@@ -102,7 +102,6 @@ function decodeGlobal(ast) {
102
102
string_var : null ,
103
103
string_path : null ,
104
104
def : [ ] ,
105
- rotate : { } ,
106
105
}
107
106
traverse ( ast , {
108
107
Identifier : ( path ) => {
@@ -141,32 +140,10 @@ function decodeGlobal(ast) {
141
140
console . info ( `Drop string table: ${ var_string_table } ` )
142
141
}
143
142
} else if ( up1 . isAssignmentExpression ( ) && path . key === 'left' ) {
144
- const right = up1 . get ( 'right' )
145
- const name = up1 . parentPath . get ( 'left.expressions.1.name' ) . node
146
- if ( right . isIdentifier ( ) ) {
147
- let top = up1
148
- while ( ! t . isProgram ( top . parentPath ) ) {
149
- top = top . parentPath
150
- }
151
- refs . rotate [ name ] = {
152
- code : [ top ] ,
153
- }
154
- } else if ( right . isCallExpression ( ) ) {
155
- const name2 = right . node . callee . name
156
- const path1 = right . scope . getBinding ( name2 ) . path
157
- const name1 = path1 . node . init . name
158
- let top = up1
159
- while ( ! t . isProgram ( top . parentPath ) ) {
160
- top = top . parentPath
161
- }
162
- refs . rotate [ name ] = {
163
- code : [ path1 . parentPath , top ] ,
164
- alias : name2 ,
165
- origin : name1 ,
166
- }
167
- } else {
168
- console . warn ( `Unexpected ref var_version: ${ up1 } ` )
169
- }
143
+ // We don't need to execute this reference
144
+ // Instead, we can delete it directly
145
+ const up2 = up1 . parentPath
146
+ up2 . replaceWith ( up2 . node . left )
170
147
} else {
171
148
console . warn ( `Unexpected ref var_version: ${ up1 } ` )
172
149
}
@@ -178,22 +155,36 @@ function decodeGlobal(ast) {
178
155
console . error ( 'Cannot find string table' )
179
156
return false
180
157
}
181
- // check if exists rotate function
182
- const var_rotate = refs . rotate [ var_string_table ]
183
- if ( var_rotate ) {
184
- for ( let rm of var_rotate . code ) {
185
- decrypt_code . push ( rm . node )
186
- rm . remove ( )
187
- }
188
- }
189
- // check if contains decrypt variable
158
+ // check if contains rotate function and decrypt variable
190
159
let decrypt_val
191
160
let binds = refs . string_path . scope . getBinding ( var_string_table )
161
+ // remove path of string table
162
+ decrypt_code [ 1 ] = refs . string_path . node
163
+ refs . string_path . remove ( )
164
+ // iterate refs
192
165
for ( let bind of binds . referencePaths ) {
193
166
if ( bind . findParent ( ( path ) => path . removed ) ) {
194
167
continue
195
168
}
196
169
const parent = bind . parentPath
170
+ if ( parent . isCallExpression ( ) && bind . listKey === 'arguments' ) {
171
+ // This is the rotate function.
172
+ // However, we can delete it later.
173
+ continue
174
+ }
175
+ if ( parent . isSequenceExpression ( ) ) {
176
+ // rotate function
177
+ decrypt_code . push ( t . expressionStatement ( parent . node ) )
178
+ const up2 = parent . parentPath
179
+ if ( up2 . isIfStatement ( ) ) {
180
+ // In the new version, rotate function will be enclosed by an
181
+ // empty IfStatement
182
+ up2 . remove ( )
183
+ } else {
184
+ parent . remove ( )
185
+ }
186
+ continue
187
+ }
197
188
if ( t . isVariableDeclarator ( parent . node ) ) {
198
189
// main decrypt val
199
190
let top = parent . getFunctionParent ( )
@@ -224,14 +215,6 @@ function decodeGlobal(ast) {
224
215
}
225
216
console . log ( `Main call wrapper name: ${ decrypt_val } ` )
226
217
227
- // remove path of string table
228
- let top = refs . string_path
229
- while ( top . parentPath . parentPath ) {
230
- top = top . parentPath
231
- }
232
- decrypt_code [ 1 ] = top . node
233
- top . remove ( )
234
-
235
218
// 运行解密语句
236
219
let content_code = ast . program . body
237
220
ast . program . body = decrypt_code
@@ -289,21 +272,6 @@ function decodeGlobal(ast) {
289
272
traverse ( ast , {
290
273
VariableDeclarator : dfs ,
291
274
} )
292
- // The decoding has finished in the old version
293
- if ( ! var_rotate ?. alias ) {
294
- return ast
295
- }
296
- // Since we removed a VariableDeclarator manually,
297
- // we need to decode from the alias
298
- cur_val = var_rotate . alias
299
- console . log ( `Main call wrapper alias: ${ cur_val } ` )
300
- traverse ( ast , {
301
- CallExpression : funToStr ,
302
- MemberExpression : memToStr ,
303
- } )
304
- traverse ( ast , {
305
- VariableDeclarator : dfs ,
306
- } )
307
275
return ast
308
276
}
309
277
0 commit comments