echo094 / decode-js

JS混淆代码的AST分析工具 AST analysis tool for obfuscated JS code
MIT License
547 stars 295 forks source link

obfuscator: improve string-array method for old version (<2.19.0) #55

Closed echo094 closed 8 months ago

echo094 commented 8 months ago

The string array is not wrapped in a function before 2.19.0. Hence, it's not suitable to identify the string array directly, and the fallback mode is made for this situation. However, the previous fallback mode cannot match the rotate function correctly in some cases (e.g. #50 ).

I have reworked this part based on the source code. The new method will traverse the CallExpression instead, which is the surface of the RotateFunction. After finding the RotateFunction, we can identify the StringArray and StringArrayCallsWrapper.

Besides, we have to identify three versions of StringArrayCallsWrapper: