echo094 / decode-js

JS混淆代码的AST分析工具 AST analysis tool for obfuscated JS code
MIT License
717 stars 336 forks source link

sojsonv7: Update to support new version #64

Closed echo094 closed 1 year ago

echo094 commented 1 year ago

Supersede #52 Close #62 , #63 .

The string-array in sojsonv7 is similar to that in obfuscator, and several modifications are made.

In the previous version, the main components followed the format below:

// version string
var version_ = "jsjiami.com.v7";

// StringArray
function { stringArrayFunctionName } () {
  const { stringArrayName } = function () {
    return [version_, { stringArrayStorageItems }]
  }();
  { stringArrayFunctionName } = function () {
    return { stringArrayName };
  };
  return { stringArrayFunctionName }();
}

// StringArrayCallsWrapper
function { stringArrayCallsWrapperName } ({ stringArrayCacheName }, key) {
  const stringArray = { stringArrayFunctionName }();

  { stringArrayCallsWrapperName } = function (index, key) {
    index = index - { indexShiftAmount };

    let value = stringArray[index];

    { decodeCodeHelperTemplate }

    return value;
  };

  return { stringArrayCallsWrapperName }({ stringArrayCacheName }, key);
}

// StringArrayRotateFunction
((function (v21, v1, f1, v22) {
  return function (f1, v1) {
    const wrapper = stringArrayCallsWrapperName;
    const stringArray = f1()
  }(f1, v1, function () { })
})(cmp21, cmp1, stringArrayFunctionName, cmp22), stringArrayFunctionName) && (version_ = stringArrayFunctionName);

// version string again
var version_ = "jsjiami.com.v7";

In the updated version, the expression of StringArrayRotateFunction is enclosed in several forms:

  1. Still as the left of a LogicalExpression, which modifies the right AssignmentExpression: (#51)
{StringArrayRotateFunction} && (version_ = stringArrayCallsWrapperAlias(index, key));

The stringArrayCallsWrapperAlias is defined at the top of the code:

const stringArrayCallsWrapperAlias = stringArrayCallsWrapperName;
  1. Still as the left of a LogicalExpression, which modifies the right AssignmentExpression: (#63)
{StringArrayRotateFunction} && (version_ = {Literal});
  1. As the test node of an IfStatement: (#62)
if ({StringArrayRotateFunction}) {}

Actually, we don't have to care about the AssignmentExpression above, and it can be deleted safely. Meanwhile, we can identify the StringArrayRotateFunction by iterate the references of stringArrayFunctionName.