node-automator 1.1.0 → 1.2.1

package/utils/deobfuscator/transformations/controlFlow/sequenceSplitter.js

@@ -0,0 +1,168 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SequenceSplitter = void 0;
+const t = __importStar(require("@babel/types"));
+const traverse_1 = __importDefault(require("@babel/traverse"));
+const transformation_1 = require("../transformation");
+class SequenceSplitter extends transformation_1.Transformation {
+    /**
+     * Executes the transformation.
+     * @param log The log function.
+     */
+    execute(log) {
+        const self = this;
+        (0, traverse_1.default)(this.ast, {
+            ConditionalExpression(path) {
+                if (path.parentPath && path.parentPath.isExpressionStatement()) {
+                    const replacement = t.ifStatement(path.node.test, t.expressionStatement(path.node.consequent), t.expressionStatement(path.node.alternate));
+                    if (path.parentPath.parentPath &&
+                        path.parentPath.parentPath.key == 'alternate' &&
+                        path.parentPath.parentPath.isBlockStatement() &&
+                        path.parentPath.parentPath.node.body.length == 1) {
+                        path.parentPath.parentPath.replaceWith(replacement);
+                    }
+                    else {
+                        path.parentPath.replaceWith(replacement);
+                    }
+                    path.skip();
+                    self.setChanged();
+                }
+            },
+            LogicalExpression(path) {
+                if ((path.node.operator == '&&' || path.node.operator == '||') &&
+                    path.parentPath &&
+                    path.parentPath.isExpressionStatement()) {
+                    const test = path.node.operator == '&&'
+                        ? path.node.left
+                        : t.unaryExpression('!', path.node.left);
+                    const replacement = t.ifStatement(test, t.expressionStatement(path.node.right));
+                    if (path.parentPath.parentPath &&
+                        path.parentPath.parentPath.key == 'alternate' &&
+                        path.parentPath.parentPath.isBlockStatement() &&
+                        path.parentPath.parentPath.node.body.length == 1) {
+                        path.parentPath.parentPath.replaceWith(replacement);
+                    }
+                    else {
+                        path.parentPath.replaceWith(replacement);
+                    }
+                    path.skip();
+                    self.setChanged();
+                }
+            },
+            ['ForStatement|WhileStatement|DoWhileStatement'](path) {
+                if (!t.isBlockStatement(path.node.body)) {
+                    path.node.body = t.blockStatement([path.node.body]);
+                    self.setChanged();
+                }
+            },
+            IfStatement(path) {
+                if (!t.isBlockStatement(path.node.consequent)) {
+                    path.node.consequent = t.blockStatement([path.node.consequent]);
+                    self.setChanged();
+                }
+                if (path.node.alternate &&
+                    !t.isBlockStatement(path.node.alternate) &&
+                    !t.isIfStatement(path.node.alternate)) {
+                    path.node.alternate = t.blockStatement([path.node.alternate]);
+                    self.setChanged();
+                }
+            },
+            VariableDeclaration(path) {
+                if (path.node.declarations.length > 1) {
+                    const replacements = path.node.declarations.map(d => t.variableDeclaration(path.node.kind, [d]));
+                    if (path.parentPath &&
+                        path.parentPath.isForStatement() &&
+                        path.parentKey == 'init') {
+                        const lastDeclaration = replacements.pop();
+                        path.parentPath.insertBefore(replacements);
+                        path.parentPath.node.init = lastDeclaration;
+                    }
+                    else {
+                        path.replaceWithMultiple(replacements);
+                    }
+                    self.setChanged();
+                }
+            },
+            SequenceExpression(path) {
+                const expressions = path.node.expressions;
+                if (expressions.length == 1) {
+                    path.replaceWith(expressions[0]);
+                    self.setChanged();
+                    return;
+                }
+                let outerPath = path;
+                while (!t.isStatement(outerPath.node)) {
+                    const parent = outerPath.parentPath;
+                    if (!parent) {
