node-automator 1.0.5 → 1.2.0

package/commands/deobfuscate.js

@@ -0,0 +1,15 @@
+const { deobfuscate } = require('../utils/deobfuscator');
+const { BaseCommand } = require("./base");
+
+class DeobfuscateCommand extends BaseCommand {
+    async execute() {
+        return deobfuscate(this.content, this.selfData.sourceType, this.selfData.config);
+    }
+    getRequireContent() {
+        return true;
+    }
+}
+
+module.exports = {
+    DeobfuscateCommand,
+};

package/commands/mgr.js

@@ -113,6 +113,8 @@ const { AssertCommand } = require('./assert');
 const { SvnAddCommand } = require('./svn_add');
 const { ImageCropCommand } = require('./image_crop');
 const { CursorUpCommand } = require('./cursor_up');
+const { RegisterSearchInstallLocationCommand } = require('./register_search_install_location');
+const { DeobfuscateCommand } = require('./deobfuscate');
 
 const globalData = {
     "executed_cfg": [], // 执行过的配置文件
@@ -467,6 +469,8 @@ function init() {
     register("svn_add", SvnAddCommand, false);
     register("image_crop", ImageCropCommand, false);
     register("cursor_up", CursorUpCommand, false);
+    register("register_search_install_location", RegisterSearchInstallLocationCommand, false);
+    register("deobfuscate", DeobfuscateCommand, false);
 }
 
 module.exports = {

package/commands/register_search_install_location.js

@@ -0,0 +1,12 @@
+const { registerSearchInstallLocation } = require('../utils/reg_tool');
+const { BaseCommand } = require("./base");
+
+class RegisterSearchInstallLocationCommand extends BaseCommand {
+    async execute() {
+        return registerSearchInstallLocation(this.selfData.target);
+    }
+}
+
+module.exports = {
+    RegisterSearchInstallLocationCommand,
+};

package/commands/which.js

@@ -1,57 +1,16 @@
+const { warn } = require('../utils/log_tool');
+const { registerSearchInstallLocation } = require('../utils/reg_tool');
+const { which } = require('../utils/which_tool');
 const { BaseCommand } = require("./base");
-const { exec_shell } = require('../utils/shell_tool');
-const { get_fst_file } = require("../utils/file_tool");
-const path = require("path");
-const fs = require("fs");
-const { warn } = require("../utils/log_tool");
+
 
 class WhichCommand extends BaseCommand {
     async execute() {
-        let cmd;
-        switch (process.platform) {
-            case "win32": {
-                cmd = "where";
-                break;
-            }
-            default: {
-                cmd = "which";
-                break;
-            }
-        }
-
-        let file;
-        let stdout = await exec_shell({
-            cmd: `${cmd} ${this.selfData.target}`,
-            capture_stdout: true,
-            ignore_code: true,
-        });
-        if (stdout) {
-            /** @type {string[]} */
-            let files = stdout.split(/[\r\n]{1,2}/);
-            files = files.filter(v => v && v.trim());
-            // windows系统下，优先选择有 .cmd 或者 .exe
-            if (process.platform === "win32") { 
-                let preferExts = ['.exe', '.cmd'];
-                files.sort((a, b) => {
-                    let exta = path.extname(a);
-                    let extb = path.extname(b);
-                    if (preferExts.includes(exta)) {
-                        return -1;
-                    } else if (preferExts.includes(extb)) {
-                        return 1;
-                    }
-                    return 0;
-                });
-            }
-            file = get_fst_file(files);
-            if (file) {
-                file = fs.realpathSync(file);
-            }
-        }
-        if (!file) {
-            warn(`未找到 ${this.selfData.target}`);
+        let result = await which(this.selfData.target);
+        if (!result) {
+          warn(`未找到 ${this.selfData.target}`);
         }
-        return file;
+        return result;
     }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-automator",
-  "version": "1.0.5",
+  "version": "1.2.0",
   "description": "Execute automation with yaml configuration(compatible with json)",
   "main": "index.js",
   "repository": {
@@ -59,6 +59,11 @@
     "xmldom": "^0.4.0",
     "yaml": "^1.10.0",
     "yamljs": "^0.3.0",
-    "yargs": "^16.2.0"
+    "yargs": "^16.2.0",
+    "@babel/generator": "^7.22.3",
+    "@babel/parser": "^7.22.4",
+    "@babel/traverse": "^7.22.4",
+    "@babel/types": "^7.22.4",
+    "@types/node": "^20.2.5"
   }
 }

