jsconfuser: new plugin

src/main.js

@@ -1,6 +1,7 @@
 const fs = require('fs')
 const PluginCommon = require('./plugin/common.js')
 const PluginJjencode = require('./plugin/jjencode.js')
+const PluginJsconfuser = require('./plugin/jsconfuser.js')
 const PluginSojson = require('./plugin/sojson.js')
 const PluginSojsonV7 = require('./plugin/sojsonv7.js')
 const PluginObfuscator = require('./plugin/obfuscator.js')
@@ -40,6 +41,8 @@ if (type === 'sojson') {
   code = PluginAwsc(sourceCode)
 } else if (type === 'jjencode') {
   code = PluginJjencode(sourceCode)
+} else if (type === 'jsconfuser') {
+  code = PluginJsconfuser(sourceCode)
 } else {
   code = PluginCommon(sourceCode)
 }

src/plugin/jsconfuser.js

@@ -0,0 +1,60 @@
+const { parse } = require('@babel/parser')
+const generator = require('@babel/generator').default
+const traverse = require('@babel/traverse').default
+
+const calculateConstantExp = require('../visitor/calculate-constant-exp')
+const pruneIfBranch = require('../visitor/prune-if-branch')
+const jcAntiTooling = require('../visitor/jsconfuser/anti-tooling')
+const jcControlFlow = require('../visitor/jsconfuser/control-flow')
+const jcDuplicateLiteral = require('../visitor/jsconfuser/duplicate-literal')
+const jcGlobalConcealing = require('../visitor/jsconfuser/global-concealing')
+const jcMinifyInit = require('../visitor/jsconfuser/minify')
+const jcOpaquePredicates = require('../visitor/jsconfuser/opaque-predicates')
+const jcStackInit = require('../visitor/jsconfuser/stack')
+const jcStringCompression = require('../visitor/jsconfuser/string-compression')
+const jcStringConceal = require('../visitor/jsconfuser/string-concealing')
+
+module.exports = function (code) {
+  let ast
+  try {
+    ast = parse(code, { errorRecovery: true })
+  } catch (e) {
+    console.error(`Cannot parse code: ${e.reasonCode}`)
+    return null
+  }
+  // AntiTooling
+  traverse(ast, jcAntiTooling)
+  // Minify
+  const jcMinify = jcMinifyInit()
+  traverse(ast, jcMinify.deMinifyArrow)
+  // DuplicateLiteralsRemoval
+  traverse(ast, jcDuplicateLiteral)
+  // Stack
+  const jcStack = jcStackInit(jcMinify.arrowFunc)
+  traverse(ast, jcStack.deStackFuncLen)
+  traverse(ast, jcStack.deStackFuncOther)
+  // StringCompression
+  traverse(ast, jcStringCompression)
+  // StringConcealing
+  traverse(ast, jcStringConceal.deStringConcealing)
+  traverse(ast, jcStringConceal.deStringConcealingPlace)
+  // StringSplitting
+  traverse(ast, calculateConstantExp)
+  // Stack (run again)
+  traverse(ast, jcStack.deStackFuncOther)
+  // OpaquePredicates
+  traverse(ast, jcOpaquePredicates)
+  traverse(ast, calculateConstantExp)
+  traverse(ast, pruneIfBranch)
+  // GlobalConcealing
+  traverse(ast, jcGlobalConcealing)
+  // ControlFlowFlattening
+  traverse(ast, jcControlFlow.deControlFlowFlatteningStateless)
+  traverse(ast, calculateConstantExp)
+  // ExpressionObfuscation
+  code = generator(ast, {
+    comments: false,
+    jsescOption: { minimal: true },
+  }).code
+  return code
+}

src/utility/check-func.js

@@ -0,0 +1,15 @@
+function checkPattern(code, pattern) {
+  let i = 0
+  let j = 0
+  while (i < code.length && j < pattern.length) {
+    if (code[i] == pattern[j]) {
+      ++j
+    }
+    ++i
+  }
+  return j == pattern.length
+}
+
+module.exports = {
+  checkPattern,
+}

src/utility/safe-func.js

@@ -0,0 +1,72 @@
+const t = require('@babel/types')
+
+function safeDeleteNode(name, path) {
+  let binding
+  if (path.isFunctionDeclaration()) {
+    binding = path.parentPath.scope.getBinding(name)
+  } else {
+    binding = path.scope.getBinding(name)
+  }
+  if (!binding) {
+    return false
+  }
+  binding.scope.crawl()
+  binding = binding.scope.getBinding(name)
+  if (binding.references) {
+    return false
+  }
+  for (const item of binding.constantViolations) {
+    item.remove()
+  }
+  const decl = binding.path
+  if (decl.removed) {
+    return true
+  }
+  if (!decl.isVariableDeclarator() && !decl.isFunctionDeclaration()) {
+    return true
+  }
+  binding.path.remove()
+  return true
+}
+
+function safeGetLiteral(path) {
+  if (path.isUnaryExpression()) {
+    if (path.node.operator === '-' && path.get('argument').isNumericLiteral()) {
+      return -1 * path.get('argument').node.value
+    }
+    return null
+  }
+  if (path.isLiteral()) {
+    return path.node.value
+  }
+  return null
+}
+
+function safeGetName(path) {
+  if (path.isIdentifier()) {
+    return path.node.name
+  }
+  if (path.isLiteral()) {
+    return path.node.value
+  }
+  return null
+}
+
+function safeReplace(path, value) {
+  if (typeof value === 'string') {
+    path.replaceWith(t.stringLiteral(value))
+    return
+  }
+  if (typeof value === 'number') {
+    path.replaceWith(t.numericLiteral(value))
+    return
+  }
+  path.replaceWithSourceString(value)
+}
+
+module.exports = {
+  safeDeleteNode,
+  safeGetLiteral,
+  safeGetName,
+  safeReplace,
+}

src/visitor/jsconfuser/anti-tooling.js

@@ -0,0 +1,53 @@
+const t = require('@babel/types')
+
+function deAntiToolingCheckFunc(path) {
+  if (path.node.params.length) {
+    return false
+  }
+  const body = path.node.body
+  if (!t.isBlockStatement(body)) {
+    return false
+  }
+  if (body.body.length) {
+    return false
+  }
+  return true
+}
+
+function deAntiToolingExtract(path, func_name) {
+  let binding = path.scope.getBinding(func_name)
+  for (let ref of binding.referencePaths) {
+    if (!ref.parentPath.isCallExpression() || !ref.key === 'callee') {
+      continue
+    }
+    const call = ref.parentPath
+    if (!call.listKey === 'body') {
+      continue
+    }
+    for (let node of call.node.arguments) {
+      call.insertBefore(node)
+    }
+    call.remove()
+  }
+  binding.scope.crawl()
+  binding = path.scope.getBinding(func_name)
+  if (binding.references === 0) {
+    path.remove()
+  }
+}
+
+const deAntiTooling = {
+  FunctionDeclaration(path) {
+    const func_name = path.node.id?.name
+    if (!func_name) {
+      return
+    }
+    if (!deAntiToolingCheckFunc(path)) {
+      return
+    }
+    console.log(`AntiTooling Func Name: ${func_name}`)
+    deAntiToolingExtract(path, func_name)
+  },
+}
+
+module.exports = deAntiTooling