MichaelXF / js-confuser

JS-Confuser is a JavaScript obfuscation tool to make your programs *impossible* to read.
https://js-confuser.com
MIT License
168 stars 28 forks source link

got inf loop with obfuscated code #123

Closed youdie323323 closed 4 months ago

youdie323323 commented 5 months ago

Describe the bug:

The program gets stuck in a infinite loop

Config and Small code sample

Config:

{
        target: "browser",
        verbose: true,
        preset: "medium",
}

Code:

new function () {
    var isSelf = 0;
    const __Reflect_apply = Reflect.apply
    const hook = (_class, blacklist, callback) => {
        Object.getOwnPropertyNames(_class).forEach(funcName => {
            if (!blacklist.includes(funcName) && typeof _class[funcName] === 'function') {
                try {
                    _class[funcName] = new Proxy(_class[funcName], {
                        apply(target, _this, args) {
                            if (isSelf === 1) return __Reflect_apply(target, _this, args);
                            if (new Error().stack.split("at ").slice(2).some(stackEntry => stackEntry.includes("dhdgffkkebhmkfjojejmpbldmpobfkfo/userscript.html"))) {
                                callback(target.name)
                            }
                            isSelf = 1;
                            const ret = __Reflect_apply(target, _this, args);
                            isSelf = 0;
                            return ret;
                        }
                    });
                } catch { }
            }
        });
    };
    hook(window, [], c)
    function c(name) {
        console.log(name + " was called by a tampermonkey script")
    }
}();

Expected behavior

The program should not get error "Uncaught RangeError: Maximum call stack size exceeded" and detect tampermonkey script (raw works fine)

Actual behavior

get error "Uncaught RangeError: Maximum call stack size exceeded" and not detect tampermonkey script

Example

Userscript code:

(function() {
    'use strict';
    alert("test")
})();

output (with non-obfuscated code):

alert was called by a tampermonkey script
youdie323323 commented 4 months ago

this solve when i disable stringEncoding, renameVariables