33

ast/decode.js

@@ -12,7 +12,7 @@ process.argv.length > 3 ? decodeFile = process.argv[3] : decodeFile = "./decodeR
 //将源代码解析为AST
 let sourceCode = fs.readFileSync(encodeFile, {encoding: "utf-8"});
 
-let ast = parser.parse(sourceCode);
+let ast = parser.parse(sourceCode, {sourceType:'script'});
 
 
 console.time("处理完毕，耗时");
@@ -57,18 +57,19 @@ const renameFunc =
             let {id, params, body} = node;
             let name = id.name;
 
-            // if (params.length != 2 || body.body.length != 1 ||
-            //     !types.isReturnStatement(body.body[0]) || !types.isCallExpression(body.body[0].argument)) {
-            //     return;
-            // }
+            if (params.length != 2 ||
+                !types.isVariableDeclaration(body.body[0]) || !types.isReturnStatement(body.body[1])) {
+                return;
+            }
 
             let binding = parentPath.scope.getBinding(name);
 
             if (!binding || !binding.constant) {
                 return;
             }
-            console.log('getName', name)
             let newNameId = getUnusedIdentifier();
+            console.log('rename',name,newNameId)
+            console.log(generator(path.parent).code)
             for (let referPath of binding.referencePaths) {
                 referPath.replaceWith(newNameId);
             }
@@ -517,9 +518,9 @@ for (let j = 0; j < 3; j++) {
             let {id, init} = declaration;
             if (!init) return
             if (!types.isIdentifier(init)) return;
-            if (init.name === '$d') {
-                debugger;
-            }
+            // if (init.name === '$d') {
+            //     debugger;
+            // }
 
             if (keys2.includes(init.name)) {
                 let t = newMap[init.name];
@@ -542,7 +543,7 @@ for (let j = 0; j < 3; j++) {
                 console.log(id.name, init.name, keys2.includes(init.name), binding.references)
 
 
-                if (id.name === 'zo') {
+                if (id.name === 'xc') {
                     // console.log(id.name, init.name, keys2.includes(init.name), binding.references)
                     debugger
                 }

ast/decode2.js

+const acorn = require('acorn')
+const fs = require('fs');
+const types = require("@babel/types");
+const parser = require("@babel/parser");
+const traverse = require("@babel/traverse").default;
+const generator = require("@babel/generator").default;
+
+
+//js混淆代码读取
+process.argv.length > 2 ? encodeFile = process.argv[2] : encodeFile = "./main.js";
+process.argv.length > 3 ? decodeFile = process.argv[3] : decodeFile = "./decodeResult.js";
+let sourceCode = fs.readFileSync(encodeFile, {encoding: "utf-8"});
+
+const ast = acorn.parse(sourceCode, {
+    sourceType:"script"
+})
+
+function walkNode(node, callback) {
+  callback(node)
+
+  // 有 type 字段的我们认为是一个节点
+  Object.keys(node).forEach((key) => {
+    const item = node[key]
+    if (Array.isArray(item)) {
+      item.forEach((sub) => {
+        sub.type && walkNode(sub, callback)
+      })
+    }
+
+    item && item.type && walkNode(item, callback)
+  })
+}
+
+walkNode(ast, function (e){
+    console.log(e)
+})
\ No newline at end of file

package-lock.json

@@ -9,6 +9,7 @@
       "version": "1.0.0",
       "license": "ISC",
       "dependencies": {
+        "acorn": "^8.10.0",
         "md5": "^2.3.0"
       },
       "devDependencies": {
@@ -365,6 +366,17 @@
         "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
+    "node_modules/acorn": {
+      "version": "8.10.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.10.0.tgz",
+      "integrity": "sha512-F0SAmZ8iUtS//m8DmCTA0jlh6TDKkHQyK6xc6V4KDTyZKA9dnvX9/3sRTVQrWm79glUAZbnmmNcdYwUIHWVybw==",
+      "bin": {
+        "acorn": "bin/acorn"
+      },
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
     "node_modules/ansi-styles": {
       "version": "3.2.1",
       "resolved": "https://registry.npmmirror.com/ansi-styles/-/ansi-styles-3.2.1.tgz",

package.json

@@ -9,6 +9,7 @@
   "author": "",
   "license": "ISC",
   "dependencies": {
+    "acorn": "^8.10.0",
     "md5": "^2.3.0"
   },
   "devDependencies": {