+                        return;
+                    }
+                    if ((parent.isConditionalExpression() &&
+                        (outerPath.key == 'consequent' || outerPath.key == 'alternate')) ||
+                        (parent.isLogicalExpression() && outerPath.key == 'right') ||
+                        (parent.isForStatement() &&
+                            (outerPath.key == 'test' || outerPath.key == 'update')) ||
+                        (parent.isDoWhileStatement() && outerPath.key == 'test')) {
+                        return;
+                    }
+                    outerPath = parent;
+                }
+                const lastExpression = expressions[expressions.length - 1];
+                if (self.isExcluded(lastExpression)) {
+                    const firstExpressions = expressions.splice(0, expressions.length - 2);
+                    if (firstExpressions.length > 0) {
+                        const expressionStatements = firstExpressions.map(e => t.expressionStatement(e));
+                        outerPath.insertBefore(expressionStatements);
+                        self.setChanged();
+                    }
+                }
+                else {
+                    const lastExpression = expressions.splice(expressions.length - 1, 1)[0];
+                    const expressionStatements = expressions.map(e => t.expressionStatement(e));
+                    outerPath.insertBefore(expressionStatements);
+                    path.replaceWith(lastExpression);
+                    self.setChanged();
+                }
+            }
+        });
+        return this.hasChanged();
+    }
+    /**
+     * Returns whether a node that is the last in a sequence expression
+     * is excluded from being placed on its own.
+     * @param node The AST node.
+     * @returns Whether.
+     */
+    isExcluded(node) {
+        return t.isIdentifier(node) && node.name == 'eval';
+    }
+}
+exports.SequenceSplitter = SequenceSplitter;
+SequenceSplitter.properties = {
+    key: 'sequenceSplitting'
+};

package/utils/deobfuscator/transformations/expressions/expressionSimplifier.js

@@ -0,0 +1,288 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExpressionSimplifier = void 0;
+const t = __importStar(require("@babel/types"));
+const traverse_1 = __importDefault(require("@babel/traverse"));
+const transformation_1 = require("../transformation");
+const expression_1 = require("../../helpers/expression");
+class ExpressionSimplifier extends transformation_1.Transformation {
+    /**
+     * Executes the transformation.
+     * @param log The log function.
+     */
+    execute(log) {
+        const self = this;
+        (0, traverse_1.default)(this.ast, {
+            ['UnaryExpression|BinaryExpression'](path) {
+                const replacement = path.isUnaryExpression()
+                    ? self.simplifyUnaryExpression(path.node)
+                    : self.simplifyBinaryExpression(path.node);
+                if (replacement) {
+                    path.replaceWith(replacement);
+                    self.setChanged();
+                }
+            }
+        });
+        return this.hasChanged();
+    }
+    /**
+     * Attempts to simplify an expression.
+     * @param expression The expression.
+     * @returns The expression in the simplest form possible.
+     */
+    simplifyExpression(expression) {
+        if (t.isUnaryExpression(expression) || t.isBinaryExpression(expression)) {
+            const replacement = t.isUnaryExpression(expression)
+                ? this.simplifyUnaryExpression(expression)
+                : this.simplifyBinaryExpression(expression);
+            return replacement || expression;
+        }
+        else {
+            return expression;
+        }
+    }
+    /**
+     * Attempts to simplify a unary expression.
+     * @param expression The unary expression.
+     * @returns The simplified expression or undefined.
+     */
+    simplifyUnaryExpression(expression) {
+        if (!ExpressionSimplifier.RESOLVABLE_UNARY_OPERATORS.has(expression.operator)) {
+            return undefined;
+        }
+        else if ((0, expression_1.isNegativeNumericLiteral)(expression)) {
+            return undefined; // avoid trying to simplify negative numbers
+        }
+        const argument = this.simplifyExpression(expression.argument);
+        if (this.isResolvableExpression(argument)) {
+            const argumentValue = this.getResolvableExpressionValue(argument);
+            const value = this.applyUnaryOperation(expression.operator, argumentValue);
+            return this.convertValueToExpression(value);
+        }
+        else {
+            return undefined;
+        }
+    }
+    /**
+     * Attempts to simplify a binary expression.
