470 lines
16 KiB
JavaScript
470 lines
16 KiB
JavaScript
/**
|
|
* hsw.js AST 解混淆脚本 v4
|
|
*
|
|
* 双解码器支持:
|
|
* - PW/QQ: base=311, 596条, rotation=275
|
|
* - Qg: base=438, 133条, 无旋转
|
|
*
|
|
* AST 遍历 passes:
|
|
* 1. 别名收集 (两个解码器各自的别名链)
|
|
* 2. 常量传播 + 解码替换
|
|
* 3. 属性访问简化: obj["prop"] → obj.prop
|
|
* 4. 字符串拼接折叠: "a".concat("b") → "ab"
|
|
* 5. 死代码清理
|
|
*/
|
|
|
|
const fs = require("fs");
|
|
const path = require("path");
|
|
const parser = require("@babel/parser");
|
|
const traverse = require("@babel/traverse").default;
|
|
const generate = require("@babel/generator").default;
|
|
const t = require("@babel/types");
|
|
|
|
const SRC = path.join(__dirname, "hsw.js");
|
|
const OUT = path.join(__dirname, "hsw.deobfuscated.js");
|
|
|
|
const src = fs.readFileSync(SRC, "utf-8");
|
|
|
|
// ═══════════════════════════════════════════
|
|
// Phase 1: 提取两个字符串数组 + 解码
|
|
// ═══════════════════════════════════════════
|
|
|
|
console.log("[*] Phase 1: 提取字符串数组...");
|
|
|
|
function decode(encoded) {
|
|
const chars =
|
|
"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=";
|
|
let raw = "";
|
|
let bc = 0;
|
|
let bs = 0;
|
|
let ch;
|
|
let idx = 0;
|
|
while ((ch = encoded.charAt(idx++))) {
|
|
ch = chars.indexOf(ch);
|
|
if (~ch) {
|
|
bs = bc % 4 ? 64 * bs + ch : ch;
|
|
if (bc++ % 4)
|
|
raw += String.fromCharCode(255 & (bs >> ((-2 * bc) & 6)));
|
|
}
|
|
}
|
|
let uri = "";
|
|
for (let i = 0; i < raw.length; i++)
|
|
uri += "%" + ("00" + raw.charCodeAt(i).toString(16)).slice(-2);
|
|
return decodeURIComponent(uri);
|
|
}
|
|
|
|
// ── 解码器 1: tH / QQ / PW (base=311, 有旋转) ──
|
|
|
|
const arr1Match = src.match(
|
|
/tH\s*=\s*function\s*\(\)\s*\{\s*var\s+Ig\s*=\s*\[([\s\S]*?)\];\s*return\s*\(\s*tH/
|
|
);
|
|
if (!arr1Match) { console.error("[-] 无法提取 tH 数组"); process.exit(1); }
|
|
|
|
const raw1 = eval(`[${arr1Match[1]}]`);
|
|
const decoded1 = raw1.map((s) => { try { return decode(s); } catch { return null; } });
|
|
console.log(`[+] 解码器1 (PW/QQ): ${raw1.length} 条, base=311`);
|
|
|
|
// 暴力搜索旋转
|
|
const BASE1 = 311;
|
|
const LEN1 = decoded1.length;
|
|
const lookup1 = (rot, idx) => decoded1[((((idx - BASE1 + rot) % LEN1) + LEN1) % LEN1)];
|
|
|
|
const constraints1 = [
|
|
[814, "length"], [507, "concat"], [606, "createElement"],
|
|
[675, "canvas"], [440, "prototype"], [719, "toString"],
|
|
[874, "call"], [532, "create"], [716, "test"],
|
|
[897, "width"], [811, "height"], [873, "toDataURL"],
|
|
];
|
|
|
|
let rot1 = -1;
|
|
for (let r = 0; r < LEN1; r++) {
|
|
if (constraints1.every(([i, e]) => lookup1(r, i) === e)) { rot1 = r; break; }
|
|
}
|
|
if (rot1 === -1) { console.error("[-] PW/QQ 旋转搜索失败"); process.exit(1); }
|
|
console.log(`[+] PW/QQ 旋转偏移: ${rot1}`);
|
|
|
|
const map1 = new Map();
|
|
for (let i = BASE1; i < BASE1 + LEN1; i++) {
|
|
const v = lookup1(rot1, i);
|
|
if (v != null) map1.set(i, v);
|
|
}
|
|
|
|
// ── 解码器 2: xf / Qg (base=438, 无旋转) ──
|
|
|
|
const arr2Match = src.match(
|
|
/xf\s*=\s*function\s*\(\)\s*\{\s*var\s+Ig\s*=\s*\[([\s\S]*?)\];\s*return\s*\(\s*xf/
|
|
);
|
|
if (!arr2Match) { console.error("[-] 无法提取 xf 数组"); process.exit(1); }
|
|
|
|
const raw2 = eval(`[${arr2Match[1]}]`);
|
|
const decoded2 = raw2.map((s) => { try { return decode(s); } catch { return null; } });
|
|
console.log(`[+] 解码器2 (Qg): ${raw2.length} 条, base=438`);
|
|
|
|
const BASE2 = 438;
|
|
const map2 = new Map();
|
|
for (let i = 0; i < decoded2.length; i++) {
|
|
