGen";
 import Template from "../../templates/template";
-import Transform from "../transform";
-import { ObfuscateOrder } from "../../order";
+import { PluginArg, PluginObject } from "../plugin";
+import { Order } from "../../order";
+import { computeProbabilityMap } from "../../probability";
 import {
-  Node,
-  Location,
-  CallExpression,
-  Identifier,
-  Literal,
-  FunctionDeclaration,
-  ReturnStatement,
-  MemberExpression,
-  SwitchStatement,
-  SwitchCase,
-  LogicalExpression,
-  VariableDeclarator,
-  FunctionExpression,
-  ExpressionStatement,
-  AssignmentExpression,
-  VariableDeclaration,
-  BreakStatement,
-} from "../../util/gen";
-import { append, prepend } from "../../util/insert";
-import { chance, getRandomInteger } from "../../util/random";
-import { predictableFunctionTag, reservedIdentifiers } from "../../constants";
-import { ComputeProbabilityMap } from "../../probability";
-import GlobalAnalysis from "./globalAnalysis";
-import { GetGlobalTemplate } from "../../templates/bufferToString";
-
-/**
- * Global Concealing hides global variables being accessed.
- *
- * - Any variable that is not defined is considered "global"
- */
-export default class GlobalConcealing extends Transform {
-  globalAnalysis: GlobalAnalysis;
-  ignoreGlobals = new Set(["require", "__dirname", "eval"]);
-
-  constructor(o) {
-    super(o, ObfuscateOrder.GlobalConcealing);
-
-    this.globalAnalysis = new GlobalAnalysis(o);
-    this.before.push(this.globalAnalysis);
-  }
+  MULTI_TRANSFORM,
+  reservedIdentifiers,
+  variableFunctionName,
+} from "../../constants";
+import {
+  getMemberExpressionPropertyAsString,
+  isVariableIdentifier,
+  prepend,
+} from "../../utils/ast-utils";
+import { createGetGlobalTemplate } from "../../templates/getGlobalTemplate";
+import { getRandomInteger, getRandomString } from "../../utils/random-utils";
+import { ok } from "assert";
 
-  match(object: Node, parents: Node[]) {
-    return object.type == "Program";
-  }
+const ignoreGlobals = new Set([
+  "require",
+  "__dirname",
+  "eval",
+  "arguments",
+  variableFunctionName,
+  ...reservedIdentifiers,
+]);
 
-  transform(object: Node, parents: Node[]) {
-    return () => {
-      var globals: { [name: string]: Location[] } = this.globalAnalysis.globals;
-      this.globalAnalysis.notGlobals.forEach((del) => {
-        delete globals[del];
-      });
+export default ({ Plugin }: PluginArg): PluginObject => {
+  const me = Plugin(Order.GlobalConcealing, {
+    changeData: {
+      globals: 0,
+      nativeFunctions: 0,
+    },
+  });
 
-      for (var varName of this.ignoreGlobals) {
-        delete globals[varName];
-      }
+  var globalMapping = new Map<string, string>(),
+    globalFnName = me.getPlaceholder() + "_getGlobal",
+    globalVarName = me.getPlaceholder() + "_globalVar",
+    gen = new NameGen();
 
-      reservedIdentifiers.forEach((x) => {
-        delete globals[x];
-      });
+  // Create the getGlobal function using a template
+  function createGlobalConcealingFunction(): t.FunctionDeclaration {
+    // Create fake global mappings
+
+    var fakeCount = getRandomInteger(20, 40);
+    for (var i = 0; i < fakeCount; i++) {
+      var fakeName = getRandomString(getRandomInteger(6, 8));
+      globalMapping.set(gen.generate(), fakeName);
+    }
 
-      Object.keys(globals).forEach((x) => {
-        if (this.globalAnalysis.globals[x].length < 1) {
-          delete globals[x];
-        } else if (
-          !ComputeProbabilityMap(this.options.globalConcealing, (x) => x, x)
-        ) {
-          delete globals[x];
-        }
+    const createSwitchStatement = () => {
+      const cases = Array.from(globalMapping.keys()).map((originalName) => {
+        var mappedKey = globalMapping.get(originalName);
+
+        return t.switchCase(t.stringLiteral(mappedKey), [
+          t.returnStatement(
+            t.memberExpression(
+              t.identifier(globalVarName),
+              t.stringLiteral(originalName),
+              true
+            )
+          ),
+        ]);
       });
 
-      if (Object.keys(globals).length > 0) {
-        var usedStates = new Set<number>();
+      return t.switchStatement(t.identifier("mapping"), cases);
+    };
 
-        // Make getter function
+    return t.functionDeclaration(
+      t.identifier(globalFnName),
+      [t.identifier("mapping")],
+      t.blockStatement([createSwitchStatement()])
+    );
+  }
 