+     * @param expression The binary expression.
+     * @returns The simplified expression or undefined.
+     */
+    simplifyBinaryExpression(expression) {
+        if (!t.isExpression(expression.left) ||
+            !ExpressionSimplifier.RESOLVABLE_BINARY_OPERATORS.has(expression.operator)) {
+            return undefined;
+        }
+        const left = this.simplifyExpression(expression.left);
+        const right = this.simplifyExpression(expression.right);
+        if (this.isResolvableExpression(left) && this.isResolvableExpression(right)) {
+            const leftValue = this.getResolvableExpressionValue(left);
+            const rightValue = this.getResolvableExpressionValue(right);
+            const value = this.applyBinaryOperation(expression.operator, leftValue, rightValue);
+            return this.convertValueToExpression(value);
+        }
+        else if (expression.operator == '-' && (0, expression_1.isNegativeNumericLiteral)(right)) {
+            // convert (- -a) to +a (as long as a is a number)
+            expression.right = right.argument;
+            expression.operator = '+';
+            return expression;
+        }
+        else {
+            return undefined;
+        }
+    }
+    /**
+     * Applies a unary operation.
+     * @param operator The operator.
+     * @param argument The argument value.
+     * @returns The resultant value.
+     */
+    applyUnaryOperation(operator, argument) {
+        switch (operator) {
+            case '-':
+                return -argument;
+            case '+':
+                return +argument;
+            case '!':
+                return !argument;
+            case '~':
+                return ~argument;
+            case 'typeof':
+                return typeof argument;
+            case 'void':
+                return void argument;
+        }
+    }
+    /**
+     * Applies a binary operation.
+     * @param operator The resolvable binary operator.
+     * @param left The value of the left expression.
+     * @param right The value of the right expression.
+     * @returns The resultant value.
+     */
+    applyBinaryOperation(operator, left, right) {
+        switch (operator) {
+            case '==':
+                return left == right;
+            case '!=':
+                return left != right;
+            case '===':
+                return left === right;
+            case '!==':
+                return left !== right;
+            case '<':
+                return left < right;
+            case '<=':
+                return left <= right;
+            case '>':
+                return left > right;
+            case '>=':
+                return left >= right;
+            case '<<':
+                return left << right;
+            case '>>':
+                return left >> right;
+            case '>>>':
+                return left >>> right;
+            case '+':
+                return left + right;
+            case '-':
+                return left - right;
+            case '*':
+                return left * right;
+            case '/':
+                return left / right;
+            case '%':
+                return left % right;
+            case '**':
+                return left ** right;
+            case '|':
+                return left | right;
+            case '^':
+                return left ^ right;
+            case '&':
+                return left & right;
+        }
+    }
+    /**
+     * Gets the real value from a resolvable expression.
+     * @param expression The resolvable expression.
+     * @returns The value.
+     */
+    getResolvableExpressionValue(expression) {
+        switch (expression.type) {
+            case 'NumericLiteral':
+            case 'StringLiteral':
+            case 'BooleanLiteral':
+            case 'DecimalLiteral':
+            case 'BigIntLiteral':
+                return expression.value;
+            case 'UnaryExpression':
+                return -this.getResolvableExpressionValue(expression.argument);
+            case 'NullLiteral':
+                return null;
+            case 'Identifier':
+                return undefined;
+            case 'ArrayExpression':
+                return [];
+            case 'ObjectExpression':
+                return {};
+        }
+    }
+    /**
+     * Attempts to convert a value of unknown type to an expression node.
+     * @param value The value.
+     * @returns The expression or undefined.
