relative / synchrony

javascript-obfuscator cleaner & deobfuscator
https://deobfuscate.relative.im/
GNU General Public License v3.0
849 stars 109 forks source link

variable name change [request] #10

Closed bbday closed 2 years ago

bbday commented 3 years ago

Is possible add something to rename variables startwith (_0x) into names more easy? (it is so powerfull to make diff changes between file verions compare old/new code) probably best code is start from "a" on each local function like

var AAA = function() { { var aaa = !![]; var bbb = 44; var ccc = 333; }

var BBB = function() { { var aaa = []; var bbb = 45565; }

var _0x4c9014 = function () {
            var _0x29fca2 = !![];
            return function (_0x519fa5, _0x5d069d) {
                var _0x2a33ff = _0x29fca2 ? function () {
                    if (_0x5d069d) {
                        var _0x59f962 = _0x5d069d['apply'](_0x519fa5, arguments);
                        return _0x5d069d = null, _0x59f962;
                    }
                } : function () {
                };
                return _0x29fca2 = ![], _0x2a33ff;
            };
        }()

to

var p = function() {
            var q = !![];
            return function(r, s) {
                var t = q ? function() {
                    if (s) {
                        var u = s.apply(r, arguments);
                        return s = null, u;
                    }
                } : function() {};
                return q = ![], t;
            };
        }()

i found it in other script: https://github.com/sd-soleaio/deobfuscator-io/blob/6955343e9505336359c68dbad19d436cf507645d/src/deobfuscator.js#L154

Other idea is remove function used to decript name: 'StringDecoderTransformer', params: { identifiers: [['targetFunction', 0, targetFunction, 0]],

    var _0x4d615f = targetFunction; < should be removed cause was replaced
    if (typeof _0x2cc184 === "string") {
relative commented 3 years ago

Changing variable names is a feature I could implement but manual variable renaming is much faster and more reliable (with VSCode you can select a symbol and press f2 to change the var name and all references)

Other idea is remove function used to decript

Afaik setting removeReferences will remove the functions

anka-213 commented 3 years ago

I find that first automatically renaming all the variables to something shorter is very helpful, since you can get a better quick overview and see what variables are the same at a glance before doing the manual renaming.

bbday commented 3 years ago

the only issue is use "global" value check, instead rename only inside function (local) i mean it do like this:

function A1(a,b) { 
  var c = 1+2;
  var d = 3+ 4;
  return c+d+a+b
 }

 function B1(f,g) { 
  var h = 2+2;
  var i = 6+7;
  return h+i+f+g
 }

when should be

 function A1(a,b) { 
  var c = 1+2;
  var d = 3+ 4;
  return c+d+a+b
 }

 function B1(a,b) { 
  var c = 2+2;
  var d= 6+7;
  return c+d+a+b
 }

Then is more easy overview changes and make diff cause you have always same "local variables" name, because if you add new function between A1 - B1, it will use new variables name

relative commented 2 years ago

Other idea is remove function used to decript

This has been implemented in 2.0.1

Variable renaming is a lot easier (you can do it from the deobfuscator web ui because it uses monaco (vsc's editor), by pressing f2 after selecting a symbol.

however there are plans to implement automatic identifier renaming with type inference in an upcoming version

relative commented 2 years ago

implemented in https://github.com/relative/synchrony/releases/tag/2.3.0.

update with npm i --global deobfuscator@2.3.0 and run synchrony deobfuscate --rename ./file.js