mojic 1.2.5 → 2.1.1

package/bin/mojic.js

@@ -9,10 +9,12 @@ import { Transform } from 'stream';
 import { StringDecoder } from 'string_decoder';
 import { CipherEngine } from '../lib/CipherEngine.js';
 
+const VERSION = '2.1.1';
+
 program
     .name('mojic')
     .description('Obfuscate C source code into emojis')
-    .version('1.2.5')
+    .version(VERSION)
     .addHelpCommand('help [command]', 'Display help for command')
     .showHelpAfterError();
 
@@ -119,7 +121,7 @@ program
                 throw new Error(`'${targetPath}' is a directory. Use -r to process recursively.`);
             }
 
-            console.log(chalk.blue('Initiating Mojic Encryption v1.2...'));
+            console.log(chalk.blue(`Initiating Mojic Encryption v${VERSION}...`));
             if (options.flat) console.log(chalk.yellow('   -> Structural Flattening Enabled'));
 
             const password = await promptPassword('Create password for file(s):');

package/lib/CipherEngine.js

@@ -3,12 +3,15 @@ import { Transform } from 'stream';
 import { StringDecoder } from 'string_decoder';
 
 /**
- * MOJIC v1.2.5 CIPHER ENGINE
- * "Operation Polymorphic Chaos"
+ * MOJIC v2.1.1 CIPHER ENGINE
+ * "Operation Ironclad"
+ * * Security Upgrades:
+ * - KDF: Upgraded from PBKDF2 to Scrypt (Memory-Hard, GPU-Resistant)
+ * - PRNG: Upgraded from Xoshiro256** to AES-256-CTR (Cryptographically Secure)
+ * - Auth: Extended Key material for higher entropy
  * * Fixes:
- * - Word Boundaries: Prevents splitting variables like 'secretCode'
- * - Regex: correctly handles #directives vs keywords
- * - Tokenization: Handles combined graphemes (skin tones/modifiers) during decryption
+ * - Polymorphic Data: Added XOR Whitening to raw data chunks to hide patterns (e.g., repeating whitespace).
+ * - RNG Buffering: Fixed potential byte loss in AES-CTR buffer refill.
  */
 
 // --- EMOJI UNIVERSE GENERATION ---
@@ -33,7 +36,7 @@ const generateUniverse = () => {
             }
         }
     }
-    return universe; // Expect > 1100 chars
+    return universe; 
 };
 
 const RAW_UNIVERSE = generateUniverse();
@@ -50,41 +53,50 @@ const C_KEYWORDS = [
     'include', 'define', 'main', 'printf', 'NULL', '#include', '#define'
 ];
 
-// --- PRNG: Xoshiro256** ---
-class Xoshiro256 {
-    constructor(seedBuffer) {
-        if (seedBuffer.length < 32) throw new Error("Seed too short");
-        this.s = [
-            seedBuffer.readBigUInt64BE(0),
-            seedBuffer.readBigUInt64BE(8),
-            seedBuffer.readBigUInt64BE(16),
-            seedBuffer.readBigUInt64BE(24)
-        ];
+// --- PRNG: AES-256-CTR (CSPRNG) ---
+// Replaces Xoshiro with a cryptographically secure stream
+class AesCounterRNG {
+    constructor(key, iv) {
+        if (key.length !== 32 || iv.length !== 16) throw new Error("Invalid seed length for AES-RNG");
+        this.cipher = crypto.createCipheriv('aes-256-ctr', key, iv);
+        this.buffer = Buffer.alloc(0);
+        
+        // Encrypt an initial block of zeros to start the keystream
+        this._refill();
     }
 
-    next() {
-        const result = this.rotl(this.s[1] * 5n, 7n) * 9n;
-        const t = this.s[1] << 17n;
-
-        this.s[2] ^= this.s[0];
-        this.s[3] ^= this.s[1];
-        this.s[1] ^= this.s[2];
-        this.s[0] ^= this.s[3];
+    _refill() {
+        // Generate 1KB of random keystream at a time
+        const zeros = Buffer.alloc(1024); 
+        const newBytes = this.cipher.update(zeros);
+        // Correctly concatenate new bytes to existing buffer to prevent data loss
+        this.buffer = Buffer.concat([this.buffer, newBytes]);
+    }
 
-        this.s[2] ^= t;
-        this.s[3] = this.rotl(this.s[3], 45n);
+    next() {
+        if (this.buffer.length < 8) this._refill();
+        
+        // Read 64 bits (BigInt) to match previous interface
+        const val = this.buffer.readBigUInt64BE(0);
+        this.buffer = this.buffer.subarray(8);
+        return val;
+    }
 
