js-confuser 1.7.3 → 2.0.0-alpha.0

package/src/order.ts

@@ -1,16 +1,16 @@
 /**
  * Describes the order of transformations.
  */
-export enum ObfuscateOrder {
+export enum Order {
   Preparation = 0,
 
   ObjectExtraction = 1,
 
   Flatten = 2,
 
-  RGF = 3,
+  Lock = 3,
 
-  Lock = 4, // Includes Integrity & Anti Debug
+  RGF = 4,
 
   Dispatcher = 6,
 
@@ -18,10 +18,6 @@ export enum ObfuscateOrder {
 
   Calculator = 9,
 
-  ControlFlowFlattening = 10,
-
-  Eval = 11,
-
   GlobalConcealing = 12,
 
   OpaquePredicates = 13,
@@ -32,25 +28,29 @@ export enum ObfuscateOrder {
 
   StringCompression = 18,
 
-  Stack = 20,
+  VariableMasking = 20,
 
   DuplicateLiteralsRemoval = 22,
 
-  Shuffle = 24,
+  Shuffle = 23,
+
+  ControlFlowFlattening = 24,
 
-  NameRecycling = 25,
+  MovedDeclarations = 25,
 
-  MovedDeclarations = 26,
+  FunctionOutlining = 26,
 
   RenameLabels = 27,
 
   Minify = 28,
 
-  AntiTooling = 29,
+  AstScrambler = 29,
 
   RenameVariables = 30,
 
-  ES5 = 31,
-
   Finalizer = 35,
+
+  Pack = 36,
+
+  Integrity = 37, // Must run last
 }

package/src/presets.ts

@@ -1,27 +1,17 @@
 import { ObfuscateOptions } from "./options";
 
 /**
- * - High Obfuscation preset.
- * - **Average 90% performance reduction.**
+ * - High Obfuscation preset
  *
- * ## **`Enabled features`**
- * 1. Variable renaming
- * 2. Control flow obfuscation
- * 3. String concealing
- * 4. Opaque predicates
- * 5. Dead code
- * 6. Dispatcher
- * 7. Moved declarations
- * 8. Object extraction
- * 9. Global concealing
- * 10. Minified output
+ * **This preset is unsafe and may break your code.**
  *
- * ## **`Disabled features`**
- * - `rgf` Use at your own risk!
+ * Security risks:
  *
- * ### Potential Issues
- * 1. *String Encoding* can corrupt files. Disable `stringEncoding` manually if this happens.
- * 2. *Dead Code* can bloat file size. Reduce or disable `deadCode`.
+ * - Function constructor (`Pack`)
+ * - Escapes strict-mode constraints (`Pack`)
+ * - Use of `with` statement (`Control Flow Flattening`)
+ * - Object.prototype pollution (`Opaque Predicates`)
+ * - Bloats file size (`Dead Code` and `String Compression` can add up to 50kb)
  */
 const highPreset: ObfuscateOptions = {
   target: "node",
@@ -30,8 +20,8 @@ const highPreset: ObfuscateOptions = {
   calculator: true,
   compact: true,
   hexadecimalNumbers: true,
-  controlFlowFlattening: 0.75,
-  deadCode: 0.2,
+  controlFlowFlattening: 0.5,
+  deadCode: 0.25,
   dispatcher: true,
   duplicateLiteralsRemoval: 0.75,
   flatten: true,
@@ -43,20 +33,33 @@ const highPreset: ObfuscateOptions = {
   opaquePredicates: 0.75,
   renameVariables: true,
   renameGlobals: true,
-  shuffle: { hash: 0.5, true: 0.5 },
-  stack: true,
+  shuffle: true,
+  variableMasking: 0.75,
   stringConcealing: true,
   stringCompression: true,
   stringEncoding: true,
   stringSplitting: 0.75,
+  astScrambler: true,
+
+  // Experimental
+  // functionOutlining: false,
 
-  // Use at own risk
-  rgf: false,
+  // Security risks
+  pack: true,
 };
 
