先来看看效果：
解混淆前的代码 -> 解混淆后的代码
完整的插件代码
If节点转Switch节点
例子
这里将if节点转换成switch，当然只是针对这段代码而写的。
这里是为switch合并做预处理，只针对最内层case，外层case并不在处理范围。
if (_$nE
插件
function ifToSwitchNode(path, pathStr = "test.left") {
function getNodes(path, list = []) {
if (!path.isIfStatement()) {
list.push({
type: "SwitchCase",
consequent: path.node.body,
test: types.valueToNode(list[list.length - 2].right.value)
})
return list;
}
items.forEach(n => {
let tmep = path.get(n);
list.push(tmep.node);
})
return getNodes(path.get("alternate"), list);
}
function reductionTest(test) {
switch (test.operator) {
case "
switch合并
例子
这里将多维的switch合并为一维的。
switch (_$nE) {
case 3:
switch (_$nE) {
case 0:
_$hk = window, _$NB = String, _$OA = Array, _$Qd = document, _$uO = Date;
case 1:
_$bx = _$hk['$_ts'] = {};
case 2:
_$bx = _$hk['$_ts'];
case 3:
_$_l = !_$bx;
}
case 4:
switch (_$nE) {
case 4:
_$UX(0);
case 5:
if (!_$_l) _$nI += 1;
case 6:
_$bj = [4, 16, 64, 256, 1024, 4096, 16384, 65536];
case 7:
return;
}
}
----------------------------------------------
switch (_$nE) {
case 0:
_$hk = window, _$NB = String, _$OA = Array, _$Qd = document, _$uO = Date;
case 1:
_$bx = _$hk['$_ts'] = {};
case 2:
_$bx = _$hk['$_ts'];
case 3:
_$_l = !_$bx;
case 4:
_$UX(0);
case 5:
if (!_$_l) _$nI += 1;
case 6:
_$bj = [4, 16, 64, 256, 1024, 4096, 16384, 65536];
case 7:
return;
}
插件
function getCaseAll(cases, caseAll = []) {
if (!types.isSwitchStatement(cases[0].consequent[0])) return cases;
for (let i = 0; i
缓存关键数据
插件
这里是为方便后续操作做准备。
/**
* 向上查询某类型的ParentPath
* home.php?mod=space&uid=952169 path
* @param type
* @returns {null|*}
*/
function findParentPath(path, type) {
while (!path.isProgram()) {
path = path.parentPath;
if (!path[`is${type}`]()) return path.parentPath;
}
}
/**
* 节点筛选器
* @param list [node/path...] 元素node或path都可
* @param filter 类型 array [str...] 类型列表
* @param filterMode 过滤器模式 默认false | false - 只输出配置的类型 true - 过滤（不输出）配置的类型
* @param isCode 默认true返回代码 false返回节点列表
* @returns {string|array} code/itemList
*/
function nodeFilter(list, filter = [true], filterMode = false, isCode = true) {
let code = "", itemList = [];
if (!list.length) return "";
let isPath = typeof list[0].isReturnStatement === "function";
if (isPath) list = list.reverse();
list.forEach(node => {
if (isPath) node = node.node;
if (filter[0] === true ||
(!filterMode === filter.includes(node.type))) {
isCode ? code += `${generator(node).code}\n` : itemList.push(node);
}
})
return isCode ? code : itemList;
}
/***
* 获取需要用到的对象名和节点
* @param path
* @param resultPath
*/
function getFuncInfo(path, resultPath) {
let info = Object();
info["switchPath"] = path.get('body.body.1');
let expressionNode = path.node.body.body[0];
let arrayName = expressionNode.expression.right.object.name;
let largeArrayInit = path.scope.getBinding(arrayName).path.node.init;
let largeArrayName = largeArrayInit.object.name;
let largeArrayIndex = largeArrayInit.property.value;
info["array"] = eval(generator(path.scope.getBinding(largeArrayName).path.node.init).code)[largeArrayIndex];
info["indexName"] = expressionNode.expression.right.property.argument.name;
info["variable"] = nodeFilter(path.getAllPrevSiblings(), ['VariableDeclaration', 'FunctionDeclaration'], false, false);
info["path"] = resultPath;
return info;
}
let funcInfo = {};
/***
* 缓存关键数据
* @type {{WhileStatement(*): void}}
*/
const cacheCriticalData = {
WhileStatement(path) {
let resultPath = findParentPath(path, "FunctionDeclaration");
if (!resultPath) return;
let funcName = "main";
if (!resultPath.isFunctionExpression()) {
funcName = resultPath.node.id.name;
}
// 缓存path和关键变量名以便后续使用
funcInfo[funcName] = getFuncInfo(path, resultPath);
}
}
合并调用信息前的准备
插件
let cache = {};
const mergeCallInfo = {
CallExpression(path) {
let name = path.node.callee.name;
if (Object.keys(funcInfo).includes(name)) {
let now = funcInfo[name];
const {cases} = now.switchPath.node;
let value = path.node.arguments[0].value;
let replaceBody = [];
let callCode = path.toString();
if (Object.keys(cache).includes(callCode)) return;
let constantViolations = (() => {
let list = [];
