node-automator 1.0.5 → 1.2.0

package/utils/deobfuscator/transformations/objects/objectPacker.js

@@ -0,0 +1,125 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ObjectPacker = void 0;
+const t = __importStar(require("@babel/types"));
+const variable_1 = require("../../helpers/variable");
+const transformation_1 = require("../transformation");
+const traverse_1 = __importDefault(require("@babel/traverse"));
+class ObjectPacker extends transformation_1.Transformation {
+    /**
+     * Executes the transformation.
+     * @param log The log function.
+     */
+    execute(log) {
+        const self = this;
+        (0, traverse_1.default)(this.ast, {
+            enter(path) {
+                const variable = (0, variable_1.findConstantVariable)(path, isEmptyObjectExpression);
+                if (!variable) {
+                    return;
+                }
+                const parentPath = path.getStatementParent();
+                if (!parentPath ||
+                    parentPath.parentPath == undefined ||
+                    typeof parentPath.key != 'number') {
+                    return;
+                }
+                const statements = parentPath.parentPath.node[parentPath.parentKey];
+                let numRemoved = 0;
+                for (let i = parentPath.key + 1; i < statements.length; i++) {
+                    const node = statements[i];
+                    if (t.isExpressionStatement(node) &&
+                        self.isPropertyAssignment(node.expression, variable.name)) {
+                        // replace multiple properties assigned in same statement
+                        if (self.isPropertyAssignment(node.expression.right, variable.name)) {
+                            const properties = [node.expression.left];
+                            let right = node.expression.right;
+                            while (self.isPropertyAssignment(right, variable.name)) {
+                                properties.push(right.left);
+                                right = right.right;
+                            }
+                            // don't duplicate expressions with side effects
+                            if (!t.isLiteral(right)) {
+                                return;
+                            }
+                            for (const { property } of properties) {
+                                const isComputed = !t.isStringLiteral(property) &&
+                                    !t.isNumericLiteral(property) &&
+                                    !t.isIdentifier(property);
+                                const objectProperty = t.objectProperty(property, right, isComputed);
+                                variable.expression.properties.push(objectProperty);
+                                self.setChanged();
+                                numRemoved++;
+                            }
+                        }
+                        else {
+                            const key = node.expression.left.property;
+                            const isComputed = !t.isStringLiteral(key) &&
+                                !t.isNumericLiteral(key) &&
+                                !t.isIdentifier(key);
+                            const property = t.objectProperty(key, node.expression.right, isComputed);
+                            variable.expression.properties.push(property);
+                            self.setChanged();
+                            numRemoved++;
+                        }
+                    }
+                    else {
+                        break;
+                    }
+                }
+                statements.splice(parentPath.key + 1, numRemoved);
+            }
+        });
+        return this.hasChanged();
+    }
+    /**
+     * Returns whether a node is setting a property on a given object.
+     * @param node The AST node.
+     * @param objectName The name of the object.
+     * @returns Whether.
+     */
+    isPropertyAssignment(node, objectName) {
+        return (t.isAssignmentExpression(node) &&
+            t.isMemberExpression(node.left) &&
+            t.isIdentifier(node.left.object) &&
+            node.left.object.name == objectName);
+    }
+}
+exports.ObjectPacker = ObjectPacker;
+ObjectPacker.properties = {
+    key: 'objectPacking'
+};
+/**
+ * Returns whether a node is an empty object expression.
+ * @param node The node.
+ * @returns Whether.
+ */
+const isEmptyObjectExpression = (node) => {
+    return t.isObjectExpression(node) && node.properties.length == 0;
+};