+     */
+    convertValueToExpression(value) {
+        switch (typeof value) {
+            case 'string':
+                return t.stringLiteral(value);
+            case 'number':
+                return value >= 0
+                    ? t.numericLiteral(value)
+                    : t.unaryExpression('-', t.numericLiteral(Math.abs(value)));
+            case 'boolean':
+                return t.booleanLiteral(value);
+            case 'bigint':
+                return t.bigIntLiteral(value.toString());
+            case 'undefined':
+                return t.identifier('undefined');
+            default:
+                return undefined;
+        }
+    }
+    /**
+     * Returns whether a node is a resolvable expression that can be
+     * evaluated safely.
+     * @param node The AST node.
+     * @returns Whether.
+     */
+    isResolvableExpression(node) {
+        return ((t.isLiteral(node) && !t.isRegExpLiteral(node) && !t.isTemplateLiteral(node)) ||
+            (t.isUnaryExpression(node) && node.operator == '-' && t.isLiteral(node.argument)) ||
+            (t.isIdentifier(node) && node.name == 'undefined') ||
+            (t.isArrayExpression(node) && node.elements.length == 0) ||
+            (t.isObjectExpression(node) && node.properties.length == 0));
+    }
+}
+exports.ExpressionSimplifier = ExpressionSimplifier;
+ExpressionSimplifier.properties = {
+    key: 'expressionSimplification'
+};
+ExpressionSimplifier.RESOLVABLE_UNARY_OPERATORS = new Set([
+    '-',
+    '+',
+    '!',
+    '~',
+    'typeof',
+    'void'
+]);
+ExpressionSimplifier.RESOLVABLE_BINARY_OPERATORS = new Set([
+    '==',
+    '!=',
+    '===',
+    '!==',
+    '<',
+    '<=',
+    '>',
+    '>=',
+    '<<',
+    '>>',
+    '>>>',
+    '+',
+    '-',
+    '*',
+    '/',
+    '%',
+    '**',
+    '|',
+    '^',
+    '&'
+]);

package/utils/deobfuscator/transformations/objects/objectPacker.js

@@ -0,0 +1,125 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ObjectPacker = void 0;
+const t = __importStar(require("@babel/types"));
+const variable_1 = require("../../helpers/variable");
+const transformation_1 = require("../transformation");
+const traverse_1 = __importDefault(require("@babel/traverse"));
+class ObjectPacker extends transformation_1.Transformation {
+    /**
+     * Executes the transformation.
+     * @param log The log function.
+     */
+    execute(log) {
+        const self = this;
+        (0, traverse_1.default)(this.ast, {
+            enter(path) {
+                const variable = (0, variable_1.findConstantVariable)(path, isEmptyObjectExpression);
+                if (!variable) {
+                    return;
+                }
+                const parentPath = path.getStatementParent();
+                if (!parentPath ||
+                    parentPath.parentPath == undefined ||
+                    typeof parentPath.key != 'number') {
+                    return;
+                }
+                const statements = parentPath.parentPath.node[parentPath.parentKey];
+                let numRemoved = 0;
+                for (let i = parentPath.key + 1; i < statements.length; i++) {
+                    const node = statements[i];
+                    if (t.isExpressionStatement(node) &&
+                        self.isPropertyAssignment(node.expression, variable.name)) {
+                        // replace multiple properties assigned in same statement
+                        if (self.isPropertyAssignment(node.expression.right, variable.name)) {
+                            const properties = [node.expression.left];
+                            let right = node.expression.right;
+                            while (self.isPropertyAssignment(right, variable.name)) {
+                                properties.push(right.left);
+                                right = right.right;
+                            }
+                            // don't duplicate expressions with side effects
+                            if (!t.isLiteral(right)) {
+                                return;
+                            }
+                            for (const { property } of properties) {
+                                const isComputed = !t.isStringLiteral(property) &&
+                                    !t.isNumericLiteral(property) &&
+                                    !t.isIdentifier(property);
+                                const objectProperty = t.objectProperty(property, right, isComputed);
+                                variable.expression.properties.push(objectProperty);
+                                self.setChanged();
+                                numRemoved++;
+                            }
+                        }
+                        else {
+                            const key = node.expression.left.property;
+                            const isComputed = !t.isStringLiteral(key) &&
+                                !t.isNumericLiteral(key) &&
+                                !t.isIdentifier(key);
+                            const property = t.objectProperty(key, node.expression.right, isComputed);
+                            variable.expression.properties.push(property);
+                            self.setChanged();
+                            numRemoved++;
+                        }
+                    }
+                    else {
+                        break;
+                    }
+                }
+                statements.splice(parentPath.key + 1, numRemoved);
+            }
+        });
+        return this.hasChanged();
+    }
+    /**
+     * Returns whether a node is setting a property on a given object.