-        return result; 
+    nextBytes(length) {
+        if (this.buffer.length < length) this._refill();
+        
+        // Return a Buffer of requested length
+        const bytes = this.buffer.subarray(0, length);
+        this.buffer = this.buffer.subarray(length);
+        return bytes;
     }
 
     nextFloat() {
+        // Convert uint64 to double [0, 1)
+        // We take upper 53 bits for standard double precision
         const val = Number(this.next() >> 11n);
         return val * (2 ** -53); 
     }
-
-    rotl(x, k) {
-        return (x << k) | (x >> (64n - k));
-    }
 }
 
 export class CipherEngine {
@@ -96,24 +108,31 @@ export class CipherEngine {
         this.dataReverseMap = new Map(); 
         this.isReady = false;
         this.hmac = null; 
-        this.lineLength = 0; // For wrapping
+        this.lineLength = 0;
     }
 
     async init(existingSaltHex = null, expectedAuthCheck = null) {
         this.salt = existingSaltHex 
             ? Buffer.from(existingSaltHex, 'hex') 
-            : crypto.randomBytes(16);
+            : crypto.randomBytes(32); // Increased salt size to 32 bytes
 
+        // SECURITY UPGRADE: Scrypt instead of PBKDF2
+        // N=16384, r=8, p=1 are standard secure defaults
         const derivedKey = await new Promise((resolve, reject) => {
-            crypto.pbkdf2(this.password, this.salt, 100000, 64, 'sha512', (err, key) => {
+            crypto.scrypt(this.password, this.salt, 80, { N: 16384, r: 8, p: 1 }, (err, key) => {
                 if (err) reject(err); else resolve(key);
             });
         });
 
-        const seedBuffer = derivedKey.subarray(0, 32);
-        this.authKey = derivedKey.subarray(32, 64);
+        // Split 80 bytes of key material:
+        // 0-32:   AES Key (32 bytes)
+        // 32-48:  AES IV (16 bytes)
+        // 48-80:  HMAC Auth Key (32 bytes)
+        
+        const rngKey = derivedKey.subarray(0, 32);
+        const rngIv = derivedKey.subarray(32, 48);
+        this.authKey = derivedKey.subarray(48, 80);
         
-        // Check password correctness immediately if Auth Check is provided
         if (expectedAuthCheck) {
             const calculatedAuthCheck = this.authKey.subarray(0, 4).toString('hex');
             if (calculatedAuthCheck !== expectedAuthCheck) {
@@ -121,7 +140,8 @@ export class CipherEngine {
             }
         }
 
-        this.rng = new Xoshiro256(seedBuffer);
+        // Initialize CSPRNG
+        this.rng = new AesCounterRNG(rngKey, rngIv);
 
         const shuffled = this._shuffleArray([...RAW_UNIVERSE]);
 
@@ -146,6 +166,7 @@ export class CipherEngine {
     }
 
     _shuffleArray(array) {
+        // Fisher-Yates shuffle using CSPRNG
         for (let i = array.length - 1; i > 0; i--) {
             const j = Math.floor(this.rng.nextFloat() * (i + 1));
             [array[i], array[j]] = [array[j], array[i]];
@@ -176,9 +197,16 @@ export class CipherEngine {
             hexString += index.toString(16);
         }
         
+        // Salt is now variable length (usually 32 bytes = 64 hex chars), 
+        // AuthCheck is always last 4 bytes (8 hex chars)
+        const totalLen = hexString.length;
+        if (totalLen < 8) throw new Error("Header too short");
+
+        const authStart = totalLen - 8;
+        
         return { 
-            saltHex: hexString.substring(0, 32),
-            authCheckHex: hexString.length >= 40 ? hexString.substring(32, 40) : null
+            saltHex: hexString.substring(0, authStart),
+            authCheckHex: hexString.substring(authStart)
         };
     }
 
@@ -193,11 +221,9 @@ export class CipherEngine {
             transform(chunk, encoding, callback) {
                 const str = chunk.toString('utf8');
                 
-                // Separate alpha keywords (int, void) from symbols (#include)
                 const alphaKeywords = C_KEYWORDS.filter(k => /^\w+$/.test(k)).sort((a,b)=>b.length-a.length).join('|');
                 const symKeywords = C_KEYWORDS.filter(k => !/^\w+$/.test(k)).map(k => k.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|');
                 
-                // Match: \b(int|void)\b  OR  (#include)
                 const regex = new RegExp(`(\\b(?:${alphaKeywords})\\b|(?:${symKeywords}))`, 'g');
                 
                 const parts = str.split(regex); 
@@ -227,7 +253,12 @@ export class CipherEngine {
                             const chunk = buffer.subarray(0, 5);
                             buffer = buffer.subarray(5);
                             
