Skip to content

Commit d2a4586

Browse files
authored
sojsonv7: Update to support new version (#64)
Signed-off-by: echo094 <20028238+echo094@users.noreply.github.com>
1 parent 70b6715 commit d2a4586

File tree

1 file changed

+27
-59
lines changed

1 file changed

+27
-59
lines changed

src/plugin/sojsonv7.js

Lines changed: 27 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,6 @@ function decodeGlobal(ast) {
102102
string_var: null,
103103
string_path: null,
104104
def: [],
105-
rotate: {},
106105
}
107106
traverse(ast, {
108107
Identifier: (path) => {
@@ -141,32 +140,10 @@ function decodeGlobal(ast) {
141140
console.info(`Drop string table: ${var_string_table}`)
142141
}
143142
} else if (up1.isAssignmentExpression() && path.key === 'left') {
144-
const right = up1.get('right')
145-
const name = up1.parentPath.get('left.expressions.1.name').node
146-
if (right.isIdentifier()) {
147-
let top = up1
148-
while (!t.isProgram(top.parentPath)) {
149-
top = top.parentPath
150-
}
151-
refs.rotate[name] = {
152-
code: [top],
153-
}
154-
} else if (right.isCallExpression()) {
155-
const name2 = right.node.callee.name
156-
const path1 = right.scope.getBinding(name2).path
157-
const name1 = path1.node.init.name
158-
let top = up1
159-
while (!t.isProgram(top.parentPath)) {
160-
top = top.parentPath
161-
}
162-
refs.rotate[name] = {
163-
code: [path1.parentPath, top],
164-
alias: name2,
165-
origin: name1,
166-
}
167-
} else {
168-
console.warn(`Unexpected ref var_version: ${up1}`)
169-
}
143+
// We don't need to execute this reference
144+
// Instead, we can delete it directly
145+
const up2 = up1.parentPath
146+
up2.replaceWith(up2.node.left)
170147
} else {
171148
console.warn(`Unexpected ref var_version: ${up1}`)
172149
}
@@ -178,22 +155,36 @@ function decodeGlobal(ast) {
178155
console.error('Cannot find string table')
179156
return false
180157
}
181-
// check if exists rotate function
182-
const var_rotate = refs.rotate[var_string_table]
183-
if (var_rotate) {
184-
for (let rm of var_rotate.code) {
185-
decrypt_code.push(rm.node)
186-
rm.remove()
187-
}
188-
}
189-
// check if contains decrypt variable
158+
// check if contains rotate function and decrypt variable
190159
let decrypt_val
191160
let binds = refs.string_path.scope.getBinding(var_string_table)
161+
// remove path of string table
162+
decrypt_code[1] = refs.string_path.node
163+
refs.string_path.remove()
164+
// iterate refs
192165
for (let bind of binds.referencePaths) {
193166
if (bind.findParent((path) => path.removed)) {
194167
continue
195168
}
196169
const parent = bind.parentPath
170+
if (parent.isCallExpression() && bind.listKey === 'arguments') {
171+
// This is the rotate function.
172+
// However, we can delete it later.
173+
continue
174+
}
175+
if (parent.isSequenceExpression()) {
176+
// rotate function
177+
decrypt_code.push(t.expressionStatement(parent.node))
178+
const up2 = parent.parentPath
179+
if (up2.isIfStatement()) {
180+
// In the new version, rotate function will be enclosed by an
181+
// empty IfStatement
182+
up2.remove()
183+
} else {
184+
parent.remove()
185+
}
186+
continue
187+
}
197188
if (t.isVariableDeclarator(parent.node)) {
198189
// main decrypt val
199190
let top = parent.getFunctionParent()
@@ -224,14 +215,6 @@ function decodeGlobal(ast) {
224215
}
225216
console.log(`Main call wrapper name: ${decrypt_val}`)
226217

227-
// remove path of string table
228-
let top = refs.string_path
229-
while (top.parentPath.parentPath) {
230-
top = top.parentPath
231-
}
232-
decrypt_code[1] = top.node
233-
top.remove()
234-
235218
// 运行解密语句
236219
let content_code = ast.program.body
237220
ast.program.body = decrypt_code
@@ -289,21 +272,6 @@ function decodeGlobal(ast) {
289272
traverse(ast, {
290273
VariableDeclarator: dfs,
291274
})
292-
// The decoding has finished in the old version
293-
if (!var_rotate?.alias) {
294-
return ast
295-
}
296-
// Since we removed a VariableDeclarator manually,
297-
// we need to decode from the alias
298-
cur_val = var_rotate.alias
299-
console.log(`Main call wrapper alias: ${cur_val}`)
300-
traverse(ast, {
301-
CallExpression: funToStr,
302-
MemberExpression: memToStr,
303-
})
304-
traverse(ast, {
305-
VariableDeclarator: dfs,
306-
})
307275
return ast
308276
}
309277

0 commit comments

Comments
 (0)