-        // holds "window" or "global"
-        var globalVar = this.getPlaceholder();
+  return {
+    visitor: {
+      Program: {
+        exit(programPath: NodePath<t.Program>) {
+          var illegalGlobals = new Set<string>();
+          var pendingReplacements = new Map<string, NodePath[]>();
 
-        var getGlobalVariableFnName =
-          this.getPlaceholder() + predictableFunctionTag;
+          programPath.traverse({
+            Identifier(identifierPath) {
+              if (!isVariableIdentifier(identifierPath)) return;
 
-        // Returns global variable or fall backs to `this`
-        var getGlobalVariableFn = GetGlobalTemplate.compile({
-          getGlobalFnName: getGlobalVariableFnName,
-        });
+              var identifierName = identifierPath.node.name;
 
-        // 2. Replace old accessors
-        var globalFn = this.getPlaceholder() + predictableFunctionTag;
+              if (ignoreGlobals.has(identifierName)) return;
 
-        var newNames: { [globalVarName: string]: number } = Object.create(null);
+              const binding = identifierPath.scope.getBinding(identifierName);
+              if (binding) {
+                illegalGlobals.add(identifierName);
+                return;
+              }
 
-        Object.keys(globals).forEach((name) => {
-          var locations: Location[] = globals[name];
-          var state: number;
-          do {
-            state = getRandomInteger(-1000, 1000 + usedStates.size);
-          } while (usedStates.has(state));
-          usedStates.add(state);
+              if (!identifierPath.scope.hasGlobal(identifierName)) {
+                return;
+              }
 
-          newNames[name] = state;
+              var assignmentChild = identifierPath.find((p) =>
+                p.parentPath?.isAssignmentExpression()
+              );
+              if (
+                assignmentChild &&
+                t.isAssignmentExpression(assignmentChild.parent) &&
+                assignmentChild.parent.left === assignmentChild.node &&
+                !t.isMemberExpression(identifierPath.parent)
+              ) {
+                illegalGlobals.add(identifierName);
+                return;
+              }
 
-          locations.forEach(([node, parents]) => {
-            this.replace(
-              node,
-              CallExpression(Identifier(globalFn), [Literal(state)])
-            );
+              if (!pendingReplacements.has(identifierName)) {
+                pendingReplacements.set(identifierName, [identifierPath]);
+              } else {
+                pendingReplacements.get(identifierName).push(identifierPath);
+              }
+            },
           });
-        });
-
-        // Adds all global variables to the switch statement
-        this.options.globalVariables.forEach((name) => {
-          if (!newNames[name]) {
-            var state;
-            do {
-              state = getRandomInteger(
-                0,
-                1000 + usedStates.size + this.options.globalVariables.size * 100
-              );
-            } while (usedStates.has(state));
-            usedStates.add(state);
 