+     * @param node The AST node.
+     * @param objectName The name of the object.
+     * @returns Whether.
+     */
+    isPropertyAssignment(node, objectName) {
+        return (t.isAssignmentExpression(node) &&
+            t.isMemberExpression(node.left) &&
+            t.isIdentifier(node.left.object) &&
+            node.left.object.name == objectName);
+    }
+}
+exports.ObjectPacker = ObjectPacker;
+ObjectPacker.properties = {
+    key: 'objectPacking'
+};
+/**
+ * Returns whether a node is an empty object expression.
+ * @param node The node.
+ * @returns Whether.
+ */
+const isEmptyObjectExpression = (node) => {
+    return t.isObjectExpression(node) && node.properties.length == 0;
+};

package/utils/deobfuscator/transformations/objects/objectSimplifier.js

@@ -0,0 +1,71 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ObjectSimplifier = void 0;
+const transformation_1 = require("../transformation");
+const traverse_1 = __importDefault(require("@babel/traverse"));
+const variable_1 = require("../../helpers/variable");
+const proxyObject_1 = require("./proxyObject");
+const misc_1 = require("../../helpers/misc");
+class ObjectSimplifier extends transformation_1.Transformation {
+    /**
+     * Creates a new transformation.
+     * @param ast The AST.
+     * @param config The config.
+     */
+    constructor(ast, config) {
+        super(ast, config);
+        this.config = config;
+    }
+    /**
+     * Executes the transformation.
+     * @param log The log function.
+     * @returns Whether any changes were made.
+     */
+    execute(log) {
+        const self = this;
+        const usages = [];
+        let depth = 0;
+        (0, traverse_1.default)(this.ast, {
+            enter(path) {
+                (0, misc_1.setProperty)(path, 'depth', depth++);
+                const variable = (0, variable_1.findConstantVariable)(path, proxyObject_1.isProxyObjectExpression);
+                if (!variable) {
+                    return;
+                }
+                // check if object values are modified
+                for (const referencePath of variable.binding.referencePaths) {
+                    if (referencePath.parentPath &&
+                        referencePath.parentPath.isMemberExpression() &&
+                        referencePath.parentPath.parentPath &&
+                        referencePath.parentPath.parentPath.isAssignmentExpression() &&
+                        referencePath.parentPath.key == 'left') {
+                        if (!self.config.unsafeReplace) {
+                            log(`Not replacing object ${variable.name} as it is modified`);
+                            path.skip();
+                            return;
+                        }
+                    }
+                }
+                const proxyObject = new proxyObject_1.ProxyObject(variable);
+                proxyObject.process();
+                usages.push(...proxyObject.getUsages().map(p => [p, proxyObject]));
+            }
+        });
+        // replace innermost usages first
+        usages.sort((a, b) => (0, misc_1.getProperty)(b[0], 'depth') - (0, misc_1.getProperty)(a[0], 'depth'));
+        for (const [path, proxyObject] of usages) {
+            if (proxyObject.replaceUsage(path)) {
+                this.setChanged();
+            }
+        }
+        return this.hasChanged();
+    }
+}
+exports.ObjectSimplifier = ObjectSimplifier;
+ObjectSimplifier.properties = {
+    key: 'objectSimplification',
+    rebuildScopeTree: true
+};