 /**
- * - Medium Obfuscation preset.
- * - Average 50% performance reduction.
+ * - Medium Obfuscation preset
+ *
+ * **This preset is unsafe and may break your code.**
+ *
+ * Security risks:
+ *
+ * - Function constructor (`Pack`)
+ * - Escapes strict-mode constraints (`Pack`)
+ * - Use of `with` statement (`Control Flow Flattening`)
+ * - Object.prototype pollution (`Opaque Predicates`)
+ * - Bloats file size (`Dead Code` can add up to 50kb)
  */
 const mediumPreset: ObfuscateOptions = {
   target: "node",
@@ -66,7 +69,7 @@ const mediumPreset: ObfuscateOptions = {
   compact: true,
   hexadecimalNumbers: true,
   controlFlowFlattening: 0.25,
-  deadCode: 0.025,
+  deadCode: 0.1,
   dispatcher: 0.5,
   duplicateLiteralsRemoval: 0.5,
   globalConcealing: true,
@@ -74,18 +77,21 @@ const mediumPreset: ObfuscateOptions = {
   minify: true,
   movedDeclarations: true,
   objectExtraction: true,
-  opaquePredicates: 0.5,
   renameVariables: true,
   renameGlobals: true,
   shuffle: true,
-  stack: 0.5,
+  variableMasking: 0.5,
   stringConcealing: true,
   stringSplitting: 0.25,
+  astScrambler: true,
+  pack: true,
 };
 
 /**
- * - Low Obfuscation preset.
- * - Average 30% performance reduction.
+ * - Low Obfuscation preset
+ *
+ * A balanced preset that provides basic obfuscation.
+ *
  */
 const lowPreset: ObfuscateOptions = {
   target: "node",
@@ -94,18 +100,17 @@ const lowPreset: ObfuscateOptions = {
   calculator: true,
   compact: true,
   hexadecimalNumbers: true,
-  controlFlowFlattening: 0.1,
-  deadCode: 0.01,
+  deadCode: 0.05,
   dispatcher: 0.25,
   duplicateLiteralsRemoval: 0.5,
   identifierGenerator: "randomized",
   minify: true,
   movedDeclarations: true,
   objectExtraction: true,
-  opaquePredicates: 0.1,
   renameVariables: true,
   renameGlobals: true,
   stringConcealing: true,
+  astScrambler: true,
 };
 
 /**

package/src/probability.ts

@@ -1,55 +1,37 @@
 import { ok } from "assert";
-import { createObject } from "./util/object";
-
-type Stringed<V> = (V extends string ? V : never) | "true" | "false";
-
-/**
- * Configurable probabilities for obfuscator options.
- * - **`false`** = this feature is disabled
- * - **`true`** = this feature is enabled, use default mode
- * - **`0.5`** = 50% chance
- * - **`"mode"`** = enabled, use specified mode
- * - **`["mode1", "mode2"]`** - enabled, choose random mode each occurrence
- * - **`{"mode1": 0.5, "mode2": 0.5}`** - enabled, choose based on specified probabilities
- * - **`{"mode1": 50, "mode2": 50}`** - enabled, each is divided based on total
- * - **`function(x){ return "custom_implementation" }`** - enabled, use specified function
- */
-export type ProbabilityMap<T> =
-  | false
-  | true
-  | number
-  | T
-  | T[]
-  | { [key in Stringed<T>]?: number }
-  | ((...params: any[]) => any);
+import { createObject } from "./utils/object-utils";
+import { ProbabilityMap } from "./options";
 