package/utils/deobfuscator/transformations/objects/objectSimplifier.js

@@ -0,0 +1,71 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ObjectSimplifier = void 0;
+const transformation_1 = require("../transformation");
+const traverse_1 = __importDefault(require("@babel/traverse"));
+const variable_1 = require("../../helpers/variable");
+const proxyObject_1 = require("./proxyObject");
+const misc_1 = require("../../helpers/misc");
+class ObjectSimplifier extends transformation_1.Transformation {
+    /**
+     * Creates a new transformation.
+     * @param ast The AST.
+     * @param config The config.
+     */
+    constructor(ast, config) {
+        super(ast, config);
+        this.config = config;
+    }
+    /**
+     * Executes the transformation.
+     * @param log The log function.
+     * @returns Whether any changes were made.
+     */
+    execute(log) {
+        const self = this;
+        const usages = [];
+        let depth = 0;
+        (0, traverse_1.default)(this.ast, {
+            enter(path) {
+                (0, misc_1.setProperty)(path, 'depth', depth++);
+                const variable = (0, variable_1.findConstantVariable)(path, proxyObject_1.isProxyObjectExpression);
+                if (!variable) {
+                    return;
+                }
+                // check if object values are modified
+                for (const referencePath of variable.binding.referencePaths) {
+                    if (referencePath.parentPath &&
+                        referencePath.parentPath.isMemberExpression() &&
+                        referencePath.parentPath.parentPath &&
+                        referencePath.parentPath.parentPath.isAssignmentExpression() &&
+                        referencePath.parentPath.key == 'left') {
+                        if (!self.config.unsafeReplace) {
+                            log(`Not replacing object ${variable.name} as it is modified`);
+                            path.skip();
+                            return;
+                        }
+                    }
+                }
+                const proxyObject = new proxyObject_1.ProxyObject(variable);
+                proxyObject.process();
+                usages.push(...proxyObject.getUsages().map(p => [p, proxyObject]));
+            }
+        });
+        // replace innermost usages first
+        usages.sort((a, b) => (0, misc_1.getProperty)(b[0], 'depth') - (0, misc_1.getProperty)(a[0], 'depth'));
+        for (const [path, proxyObject] of usages) {
+            if (proxyObject.replaceUsage(path)) {
+                this.setChanged();
+            }
+        }
+        return this.hasChanged();
+    }
+}
+exports.ObjectSimplifier = ObjectSimplifier;
+ObjectSimplifier.properties = {
+    key: 'objectSimplification',
+    rebuildScopeTree: true
+};

package/utils/deobfuscator/transformations/objects/proxyObject.js

@@ -0,0 +1,144 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProxyObject = exports.isProxyObjectExpression = void 0;
+const t = __importStar(require("@babel/types"));
+const misc_1 = require("../../helpers/misc");
+const proxyFunction_1 = require("../proxyFunctions/proxyFunction");
+/**
+ * Returns whether a node is a proxy object.
+ * @param node The node.
+ * @returns Whether.
+ */
+const isProxyObjectExpression = (node) => {
+    return t.isObjectExpression(node) && node.properties.length > 0;
+};
+exports.isProxyObjectExpression = isProxyObjectExpression;
+class ProxyObject {
+    /**
+     * Creates a new proxy object.
+     * @param variable The variable.
+     */
+    constructor(variable) {
+        this.literalProperties = new Map();
+        this.proxyFunctionProperties = new Map();
+        this.variable = variable;
+    }
+    /**
+     * Finds all the object's entries which can be replaced.
+     */
+    process() {
+        for (const property of this.variable.expression.properties) {
+            if (t.isObjectProperty(property) && this.isLiteralPropertyKey(property)) {
+                const key = t.isIdentifier(property.key) ? property.key.name : property.key.value;
+                if (t.isLiteral(property.value)) {
+                    this.literalProperties.set(key, property.value);
+                }
+                else if ((0, proxyFunction_1.isProxyFunctionExpression)(property.value)) {
+                    const proxyFunction = new proxyFunction_1.ProxyFunction(property.value);
+                    this.proxyFunctionProperties.set(key, proxyFunction);
+                }
+            }
+            else if (t.isObjectMethod(property) && this.isLiteralMethodKey(property)) {
+                const key = t.isIdentifier(property.key) ? property.key.name : property.key.value;
+                if ((0, proxyFunction_1.isProxyFunctionExpression)(property)) {
+                    const proxyFunction = new proxyFunction_1.ProxyFunction(property);
+                    this.proxyFunctionProperties.set(key, proxyFunction);
+                }
+            }
+        }
+    }
+    /**
+     * Returns the usages of the object.
+     * @returns The usages.
+     */
+    getUsages() {
+        return this.variable.binding.referencePaths;
+    }
+    /**
+     * Attempts to replace a usage of the object.
+     * @param path The path of the usage.
+     * @returns Whether it was replaced.
+     */
+    replaceUsage(path) {
+        const parentPath = path.parentPath;
+        if (parentPath &&
+            parentPath.isMemberExpression() &&
+            this.isLiteralMemberKey(parentPath.node) &&
+            (!parentPath.parentPath ||
+                !parentPath.parentPath.isAssignmentExpression() ||
+                parentPath.parentKey != 'left')) {
+            const key = t.isIdentifier(parentPath.node.property)
+                ? parentPath.node.property.name
+                : parentPath.node.property.value;
+            if (this.literalProperties.has(key)) {
+                const value = this.literalProperties.get(key);
+                parentPath.replaceWith((0, misc_1.copyExpression)(value));
+                return true;
+            }
+            else if (parentPath.parentPath &&
+                parentPath.parentPath.isCallExpression() &&
+                parentPath.key == 'callee' &&
+                this.proxyFunctionProperties.has(key)) {
+                const proxyFunction = this.proxyFunctionProperties.get(key);
+                const replacement = proxyFunction.getReplacement(parentPath.parentPath.node.arguments);
+                parentPath.parentPath.replaceWith(replacement);
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Returns whether an object property has a literal key.
+     * @param property The object property.
+     * @returns Whether.
+     */
+    isLiteralPropertyKey(property) {
+        return (t.isStringLiteral(property.key) ||
+            t.isNumericLiteral(property.key) ||
+            (!property.computed && t.isIdentifier(property.key)));
+    }
+    /**
+     * Returns whether an object method has a literal key.
+     * @param property The object method.
+     * @returns Whether.
+     */
+    isLiteralMethodKey(property) {
+        return (t.isStringLiteral(property.key) ||
+            t.isNumericLiteral(property.key) ||
+            (!property.computed && t.isIdentifier(property.key)));
+    }
+    /**
+     * Returns whether a member expression has a literal key.
+     * @param member The member expression.
+     * @returns Whether.
+     */
+    isLiteralMemberKey(member) {
+        return (t.isStringLiteral(member.property) ||
+            t.isNumericLiteral(member.property) ||
+            (!member.computed && t.isIdentifier(member.property)));
+    }
+}
+exports.ProxyObject = ProxyObject;

