maierfelix / Iroh

Dynamic code analysis tool - Exploit, record and analyze running JavaScript
https://maierfelix.github.io/Iroh/
MIT License
926 stars 45 forks source link

Node support #5

Closed freeqaz closed 7 years ago

freeqaz commented 7 years ago

This library is awesome and I've started experimenting with how I can use this to build some dynamic analysis tools. My goal is to trace through requests in an Express app, which is all Node.

Currently, there are some shortcomings that prevent using this library in Node. There is an npm module published, though it seems to be outdated. The package.json also is missing an index path that allows a require statement to grab the code.

To fix this, something along the following lines should be done (which I might drop a PR for):

As I said, I might drop a PR to fix these. Wanted to highlight them before I sit down and foster a discussion. Let me know if you have any questions for me!

maierfelix commented 7 years ago

Hi there!

I have no idea how to link acorn as a dependency so I can do import acorn, this caused the third_party folder in the root and the clunky build.js file. I'd love to get rid of all this!

Sadly iroh is already a registered package name, so I decided to use irohjs for now - maybe the author of it is willed to transfer ownership.

I recently added a basic test to intercept require calls in theory here, so required code would get tracked too and can get linked to the main stage. However I'm not sure if that's the way to go or to let the user explicitly decide which code to track.

maierfelix commented 7 years ago

Update: the package author was so kind to transfer the ownership, iroh can now be used

maierfelix commented 7 years ago

Added node.js support with https://github.com/maierfelix/Iroh/commit/f42f96a37de09f3d26c8047843ab2ef0f5b17a38 npm install iroh should now work

freeqaz commented 7 years ago

Sweet, thank you for getting this sorted out!