package/utils/deobfuscator/deobfuscator.js

@@ -0,0 +1,97 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Deobfuscator = void 0;
+const generator_1 = __importDefault(require("@babel/generator"));
+const traverse_1 = __importDefault(require("@babel/traverse"));
+const config_1 = require("./transformations/config");
+const objectSimplifier_1 = require("./transformations/objects/objectSimplifier");
+const proxyFunctionInliner_1 = require("./transformations/proxyFunctions/proxyFunctionInliner");
+const unusedVariableRemover_1 = require("./transformations/variables/unusedVariableRemover");
+const constantPropagator_1 = require("./transformations/variables/constantPropagator");
+const reassignmentRemover_1 = require("./transformations/variables/reassignmentRemover");
+const stringRevealer_1 = require("./transformations/strings/stringRevealer");
+const deadBranchRemover_1 = require("./transformations/controlFlow/deadBranchRemover");
+const sequenceSplitter_1 = require("./transformations/controlFlow/sequenceSplitter");
+const propertySimplifier_1 = require("./transformations/properties/propertySimplifier");
+const expressionSimplifier_1 = require("./transformations/expressions/expressionSimplifier");
+const controlFlowRecoverer_1 = require("./transformations/controlFlow/controlFlowRecoverer");
+const objectPacker_1 = require("./transformations/objects/objectPacker");
+class Deobfuscator {
+    /**
+     * Creates a new deobfuscator.
+     * @param ast The AST.
+     * @param config The config (optional).
+     */
+    constructor(ast, config = config_1.defaultConfig) {
+        this.transformationTypes = [
+            unusedVariableRemover_1.UnusedVariableRemover,
+            constantPropagator_1.ConstantPropgator,
+            reassignmentRemover_1.ReassignmentRemover,
+            deadBranchRemover_1.DeadBranchRemover,
+            objectPacker_1.ObjectPacker,
+            proxyFunctionInliner_1.ProxyFunctionInliner,
+            expressionSimplifier_1.ExpressionSimplifier,
+            sequenceSplitter_1.SequenceSplitter,
+            controlFlowRecoverer_1.ControlFlowRecoverer,
+            propertySimplifier_1.PropertySimplifier,
+            objectSimplifier_1.ObjectSimplifier,
+            stringRevealer_1.StringRevealer
+        ];
+        this.ast = ast;
+        this.config = config;
+    }
+    /**
+     * Executes the deobfuscator.
+     * @returns The simplified code.
+     */
+    execute() {
+        let types = this.transformationTypes.filter(t => this.config[t.properties.key].isEnabled);
+        let i = 0;
+        while (i < Deobfuscator.MAX_ITERATIONS) {
+            let isModified = false;
+            if (!this.config.silent) {
+                console.log(`\n[${new Date().toISOString()}]: Starting pass ${i + 1}`);
+            }
+            for (const type of types) {
+                const transformationConfig = this.config[type.properties.key];
+                const transformation = new type(this.ast, transformationConfig);
+                if (!this.config.silent) {
+                    console.log(`[${new Date().toISOString()}]: Executing ${transformation.constructor.name}`);
+                }
+                let modified = false;
+                try {
+                    modified = transformation.execute(console.log.bind(console, `[${transformation.constructor.name}]:`));
+                }
+                catch (err) {
+                    console.log(`Error: ${err}`);
+                }
+                if (modified) {
+                    isModified = true;
+                }
+                if (!this.config.silent) {
+                    console.log(`[${new Date().toISOString()}]: Executed ${transformation.constructor.name}, modified ${modified}`);
+                }
+                if (type.properties.rebuildScopeTree) {
+                    this.clearCache();
+                }
+            }
+            i++;
+            if (!isModified) {
+                break;
+            }
+        }
+        return (0, generator_1.default)(this.ast, { jsescOption: { minimal: true } }).code;
+    }
+    /**
+     * Clears the traversal cache to force the scoping to be handled
+     * again on the next traverse.
+     */
+    clearCache() {
+        traverse_1.default.cache.clear();
+    }
+}
+exports.Deobfuscator = Deobfuscator;
+Deobfuscator.MAX_ITERATIONS = 50;