package/utils/deobfuscator/transformations/properties/propertySimplifier.js

@@ -0,0 +1,70 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PropertySimplifier = void 0;
+const t = __importStar(require("@babel/types"));
+const traverse_1 = __importDefault(require("@babel/traverse"));
+const transformation_1 = require("../transformation");
+class PropertySimplifier extends transformation_1.Transformation {
+    /**
+     * Executes the transformation.
+     * @param log The log function.
+     */
+    execute(log) {
+        const self = this;
+        (0, traverse_1.default)(this.ast, {
+            MemberExpression(path) {
+                if (path.node.computed &&
+                    t.isStringLiteral(path.node.property) &&
+                    t.isValidIdentifier(path.node.property.value)) {
+                    path.node.property = t.identifier(path.node.property.value);
+                    path.node.computed = false;
+                    self.setChanged();
+                }
+            },
+            ObjectProperty(path) {
+                if (path.node.computed &&
+                    t.isStringLiteral(path.node.key) &&
+                    t.isValidIdentifier(path.node.key.value)) {
+                    path.node.key = t.identifier(path.node.key.value);
+                    path.node.computed = false;
+                    self.setChanged();
+                }
+                else if (path.node.computed &&
+                    (t.isStringLiteral(path.node.key) || t.isNumericLiteral(path.node.key))) {
+                    path.node.computed = false;
+                }
+            }
+        });
+        return this.hasChanged();
+    }
+}
+exports.PropertySimplifier = PropertySimplifier;
+PropertySimplifier.properties = {
+    key: 'propertySimplification'
+};

