echo094 / decode-js

JS混淆代码的AST分析工具 AST analysis tool for obfuscated JS code
MIT License
569 stars 301 forks source link

由于删除未使用变量导致的代码decode后无法运行 #33

Closed cesaryuan closed 10 months ago

cesaryuan commented 11 months ago

代码decode后无法运行(deob)

加密前:

var a = b = 1;
console.log(b);

加密后

var _0x432fe8=_0x275a;(function(_0x2afa35,_0x52149a){var _0x327968=_0x275a,_0x59550f=_0x2afa35();while(!![]){try{var _0xe096e0=parseInt(_0x327968(0x1c9))/0x1*(-parseInt(_0x327968(0x1cb))/0x2)+parseInt(_0x327968(0x1ce))/0x3*(-parseInt(_0x327968(0x1cc))/0x4)+parseInt(_0x327968(0x1d0))/0x5+-parseInt(_0x327968(0x1c7))/0x6*(parseInt(_0x327968(0x1c6))/0x7)+-parseInt(_0x327968(0x1cd))/0x8*(parseInt(_0x327968(0x1c8))/0x9)+-parseInt(_0x327968(0x1c5))/0xa+parseInt(_0x327968(0x1cf))/0xb;if(_0xe096e0===_0x52149a)break;else _0x59550f['push'](_0x59550f['shift']());}catch(_0x502dd4){_0x59550f['push'](_0x59550f['shift']());}}}(_0x53f9,0x87c82));var a=b=0x1;console[_0x432fe8(0x1ca)](b);function _0x275a(_0x2140fc,_0x5654b0){var _0x53f993=_0x53f9();return _0x275a=function(_0x275ad3,_0x23e9cb){_0x275ad3=_0x275ad3-0x1c5;var _0x3021f0=_0x53f993[_0x275ad3];return _0x3021f0;},_0x275a(_0x2140fc,_0x5654b0);}function _0x53f9(){var _0x4c23be=['2iokcjv','72gUVJNI','6220536iDaKAl','55743kpxwZK','38018860muobJB','525280zrFZCd','7495920oNGVhx','14fYtGiV','1788240RboHVw','9Fdycxs','547457NRCYen','log'];_0x53f9=function(){return _0x4c23be;};return _0x53f9();}

decode结果:console.log(b); 预期结果:var a = b = 1; console.log(b);

echo094 commented 11 months ago

好问题,我想想用什么办法删掉。

echo094 commented 11 months ago

例子中的定义方法只能运行在sloppy mode而无法运行在strict mode

babel-parser的options里面有strictMode的选项,但我试了一下,即使显式地传入false,任然无法对变量b正确解析。

babel关于sloppy mode的bug有很多,现在还有一个function定义无法冒泡到上层scope的问题(babel/babel#13549),这个问题在8.0.0版本中将被解决。

已在babel提了issue,在上游修复前只能先不删除这类变量了。

echo094 commented 11 months ago

babel的开发者回了,说是这种情况下变量b在global中,不在babel的修改范围内(好久没看文档了,早就忘了这茬事)。babel的讨论区也有一个处理这类变量的解决方案:babel/babel#11654,不过在我们这没必要做那么全面,我们只需要预处理一下,分离这种定义就行了。

cesaryuan commented 11 months ago

谢谢大佬哈哈,白天太忙没来得及看,感谢感谢