package/utils/deobfuscator/helpers/declaration.js

@@ -0,0 +1,57 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isDeclarationOrAssignmentExpression = exports.isDeclarationOrAssignmentStatement = void 0;
+const t = __importStar(require("@babel/types"));
+/**
+ * Checks whether a node is a variable declaration or assignment expression
+ * within an expression statement that is initialising a variable that
+ * satisfies the provided constraints.
+ * @param node The AST node.
+ * @param isId The function that determines whether the variable being declared matches.
+ * @param isValue The function that determines whether the value the variable is initialised to matches.
+ * @returns Whether.
+ */
+function isDeclarationOrAssignmentStatement(node, isId, isValue) {
+    return ((t.isVariableDeclaration(node) &&
+        node.declarations.length == 1 &&
+        isId(node.declarations[0].id) &&
+        node.declarations[0].init &&
+        isValue(node.declarations[0].init)) ||
+        (t.isExpressionStatement(node) &&
+            t.isAssignmentExpression(node.expression) &&
+            isId(node.expression.left) &&
+            isValue(node.expression.right)));
+}
+exports.isDeclarationOrAssignmentStatement = isDeclarationOrAssignmentStatement;
+function isDeclarationOrAssignmentExpression(node, isId, isValue) {
+    return ((t.isVariableDeclaration(node) &&
+        node.declarations.length == 1 &&
+        isId(node.declarations[0].id) &&
+        node.declarations[0].init &&
+        isValue(node.declarations[0].init)) ||
+        (t.isAssignmentExpression(node) && isId(node.left) && isValue(node.right)));
+}
+exports.isDeclarationOrAssignmentExpression = isDeclarationOrAssignmentExpression;

package/utils/deobfuscator/helpers/expression.js

@@ -0,0 +1,36 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isNegativeNumericLiteral = void 0;
+const t = __importStar(require("@babel/types"));
+/**
+ * Returns whether a node is a unary expression that represents a negative number.
+ * @param node The AST node.
+ * @returns Whether.
+ */
+function isNegativeNumericLiteral(node) {
+    return t.isUnaryExpression(node) && node.operator == '-' && t.isNumericLiteral(node.argument);
+}
+exports.isNegativeNumericLiteral = isNegativeNumericLiteral;

package/utils/deobfuscator/helpers/misc.js

@@ -0,0 +1,38 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getProperty = exports.setProperty = exports.copyExpression = void 0;
+const generator_1 = __importDefault(require("@babel/generator"));
+/**
+ * Copies an expression.
+ * @param expression The expression.
+ * @returns The copy.
+ */
+const copyExpression = (expression) => {
+    const parseExpression = globalThis.parser
+        .parseExpression;
+    return parseExpression((0, generator_1.default)(expression).code);
+};
+exports.copyExpression = copyExpression;
+/**
+ * Sets a property on an object.
+ * @param obj The object.
+ * @param property The property key.
+ * @param value The value.
+ */
+const setProperty = (obj, property, value) => {
+    obj.property = value;
+};
+exports.setProperty = setProperty;
+/**
+ * Gets the value of a property on an object.
+ * @param obj The object.
+ * @param property The property key.
+ * @returns
+ */
+const getProperty = (obj, property) => {
+    return obj.property;
+};
+exports.getProperty = getProperty;

package/utils/deobfuscator/helpers/strings/decoders/base64StringDecoder.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Base64StringDecoder = void 0;
+const util_1 = require("../util/util");
+const stringDecoder_1 = require("./stringDecoder");
+class Base64StringDecoder extends stringDecoder_1.StringDecoder {
+    /**
+     * Creates a new base 64 string decoder.
+     * @param stringArray The string array.
+     * @param indexOffset The offset used when accessing elements by index.
+     */
+    constructor(stringArray, indexOffset) {
+        super(stringArray, indexOffset);
+        this.stringCache = new Map();
+    }
+    /**
+     * Returns the type of the decoder.
+     */
+    get type() {
+        return stringDecoder_1.DecoderType.BASE_64;
+    }
+    /**
+     * Decodes a string.
+     * @param index The index.
+     * @returns The string.
+     */
+    getString(index) {
+        const cacheKey = index + this.stringArray[0];
+        if (this.stringCache.has(cacheKey)) {
+            return this.stringCache.get(cacheKey);
+        }
+        const encoded = this.stringArray[index + this.indexOffset];
+        const str = (0, util_1.base64Transform)(encoded);
+        this.stringCache.set(cacheKey, str);
+        return str;
+    }
+    /**
+     * Decodes a string for the rotate string call.
+     * @param index The index.
+     * @returns THe string.
+     */
+    getStringForRotation(index) {
+        if (this.isFirstCall) {
+            this.isFirstCall = false;
+            throw new Error();
+        }
+        return this.getString(index);
+    }
+}
+exports.Base64StringDecoder = Base64StringDecoder;