package/utils/deobfuscator/transformations/proxyFunctions/proxyFunction.js

@@ -0,0 +1,151 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProxyFunctionVariable = exports.ProxyFunction = exports.isProxyFunctionExpression = void 0;
+const t = __importStar(require("@babel/types"));
+const misc_1 = require("../../helpers/misc");
+const traverse_1 = __importDefault(require("@babel/traverse"));
+/**
+ * Returns whether a proxy function expression.
+ * @param node The node.
+ * @returns Whether.
+ */
+const isProxyFunctionExpression = (node) => {
+    return (t.isFunction(node) &&
+        node.params.every(p => t.isIdentifier(p)) &&
+        ((t.isBlockStatement(node.body) &&
+            node.body.body.length == 1 &&
+            t.isReturnStatement(node.body.body[0]) &&
+            (node.body.body[0].argument == undefined ||
+                (t.isExpression(node.body.body[0].argument) &&
+                    isProxyValue(node.body.body[0].argument)))) ||
+            (t.isArrowFunctionExpression(node) &&
+                t.isExpression(node.body) &&
+                isProxyValue(node.body))));
+};
+exports.isProxyFunctionExpression = isProxyFunctionExpression;
+/**
+ * Returns whether a node is a valid proxy function return value.
+ * @param node The node.
+ * @returns Whether.
+ */
+const isProxyValue = (node) => {
+    if (t.isFunction(node) || t.isBlockStatement(node) || t.isSequenceExpression(node)) {
+        return false;
+    }
+    let isValid = true;
+    (0, traverse_1.default)(node, {
+        ['SequenceExpression|BlockStatement|Function'](path) {
+            isValid = false;
+            path.stop();
+        },
+        noScope: true
+    });
+    return isValid;
+};
+class ProxyFunction {
+    /**
+     * Creates a new proxy function.
+     * @param expression The proxy function expression.
+     */
+    constructor(expression) {
+        this.expression = expression;
+    }
+    /**
+     * Returns the replacement for a call of the proxy function.
+     * @param args The arguments of the call.
+     * @returns The replacement expression.
+     */
+    getReplacement(args) {
+        const expression = t.isExpression(this.expression.body)
+            ? (0, misc_1.copyExpression)(this.expression.body)
+            : this.expression.body.body[0].argument
+                ? (0, misc_1.copyExpression)(this.expression.body.body[0].argument)
+                : t.identifier('undefined');
+        this.replaceParameters(expression, args);
+        return expression;
+    }
+    /**
+     * Replaces usages of the proxy function's parameters with the concrete arguments for a given call.
+     * @param expression The expression.
+     * @param args The arguments of the call.
+     */
+    replaceParameters(expression, args) {
+        const paramMap = new Map(this.expression.params.map((param, index) => [
+            param.name,
+            args[index] || t.identifier('undefined')
+        ]));
+        const pathsToReplace = [];
+        (0, traverse_1.default)(expression, {
+            enter(path) {
+                if (t.isIdentifier(path.node) && paramMap.has(path.node.name)) {
+                    const replacement = paramMap.get(path.node.name);
+                    pathsToReplace.push([path, replacement]);
+                }
+            },
+            noScope: true
+        });
+        for (const [path, replacement] of pathsToReplace) {
+            path.replaceWith(replacement);
+        }
+    }
+}
+exports.ProxyFunction = ProxyFunction;
+class ProxyFunctionVariable extends ProxyFunction {
+    /**
+     * Creates a new proxy function variable.
+     * @param variable The variable.
+     */
+    constructor(variable) {
+        super(variable.expression);
+        this.variable = variable;
+    }
+    /**
+     * Returns the calls to the proxy function.
+     * @returns The calls to the proxy function.
+     */
+    getCalls() {
+        return this.variable.binding.referencePaths;
+    }
+    /**
+     * Attempts to replace a call of the proxy function.
+     * @param path The path of the call.
+     * @returns Whether it was replaced.
+     */
+    replaceCall(path) {
+        if (path.parentPath && path.parentPath.isCallExpression() && path.key == 'callee') {
+            const expression = this.getReplacement(path.parentPath.node.arguments);
+            path.parentPath.replaceWith(expression);
+            return true;
+        }
+        else {
+            return false;
+        }
+    }
+}
+exports.ProxyFunctionVariable = ProxyFunctionVariable;

package/utils/deobfuscator/transformations/proxyFunctions/proxyFunctionInliner.js

@@ -0,0 +1,46 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProxyFunctionInliner = void 0;
+const transformation_1 = require("../transformation");
+const traverse_1 = __importDefault(require("@babel/traverse"));
+const variable_1 = require("../../helpers/variable");
+const proxyFunction_1 = require("./proxyFunction");
+const misc_1 = require("../../helpers/misc");
+class ProxyFunctionInliner extends transformation_1.Transformation {
+    /**
+     * Executes the transformation.
+     * @param log The log function.
+     * @returns Whether any changes were made.
+     */
+    execute(log) {
+        const usages = [];
+        let depth = 0;
+        (0, traverse_1.default)(this.ast, {
+            enter(path) {
+                (0, misc_1.setProperty)(path, 'depth', depth++);
+                const variable = (0, variable_1.findConstantVariable)(path, proxyFunction_1.isProxyFunctionExpression, true);
+                if (!variable) {
+                    return;
+                }
+                const proxyFunction = new proxyFunction_1.ProxyFunctionVariable(variable);
+                usages.push(...proxyFunction.getCalls().map(p => [p, proxyFunction]));
+            }
+        });
+        // replace innermost proxy calls first
+        usages.sort((a, b) => (0, misc_1.getProperty)(b[0], 'depth') - (0, misc_1.getProperty)(a[0], 'depth'));
+        for (const [path, proxyFunction] of usages) {
+            if (proxyFunction.replaceCall(path)) {
+                this.setChanged();
+            }
+        }
+        return this.hasChanged();
+    }
+}
+exports.ProxyFunctionInliner = ProxyFunctionInliner;
+ProxyFunctionInliner.properties = {
+    key: 'proxyFunctionInlining',
+    rebuildScopeTree: true
+};