test.py

@@ -51,10 +51,10 @@ a = 'aUkQRhAIEGJqAwMHBgUQHhBWEAhJEGJqAwAGCwAQCBBRBwIHUQMCVwAEUwNQBVMFBQYDBgEFVlA
 a2 = "UAxQUAwMHD8QGFIcU1NQHAUZKlEpCg8JOTQHVC0KIg0tNCEULiQpUi4zUBgtNzYMLDQLGS0KKRQvJylSLiQICjk0C1AtNAwJKQkXCQQJKVYpDTUXLzQDGi40NgwsNDEZLgo1FC00Jgw6M1EILQoxUyw3Lg0uCggJLRopGi83KVAtGSkTKQ4xCS8KJVIvNClULhopGS0aNVUuCiETKQ0HCS8JKVIvJCYKOjc1Fy4aCA06CiYNLSQhUi4KIVEuNAQLLQ0lGi8nKVUvJDlRLQ0lUy03Mgs5NzlQOg01GS4kLgouDToJOiQqCi40AxgtGjVQOQ0tVC83JRgpDlBdHBQSFQUcU1BQHh4eHlBQUFBQUBwDFQ=="
 a2 = "UFBQUFBQHAMVHh4eHlAMUFAMDBw/EBhSHFNTUBwFGSpRKQoPCTkKOVMtNCVULTQlFC4NLVEvI1AYLSQtGCw3JRo6JCUULgoLGS4nJVQ6CjYKORotGikJFwkECSlWKQoECS8kOVIvJAMaLDQxGi0NKRQtNCYMOjNRCS8kOggsNzoJOg0tFy4NKVE5GjUaOgkpEykOMQkvCiVSLzQpVS40BxctJAcZLSQlEykNBwkvCSlULQopUjkaC1Q5NAgKOQoMDTo3MVIvJClTLRomCy0kNRguJzlULzQyCi43NRktJAQLOic1FzkKKVM5CggLLicqCzokMgo5NAMaOjcuCy0KOgwuDSlVKQ5QXRwUEhUFHFNQUA=="
 
-a2 = 'UFBQUFBQHAMVHh4eHlAMUFAMDBw/EBhSHFNTUBwFGSpRKQoPCS4kLRktCilRLQolFC4NLVEvI1AYLSQtGCw0B1UvNzUULzQpVC4KKVAtJykYLRopUSkJFwkECSlWKQ0lGDkKKRk6NCINLDQxUDkKCxQtNCYMOjNRCC80NgksNANTOiQmDS1SMRk6JzUaLgkpEykOMQkvCiVSLzQtGC0KA1QtNC0YLho1EykNBwkvCSlULzcxVTo3MgktNAMZLicqDDokMVIuGiYMORoLFy4KKRo5GjVULgoHUS80Ngg5NyYMOjQMDS8kJgguNzIJLjc2DDk0B1M6NAgKOjQlFzkaNVAuJDoIKQ5QXRwUEhUFHFNQUB4eHh5QDAwMUAwMUBxQ'
+a2 = "UlIrUitSHgEXHBwcHCsrKytSUh4BCA9aUAwLUA1WFlIQCBIKVldaUhwcHBxSKysrUisrKx5TVFtRUFBTUFNWWlJbHBwcHCsrKysrKx4EEh5UUh5THBwcHCtSUisrUh5THgcGBgNVVltST1ZXW1FPU1MHB09aA1UDT1tXA1VTAFtRBldXVh5VUltTHlFTWldVW1YDU1ZXUldbA1dSAFtXUgFbAVoGAwZVBldbWldWUgZRUFtUVQRSVQAAW1dTVQEAW1IDAVJaUFABVVtQBlpRUVYEVlpTB1MHUAMDBltWWgQHU1QAVFEDW1oBV1YDBlRQBgRbW1ZaUQEABgMGA1JUVwFRVgEBUAMEBFIEPVpQUVoeUh4sIxwcHBwrUitSK1IeUx4AAAMDBFVWUVZXUAADU1MAUFZRU1ZTAFBTW1IDVwBaAwYGBAcDUgNQUQMAUFZaAVcHUQBWW1tRW1ADVFoeV1cDVVIGAFJWBlUDUldVBgQDUgFWBwZbBARQUFNXVlBSAFJXUlUAUloBWwNSW1pTBlFVVwNTBwZSWlRTUwdbUB5TVB4EAw4RBxwcHBwrKysrKyseEAQeVFIeUxwcHBwrKysrKyseAQEeVFIeN1AkFjg0LBIGJTdbNiUkVi0VX18cHBwcKysrK1IrHgEBAVhRUlIcHBwcUisrK1IrK1IeVVtUVhwcHBwrUlIrKyseV1VQUFtUVVNVW1pXV1RQUFpXVlccHBwcUlIrKytSHlVRAwMGUVQEV1dRBFEBWgcHBlNaAAdSVFEABAZaAwMHVAMGVANUU1QHUgEGWwdXAAADAQdSBFEDBFJSAFJWUQM="
 
 
 
 b2 = base64.b64decode(a2.encode())
-for i in bytes(encrypt(b2, 96)).decode().split('~~~~'):
+for i in bytes(encrypt(b2, 96)).decode().split('||||'):
     print(i)