-            newNames[name] = state;
-          }
-        });
-
-        var indexParamName = this.getPlaceholder();
-        var returnName = this.getPlaceholder();
-
-        var functionDeclaration = FunctionDeclaration(
-          globalFn,
-          [Identifier(indexParamName)],
-          [
-            VariableDeclaration(VariableDeclarator(returnName)),
-            SwitchStatement(
-              Identifier(indexParamName),
-              Object.keys(newNames).map((name) => {
-                var code = newNames[name];
-                var body: Node[] = [
-                  ReturnStatement(
-                    MemberExpression(Identifier(globalVar), Literal(name), true)
-                  ),
-                ];
-                if (chance(50)) {
-                  body = [
-                    ExpressionStatement(
-                      AssignmentExpression(
-                        "=",
-                        Identifier(returnName),
-                        LogicalExpression(
-                          "||",
-                          Literal(name),
-                          MemberExpression(
-                            Identifier(globalVar),
-                            Literal(name),
-                            true
+          // Remove illegal globals
+          illegalGlobals.forEach((globalName) => {
+            pendingReplacements.delete(globalName);
+          });
+
+          for (var [globalName, paths] of pendingReplacements) {
+            var mapping = globalMapping.get(globalName);
+            if (!mapping) {
+              // Allow user to disable custom global variables
+              if (
+                !computeProbabilityMap(me.options.globalConcealing, globalName)
+              )
+                continue;
+
+              mapping = gen.generate();
+              globalMapping.set(globalName, mapping);
+            }
+
+            // Replace global reference with getGlobal("name")
+            const callExpression = t.callExpression(
+              t.identifier(globalFnName),
+              [t.stringLiteral(mapping)]
+            );
+
+            const { nativeFunctionName } = me.globalState.internals;
+
+            for (let path of paths) {
+              const replaceExpression = t.cloneNode(callExpression);
+              me.skip(replaceExpression);
+
+              if (
+                // Native Function will only be populated if tamper protection is enabled
+                nativeFunctionName &&
+                // Avoid maximum call stack error
+                !path.find((p) => p.node[MULTI_TRANSFORM] || me.isSkipped(p))
+              ) {
+                // First extract the member expression chain
+                let nameAndPropertyPath = [globalName];
+                let cursorPath = path;
+                let callExpressionPath: NodePath<t.CallExpression> | null =
+                  null;
+
+                const checkForCallExpression = () => {
+                  if (
+                    cursorPath.parentPath?.isCallExpression() &&
+                    cursorPath.key === "callee"
+                  ) {
+                    callExpressionPath = cursorPath.parentPath;
+                    return true;
+                  }
+                };
+
+                if (!checkForCallExpression()) {
+                  cursorPath = cursorPath?.parentPath;
+                  while (cursorPath?.isMemberExpression()) {
+                    let propertyString = getMemberExpressionPropertyAsString(
+                      cursorPath.node
+                    );
+                    if (!propertyString || typeof propertyString !== "string") {
+                      break;
+                    }
+
+                    nameAndPropertyPath.push(propertyString);
+
+                    if (checkForCallExpression()) break;
+                    cursorPath = cursorPath.parentPath;
+                  }
+                }
+
+                // Eligible member-expression/identifier
+                if (callExpressionPath) {
+                  // Check user's custom implementation
+                  var shouldTransform =
+                    me.obfuscator.shouldTransformNativeFunction(
+                      nameAndPropertyPath
+                    );
+                  if (shouldTransform) {
+                    path.replaceWith(replaceExpression);
+
+                    // console.log("Hello World") ->
+                    // checkNative(getGlobal("console")["log"])("Hello World")
+
+                    // Parent-most member expression must be wrapped
+                    // This to preserve proper 'this' binding in member expression invocations
+                    let callee = callExpressionPath.get(
+                      "callee"
+                    ) as NodePath<t.Expression>;
+                    let callArgs: t.Expression[] = [callee.node];
+
+                    if (callee.isMemberExpression()) {
+                      const additionalPropertyString =
+                        getMemberExpressionPropertyAsString(callee.node);
+                      ok(
+                        additionalPropertyString,
+                        "Expected additional property to be a string"
+                      );
+                      callee = callee.get("object");
+                      callArgs = [
+                        callee.node,
+                        t.stringLiteral(additionalPropertyString),
+                      ];
+                    }
+
+                    // Method supports two signatures:
+                    // checkNative(fetch)(...)
+                    // checkNative(console, "log")(...)
+
+                    callExpressionPath
+                      .get("callee")
+                      .replaceWith(
+                        me.skip(
+                          t.callExpression(
+                            t.identifier(nativeFunctionName),
+                            callArgs
                           )
                         )
-                      )
-                    ),
-                    BreakStatement(),
-                  ];
+                      );
+
+                    me.changeData.nativeFunctions++;
+                    continue;
+                  }
                 }
+              }
 
-                return SwitchCase(Literal(code), body);
-              })
-            ),
-            ReturnStatement(
-              MemberExpression(
-                Identifier(globalVar),
-                Identifier(returnName),
-                true
-              )
-            ),
-          ]
-        );
-
-        var tempVar = this.getPlaceholder();
-
-        var variableDeclaration = Template(`
-        var ${globalVar};
-        `).single();
-
-        variableDeclaration.declarations.push(
-          VariableDeclarator(
-            tempVar,
-            CallExpression(
-              MemberExpression(
-                FunctionExpression(
-                  [],
-                  [
-                    ...getGlobalVariableFn,
-                    Template(
-                      `return ${globalVar} = ${getGlobalVariableFnName}["call"](this)`
-                    ).single(),
-                  ]
-                ),
-                Literal("call"),
-                true
-              ),
-              []
-            )
-          )
-        );
+              me.changeData.globals++;
 
-        prepend(object, variableDeclaration);
-        append(object, functionDeclaration);
-      }
-    };
-  }
-}
+              // Regular replacement
+              // console -> getGlobal("console")
+              path.replaceWith(replaceExpression);
+            }
+          }
+
+          // No globals changed, no need to insert the getGlobal function
+          if (globalMapping.size === 0) return;
+
+          // The Global Concealing function returns the global variable from the specified parameter
+          const globalConcealingFunction = createGlobalConcealingFunction();
+
+          prepend(programPath, globalConcealingFunction);
+
+          const getGlobalVarFnName = me.getPlaceholder() + "_getGlobalVarFn";
+
+          // Insert the get global function
+          prepend(
+            programPath,
+            createGetGlobalTemplate(me, programPath).compile({
+              getGlobalFnName: getGlobalVarFnName,
+            })
+          );
+
+          // Call the get global function and store result in 'globalVarName'
+          prepend(
+            programPath,
+            new Template(
+              `var ${globalVarName} = ${getGlobalVarFnName}()`
+            ).single<t.Statement>()
+          );
+        },
+      },
+    },
+  };
+};