Skip to content

Commit a190c92

Browse files
committed
obfuscator: support matching formatted string array function #66
Signed-off-by: echo094 <20028238+echo094@users.noreply.github.com>
1 parent 031d4af commit a190c92

File tree

1 file changed

+16
-11
lines changed

1 file changed

+16
-11
lines changed

src/plugin/obfuscator.js

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -211,14 +211,15 @@ function stringArrayV3(ast) {
211211
let ob_func_str = []
212212
let ob_dec_name = []
213213
let ob_string_func_name = null
214-
// **Prefer** Find the string list func ("func1") by matching its feature:
214+
// Normally, the string array func ("func1") follows the template below:
215215
// function aaa() {
216216
// const bbb = [...]
217217
// aaa = function () {
218218
// return bbb;
219219
// };
220220
// return aaa();
221221
// }
222+
// In some cases (lint), the assignment is merged into the ReturnStatement
222223
// After finding the possible func1, this method will check all the binding
223224
// references and put the child encode function into list.
224225
function find_string_array_function(path) {
@@ -228,29 +229,33 @@ function stringArrayV3(ast) {
228229
if (
229230
!t.isIdentifier(path.node.id) ||
230231
path.node.params.length ||
231-
!t.isBlockStatement(path.node.body) ||
232-
path.node.body.body.length != 3
232+
!t.isBlockStatement(path.node.body)
233233
) {
234234
return
235235
}
236+
const body = path.node.body.body
237+
if (body.length < 2 || body.length > 3) {
238+
return
239+
}
236240
const name_func = path.node.id.name
237241
let string_var = -1
238-
const body = path.node.body.body
239242
try {
240243
if (
241244
body[0].declarations.length != 1 ||
242245
!(string_var = body[0].declarations[0].id.name) ||
243-
!t.isArrayExpression(body[0].declarations[0].init) ||
244-
name_func != body[1].expression.left.name ||
245-
body[1].expression.right.params.length ||
246-
string_var != body[1].expression.right.body.body[0].argument.name ||
247-
body[2].argument.arguments.length ||
248-
name_func != body[2].argument.callee.name
246+
!t.isArrayExpression(body[0].declarations[0].init)
249247
) {
250248
return
251249
}
250+
const nodes = [...body]
251+
nodes.shift()
252+
const code = generator(t.BlockStatement(nodes)).code
253+
const fp = `${name_func}=function(){return${string_var}}${name_func}()`
254+
if (!checkPattern(code, fp)) {
255+
return
256+
}
252257
} catch {
253-
//
258+
return
254259
}
255260
const binding = path.scope.getBinding(name_func)
256261
if (!binding.referencePaths) {

0 commit comments

Comments
 (0)