PerimeterX / restringer

A Javascript Deobfuscator
MIT License
346 stars 37 forks source link

escodgen is not up to date #106

Open BenBaryoPX opened 10 months ago

BenBaryoPX commented 10 months ago

escodegen is not up to date with the newest ECMAScript nodes, so it fails on a PrivateIdentifier AST node.

Adding

class WithPriv{
 #privateId = 1;
}

to the array_function_replacements_local_proxies.js test case from obfuscation-detection gives an error

[+] Obfuscation type is array_function_replacements
    [+] rearrangeSequences committed 3 new changes!
[-] Unable to apply changes to AST: TypeError: this[type] is not a function
    [+] separateChainedDeclarators committed 4 new changes!
[+] Applying changes to the root node...
[-] Unable to apply changes to AST: TypeError: this[type] is not a function
    [+] resolveProxyVariables committed 1192 new changes!
[-] Unable to apply changes to AST: TypeError: this[type] is not a function
    [+] resolveProxyReferences committed 1 new changes!
[-] Unable to apply changes to AST: TypeError: this[type] is not a function
    [+] replaceBooleanExpressionsWithIf committed 4 new changes!
[-] Unable to apply changes to AST: TypeError: this[type] is not a function
    [+] replaceSequencesWithExpressions committed 5 new changes!
[-] Unable to apply changes to AST: TypeError: this[type] is not a function

However, overriding the version of escodegen to use in package.json like so:

    "overrides":{
      "escodegen":"npm:@javascript-obfuscator/escodegen"
  },

fixes the problem. I am trying to see if this fixes the talon_sdk.js file as well, but the file is so big that it has been running for a long time already.

Originally posted by @jorants in https://github.com/PerimeterX/restringer/issues/64#issuecomment-1885031962

BenBaryoPX commented 10 months ago

While I do feel it's important to support the latest, I want to find a different package that is maintained and reputable, rather than a static fix

j4k0xb commented 10 months ago

I haven't tried it yet but https://github.com/davidbonnet/astring looks promising and is much faster