echo094 / decode-js

JS混淆代码的AST分析工具 AST analysis tool for obfuscated JS code
MIT License
547 stars 295 forks source link

sojsonv7: update method for decoding string-array #52

Closed echo094 closed 8 months ago

echo094 commented 8 months ago

close #51

The string-array in sojsonv7 is similar to that in obfuscator, and several modifications are made.

In the previous version, the main components followed the format below:

// version string
var version_ = "jsjiami.com.v7";

// StringArray
function { stringArrayFunctionName } () {
  const { stringArrayName } = function () {
    return [version_, { stringArrayStorageItems }]
  }();
  { stringArrayFunctionName } = function () {
    return { stringArrayName };
  };
  return { stringArrayFunctionName }();
}

// StringArrayCallsWrapper
function { stringArrayCallsWrapperName } ({ stringArrayCacheName }, key) {
  const stringArray = { stringArrayFunctionName }();

  { stringArrayCallsWrapperName } = function (index, key) {
    index = index - { indexShiftAmount };

    let value = stringArray[index];

    { decodeCodeHelperTemplate }

    return value;
  };

  return { stringArrayCallsWrapperName }({ stringArrayCacheName }, key);
}

// StringArrayRotateFunction
((function (v21, v1, f1, v22) {
  return function (f1, v1) {
    const wrapper = stringArrayCallsWrapperName;
    const stringArray = f1()
  }(f1, v1, function () { })
})(cmp21, cmp1, stringArrayFunctionName, cmp22), stringArrayFunctionName) && (version_ = stringArrayFunctionName);

// version string again
var version_ = "jsjiami.com.v7";

In the updated version, the expression of StringArrayRotateFunction was modified (the right part of the LogicalExpression):

// StringArrayRotateFunction
((function (v21, v1, f1, v22) {
  return function (f1, v1) {
    const wrapper = stringArrayCallsWrapperName;
    const stringArray = f1()
  }(f1, v1, function () { })
})(cmp21, cmp1, stringArrayFunctionName, cmp22), stringArrayFunctionName) && (version_ = stringArrayCallsWrapperAlias(index, key));

The stringArrayCallsWrapperAlias is defined at the top of the code:

const stringArrayCallsWrapperAlias = stringArrayCallsWrapperName;

I think the update is a bugfix since the version_ will be a function in the previous version. Hence, the version checking will not function properly. After the update, the version_ will be equal to the version string.