 /**
  * Evaluates a ProbabilityMap.
  * @param map The setting object.
- * @param runner Custom function to determine return value
  * @param customFnArgs Args given to user-implemented function, such as a variable name.
  */
-export function ComputeProbabilityMap<T>(
-  map: ProbabilityMap<T>,
-  runner: (mode?: T) => any = (x?: T) => x,
-  ...customFnArgs: any[]
-): any {
+export function computeProbabilityMap<
+  T,
+  F extends (...args: any[]) => any = (...args: any[]) => any
+>(
+  map: ProbabilityMap<T, F>,
+  ...customImplementationArgs: F extends (...args: infer P) => any ? P : never
+): boolean | string {
   if (!map) {
-    return runner();
+    return false;
   }
   if (map === true || map === 1) {
-    return runner(true as any);
+    return true;
   }
   if (typeof map === "number") {
-    return runner((Math.random() < map) as any);
+    return Math.random() < map;
   }
 
   if (typeof map === "function") {
-    return (map as any)(...customFnArgs);
+    return (map as Function)(...customImplementationArgs);
   }
+
   if (typeof map === "string") {
-    return runner(map);
+    return map;
   }
+
   var asObject: { [mode: string]: number } = {};
   if (Array.isArray(map)) {
     map.forEach((x: any) => {
@@ -70,7 +52,7 @@ export function ComputeProbabilityMap<T>(
   var count = 0;
   var winner = null;
   Object.keys(percentages).forEach((key) => {
-    var x = parseFloat(percentages[key]);
+    var x = Number(percentages[key]);
 
     if (ticket >= count && ticket < count + x) {
       winner = key;
@@ -78,7 +60,7 @@ export function ComputeProbabilityMap<T>(
     count += x;
   });
 
-  return runner(winner);
+  return winner;
 }
 
 /**
@@ -111,6 +93,9 @@ export function isProbabilityMapProbable<T>(map: ProbabilityMap<T>): boolean {
     }
   }
   if (typeof map === "object") {
+    if (map instanceof Date) return true;
+    if (map instanceof RegExp) return true;
+
     var keys = Object.keys(map);
     ok(
       keys.length != 0,

package/src/templates/bufferToStringTemplate.ts

@@ -0,0 +1,57 @@
+import Template from "./template";
+
+export const BufferToStringTemplate = new Template(`
+  {GetGlobalTemplate}
+
+  var __globalObject = {getGlobalFnName}() || {};
+  var __TextDecoder = __globalObject["TextDecoder"];
+  var __Uint8Array = __globalObject["Uint8Array"];
+  var __Buffer = __globalObject["Buffer"];
+  var __String = __globalObject["String"] || String;
+  var __Array = __globalObject["Array"] || Array;
+
+  var utf8ArrayToStr = (function () {
+    var charCache = new __Array(128);  // Preallocate the cache for the common single byte chars
+    var charFromCodePt = __String["fromCodePoint"] || __String["fromCharCode"];
+    var result = [];
+
+    return function (array) {
+        var codePt;
+        var byte1;
+        var buffLen = array["length"];
+
+        result["length"] = 0;
+
+        for (var i = 0; i < buffLen;) {
+            byte1 = array[i++];
+
+            if (byte1 <= 0x7F) {
+                codePt = byte1;
+            } else if (byte1 <= 0xDF) {
+                codePt = ((byte1 & 0x1F) << 6) | (array[i++] & 0x3F);
+            } else if (byte1 <= 0xEF) {
+                codePt = ((byte1 & 0x0F) << 12) | ((array[i++] & 0x3F) << 6) | (array[i++] & 0x3F);
+            } else if (__String["fromCodePoint"]) {
+                codePt = ((byte1 & 0x07) << 18) | ((array[i++] & 0x3F) << 12) | ((array[i++] & 0x3F) << 6) | (array[i++] & 0x3F);
+            } else {
+                codePt = 63;    // Cannot convert four byte code points, so use "?" instead
+                i += 3;
+            }
+
+            result["push"](charCache[codePt] || (charCache[codePt] = charFromCodePt(codePt)));
+        }
+
+        return result["join"]('');
+    };
+  })();
+
+  function {BufferToString}(buffer){
+    if(typeof __TextDecoder !== "undefined" && __TextDecoder) {
+      return new __TextDecoder()["decode"](new __Uint8Array(buffer));
+    } else if(typeof __Buffer !== "undefined" && __Buffer) {
+      return __Buffer["from"](buffer)["toString"]("utf-8");
+    } else {          
+      return utf8ArrayToStr(buffer);
+    }
+  }
+`);