now.path.scope.getBinding(now.indexName).constantViolations.forEach(p => list.push(p.node.start))
return list;
})();
for (let i = value; i
$#合并调用
例子
switch (_$8w) {
case 0:
_$hk['$_ts'] = {};
case 1:
_$qA = _$vT.substr(_$yG, _$B_).split(_$NB.fromCharCode(255));
case 2:
var _$6U = _$UX(10);
case 3:
var _$B_ = _$z6();
case 4:
_$6U += "boDAnZapOCX8xJU2au447jYLkgwNztHO7AuauIp4P26lQTtdW5d$Q3e1G5F9IC3qE8ksXFTNV0jGl75dTsyxNioGl4Svu60uHKu3zrllyNPYY939zhkvUkumErxFngcRvZax5JQGjs3gejM9wARz_JsdQepMi5S6GKrhg3LvVtwUD70h1ZXQA3OjFPNF";
case 5:
_$pY = _$8_ === undefined || _$8_ === "";
case 6:
return 0;
case 7:
return _$UX(12, _$6U);
case 8:
var _$nE = _$z6();
case 9:
_$8_._$hk = 12;
case 10:
var _$dQ = _$z6();
----------------------------------------------
_$8_._$DK = 7;
_$8_._$hk = 12;
_$8_._$6n = 4;
_$8_._$Hn = "_$74";
_$8_._$Li = "_$v5";
_$8_._$gP = "_$pl";
_$8_._$jq = "_$ez";
_$8_._$u5 = "_$2X";
_$8_._$Zu = "_$Gn";
_$8_._$XK = "_$qK";
_$8_._$jS = "_$Ui";
_$8_._$pY = "_$qL";
_$8_._$J6 = "_$nE";
_$8_._$OA = "gabGed5GyIa";
_$8_._$2t = "JTKWP2.d7Dq";
_$8_._$uO = "Cr9JCX._VGtwUqL.MQKwjE";
_$8_._$B2 = "8ew8MTOflwq";
_$8_._$NB = _$KM;
_$8_._$Lc = "hLBEA6IMPqBY1gfp_t9V1G";
_$8_._$tQ = 57;
插件
因为直接替换卡住了，所以返璞归真正则替换吧！
function processCharacters(str) {
return str.replace(/\$/g, "\\$").replace(/\[/g, "\\[")
.replace(/\]/g, "\\]").replace(/\(/g, "\\(").replace(/\)/g, "\\)").replace(/\+/g, "\\+");
}
function replaceMergeCall() {
let cacheKeys = Object.keys(cache);
let {code} = generator(ast);
cacheKeys = [...new Set(cacheKeys)];
cacheKeys = [...cacheKeys, ...cacheKeys, ...cacheKeys];
cacheKeys.forEach(key => {
let re = new RegExp(processCharacters(key), "g");
let callCode = nodeFilter([cache[key]]);
code = code.replace(re, callCode.replace(/\'/g, '"'));
})
ast = parser.parse(code.replace(/;\n;/g, ";"));
}
拆分逗号表达式
插件
copy的蔡老板的插件，有现成的何必动手。
const decode_comma = {
//破解逗号表达式，兼容之前的脚本
ExpressionStatement(path) {
let {expression} = path.node;
if (!types.isSequenceExpression(expression)) return;
let body = [];
expression.expressions.forEach(express => {
body.push(types.expressionStatement(express));
})
path.replaceInline(body);
}
}
删除未引用
插件
/***
* 删除未引用
* @type {{VariableDeclarator(*): void}}
*/
const unreferenced = {
'VariableDeclarator|FunctionDeclaration'(path) {
const func_name = path.node.id.name;
const binding = path.scope.getBinding(func_name);
// 如果变量没有被引用过，那么删除也没关系
// 此处不能用有无修改过进行判断，因为没有被修改过并不意味着没用
if (binding && !binding.referenced) path.remove();
}
}
定制的删除未引用
插件
ast学的不深就乱写了，本着能用就行。
const forUnreferenced = {
VariableDeclarator(path) {
let _path = path.parentPath.parentPath.parentPath;
if (!_path.isFunctionExpression() || !_path.node.params.length) return;
let body = _path.node.body.body;
let start = body[0].start;
let end = body[body.length - 1].end;
let name = path.node.id.name;
const binding = path.scope.getBinding(name);
if (!binding) return;
let referencePaths = binding.referencePaths;
let referenced = 0;
for (let i = 0; i
替换值函数
只return数字的函数。
const replaceValueFunc = {
FunctionDeclaration(path) {
let {body, id, params} = path.node;
if (params.length || body.body.length !== 1) return;
const binding = path.scope.getBinding(id.name);
if (!binding) return;
let referencePaths = path.scope.getBinding(id.name).referencePaths;
referencePaths.forEach(rp => {
rp.parentPath.replaceInline(body.body[0].argument)
})
path.remove();
}
}
取反if
处理这if节点 if(!xx) function (xx) { xxx }(xx)
const negateJudgment = {
IfStatement(path) {
let {test, consequent} = path.node;
if (!types.isUnaryExpression(test)) return;
if (!types.isCallExpression(consequent.expression)) return;
path.node.consequent = consequent.expression.callee.body;
}
}
解码控制流
到这里只有7个case了
const decodeControlFlow = {
WhileStatement(path) {
let {body} = path.node;
let switchNode = body.body[1];
let {cases} = switchNode;
let replace_body = [];
funcInfo['main'].array.forEach(index => {
let case_body = cases[index].consequent;
if (types.isContinueStatement(case_body[case_body.length - 1])) {
case_body.pop();
}
replace_body = replace_body.concat(case_body);
}
);
path.replaceInline(replace_body);
}
}
到这里解混淆的绝大部分，具体流程也清晰可见了。