package/utils/deobfuscator/helpers/strings/decoders/basicStringDecoder.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BasicStringDecoder = void 0;
+const stringDecoder_1 = require("./stringDecoder");
+class BasicStringDecoder extends stringDecoder_1.StringDecoder {
+    /**
+     * Returns the type of the decoder.
+     */
+    get type() {
+        return stringDecoder_1.DecoderType.BASIC;
+    }
+    /**
+     * Decodes a string.
+     * @param index The index.
+     */
+    getString(index) {
+        return this.stringArray[index + this.indexOffset];
+    }
+    /**
+     * Decodes a string for the rotate string call.
+     * @param index The index.
+     * @returns THe string.
+     */
+    getStringForRotation(index) {
+        return this.getString(index);
+    }
+}
+exports.BasicStringDecoder = BasicStringDecoder;

package/utils/deobfuscator/helpers/strings/decoders/rc4StringDecoder.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Rc4StringDecoder = void 0;
+const util_1 = require("../util/util");
+const stringDecoder_1 = require("./stringDecoder");
+class Rc4StringDecoder extends stringDecoder_1.StringDecoder {
+    /**
+     * Creates a new RC4 string decoder.
+     * @param stringArray The string array.
+     * @param indexOffset The offset used when accessing elements by index.
+     */
+    constructor(stringArray, indexOffset) {
+        super(stringArray, indexOffset);
+        this.stringCache = new Map();
+    }
+    /**
+     * Returns the type of the decoder.
+     */
+    get type() {
+        return stringDecoder_1.DecoderType.RC4;
+    }
+    /**
+     * Decodes a string.
+     * @param index The index.
+     */
+    getString(index, key) {
+        const cacheKey = index + this.stringArray[0];
+        if (this.stringCache.has(cacheKey)) {
+            return this.stringCache.get(cacheKey);
+        }
+        const encoded = this.stringArray[index + this.indexOffset];
+        const str = this.rc4Decode(encoded, key);
+        this.stringCache.set(cacheKey, str);
+        return str;
+    }
+    /**
+     * Decodes a string for the rotate string call.
+     * @param index The index.
+     * @returns THe string.
+     */
+    getStringForRotation(index, key) {
+        if (this.isFirstCall) {
+            this.isFirstCall = false;
+            throw new Error();
+        }
+        return this.getString(index, key);
+    }
+    /**
+     * Decodes a string encoded with RC4.
+     * @param str The RC4 encoded string.
+     * @param key The key.
+     * @returns The decoded string.
+     */
+    rc4Decode(str, key) {
+        const s = [];
+        let j = 0;
+        let decoded = '';
+        str = (0, util_1.base64Transform)(str);
+        for (var i = 0; i < 256; i++) {
+            s[i] = i;
+        }
+        for (var i = 0; i < 256; i++) {
+            j = (j + s[i] + key.charCodeAt(i % key.length)) % 256;
+            [s[i], s[j]] = [s[j], s[i]];
+        }
+        i = 0;
+        j = 0;
+        for (let y = 0; y < str.length; y++) {
+            i = (i + 1) % 256;
+            j = (j + s[i]) % 256;
+            [s[i], s[j]] = [s[j], s[i]];
+            decoded += String.fromCharCode(str.charCodeAt(y) ^ s[(s[i] + s[j]) % 256]);
+        }
+        return decoded;
+    }
+}
+exports.Rc4StringDecoder = Rc4StringDecoder;

package/utils/deobfuscator/helpers/strings/decoders/stringDecoder.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DecoderType = exports.StringDecoder = void 0;
+class StringDecoder {
+    /**
+     * Creates a new string decoder.
+     * @param stringArray The string array.
+     * @param indexOffset The offset used when accessing elements by index.
+     */
+    constructor(stringArray, indexOffset) {
+        this.stringArray = stringArray;
+        this.indexOffset = indexOffset;
+        this.isFirstCall = true;
+    }
+}
+exports.StringDecoder = StringDecoder;
+var DecoderType;
+(function (DecoderType) {
+    DecoderType["BASIC"] = "BASIC";
+    DecoderType["BASE_64"] = "BASE_64";
+    DecoderType["RC4"] = "RC4";
+})(DecoderType || (exports.DecoderType = DecoderType = {}));