-                            const enc = engine._encodeBase1024(chunk);
+                            // XOR Whitening: Hide patterns (like spaces) by XORing with RNG stream
+                            const mask = engine.rng.nextBytes(5);
+                            const maskedChunk = Buffer.alloc(5);
+                            for(let i=0; i<5; i++) maskedChunk[i] = chunk[i] ^ mask[i];
+
+                            const enc = engine._encodeBase1024(maskedChunk);
                             engine.hmac.update(enc);
                             this.push(engine._wrapOutput(enc));
                         }
@@ -240,7 +271,13 @@ export class CipherEngine {
                 if (buffer.length > 0) {
                     const padded = Buffer.alloc(5);
                     buffer.copy(padded);
-                    const enc = engine._encodeBase1024(padded);
+                    
+                    // XOR Whitening for final block
+                    const mask = engine.rng.nextBytes(5);
+                    const maskedChunk = Buffer.alloc(5);
+                    for(let i=0; i<5; i++) maskedChunk[i] = padded[i] ^ mask[i];
+
+                    const enc = engine._encodeBase1024(maskedChunk);
                     engine.hmac.update(enc);
                     this.push(engine._wrapOutput(enc));
                 }
@@ -288,7 +325,13 @@ export class CipherEngine {
         if (buf.length === 0) return Buffer.alloc(0);
         const padded = Buffer.alloc(5);
         buf.copy(padded);
-        const enc = this._encodeBase1024(padded);
+
+        // XOR Whitening
+        const mask = this.rng.nextBytes(5);
+        const maskedChunk = Buffer.alloc(5);
+        for(let i=0; i<5; i++) maskedChunk[i] = padded[i] ^ mask[i];
+
+        const enc = this._encodeBase1024(maskedChunk);
         this.hmac.update(enc);
         return this._wrapOutput(enc);
     }
@@ -309,11 +352,8 @@ export class CipherEngine {
                 const segments = [...segmenter.segment(str)];
                 
                 for (const { segment } of segments) {
-                    if (segment.match(/\s/)) continue; // Skip wraps
+                    if (segment.match(/\s/)) continue; 
 
-                    // FIX: Some emojis in the universe (like skin tones 0x1F3FB) are modifiers.
-                    // If they appear next to another emoji, Intl.Segmenter merges them.
-                    // We must split them back into atomic code points to preserve token count.
                     const atoms = [...segment];
 
                     for (const atom of atoms) {
@@ -322,7 +362,6 @@ export class CipherEngine {
                         if (emojiBuffer.length > FOOTER_LEN) {
                             const emo = emojiBuffer.shift();
                             engine._processDecryptToken(emo, this);
-                            // Feed actual atomic tokens to HMAC to match encryption
                             engine.hmac.update(Buffer.from(emo));
                         }
                     }
@@ -373,7 +412,6 @@ export class CipherEngine {
             const originalEmo = this.keywordEmojis[baseIdx];
             const keyword = this.keywordReverseMap.get(originalEmo);
             
-            // Safety: This buffer should be empty if the stream is synced.
             if (this.decodeDataBuf.length > 0) {
                 this.decodeDataBuf = [];
             }
@@ -383,8 +421,17 @@ export class CipherEngine {
         } else if (this.dataReverseMap.has(emo)) {
             this.decodeDataBuf.push(this.dataReverseMap.get(emo));
             if (this.decodeDataBuf.length === 4) {
-                const chunk = this._decodeBase1024(this.decodeDataBuf);
+                // We have a full encoded chunk (4 emojis)
+                const maskedChunk = this._decodeBase1024(this.decodeDataBuf);
                 this.decodeDataBuf = [];
+                
+                // Get mask from RNG (Synchronized with encryption)
+                const mask = this.rng.nextBytes(5);
+                const chunk = Buffer.alloc(5);
+                
+                // XOR Back to get plaintext
+                for(let i=0; i<5; i++) chunk[i] = maskedChunk[i] ^ mask[i];
+
                 const cleanChunk = chunk.filter(b => b !== 0x00);
                 stream.push(cleanChunk);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mojic",
-  "version": "1.2.5",
+  "version": "2.1.1",
   "description": "Obfuscate C source code into encrypted, password-seeded emoji streams.",
   "main": "bin/mojic.js",
   "bin": {
@@ -20,6 +20,7 @@
     "access": "public"
   },
   "dependencies": {
+    "@notamitgamer/mojic": "^1.2.5",
     "chalk": "^5.3.0",
     "commander": "^11.1.0",
     "inquirer": "^9.2.12"