if (decoded2[i] != null) map2.set(i + BASE2, decoded2[i]);
|
|
}
|
|
|
|
// 验证 Qg 的一些已知值
|
|
const constraints2 = [
|
|
[441, "length"], // Qg(441) 在 wasm 段出现大量
|
|
[439, "buffer"], // Qg(439)
|
|
[453, "name"], // Qg(453)
|
|
[456, "isArray"], // Array[Qg(456)]
|
|
[457, "exec"], // regex.exec
|
|
[447, "string"], // typeof === Qg(447)
|
|
[449, "constructor"],// Ig[Qg(449)]
|
|
[462, "message"], // Ig[Qg(462)]
|
|
[463, "stack"], // Ig[Qg(463)]
|
|
[476, "set"], // cP().set()
|
|
[467, "subarray"], // Ig[Qg(467)]
|
|
];
|
|
|
|
let c2pass = 0;
|
|
for (const [idx, exp] of constraints2) {
|
|
const act = map2.get(idx);
|
|
if (act === exp) c2pass++;
|
|
else console.log(` [!] Qg(${idx}): 期望 "${exp}", 实际 "${act}"`);
|
|
}
|
|
|
|
if (c2pass < constraints2.length) {
|
|
// 需要旋转
|
|
console.log(`[!] Qg 直接映射验证 ${c2pass}/${constraints2.length}, 尝试旋转搜索...`);
|
|
const LEN2 = decoded2.length;
|
|
let rot2 = -1;
|
|
for (let r = 0; r < LEN2; r++) {
|
|
const lk = (idx) => decoded2[((((idx - BASE2 + r) % LEN2) + LEN2) % LEN2)];
|
|
if (constraints2.every(([i, e]) => lk(i) === e)) { rot2 = r; break; }
|
|
}
|
|
if (rot2 !== -1 && rot2 !== 0) {
|
|
console.log(`[+] Qg 旋转偏移: ${rot2}`);
|
|
map2.clear();
|
|
for (let i = BASE2; i < BASE2 + LEN2; i++) {
|
|
const v = decoded2[((((i - BASE2 + rot2) % LEN2) + LEN2) % LEN2)];
|
|
if (v != null) map2.set(i, v);
|
|
}
|
|
}
|
|
}
|
|
|
|
console.log(`[+] 映射表: PW/QQ=${map1.size}条, Qg=${map2.size}条, 合计=${map1.size + map2.size}条`);
|
|
|
|
// ── 合并映射: 根据解码器名来分派 ──
|
|
|
|
// decoderGroup1: PW, QQ, 以及它们的别名 → 查 map1
|
|
// decoderGroup2: Qg, 以及它的别名 → 查 map2
|
|
|
|
const group1Names = new Set(["PW", "QQ"]);
|
|
const group2Names = new Set(["Qg"]);
|
|
|
|
function getMapForDecoder(name) {
|
|
if (group1Names.has(name)) return map1;
|
|
if (group2Names.has(name)) return map2;
|
|
return null;
|
|
}
|
|
|
|
// ═══════════════════════════════════════════
|
|
// Phase 2: 解析 AST
|
|
// ═══════════════════════════════════════════
|
|
|
|
console.log("[*] Phase 2: 解析 AST...");
|
|
|
|
const ast = parser.parse(src, {
|
|
sourceType: "script",
|
|
plugins: [],
|
|
errorRecovery: true,
|
|
});
|
|
console.log("[+] AST 解析完成");
|
|
|
|
// ═══════════════════════════════════════════
|
|
// Phase 3: Pass 1 — 别名收集 (两个解码器)
|
|
// ═══════════════════════════════════════════
|
|
|
|
console.log("[*] Phase 3: 收集解码器别名...");
|
|
|
|
// 追踪: var X = PW → X 属于 group1
|
|
// var Y = Qg → Y 属于 group2
|
|
// var Z = X → Z 属于 X 的 group
|
|
|
|
const allDecoders = new Set([...group1Names, ...group2Names]);
|
|
|
|
traverse(ast, {
|
|
VariableDeclarator(path) {
|
|
if (
|
|
t.isIdentifier(path.node.id) &&
|
|
t.isIdentifier(path.node.init) &&
|
|
allDecoders.has(path.node.init.name)
|
|
) {
|
|
const src = path.node.init.name;
|
|
const dst = path.node.id.name;
|
|
if (group1Names.has(src)) group1Names.add(dst);
|
|
else if (group2Names.has(src)) group2Names.add(dst);
|
|
allDecoders.add(dst);
|
|
}
|
|
},
|
|
AssignmentExpression(path) {
|
|
if (
|
|
t.isIdentifier(path.node.left) &&
|
|
t.isIdentifier(path.node.right) &&
|
|
allDecoders.has(path.node.right.name)
|
|
) {
|
|
const src = path.node.right.name;
|
|
const dst = path.node.left.name;
|
|
if (group1Names.has(src)) group1Names.add(dst);
|
|
else if (group2Names.has(src)) group2Names.add(dst);
|
|
allDecoders.add(dst);
|
|
}
|
|
},
|
|
});
|
|
|
|
// 多轮别名链传播
|
|
let prevSize;
|
|
do {
|
|
prevSize = allDecoders.size;
|
|
traverse(ast, {
|
|
noScope: true,
|
|
VariableDeclarator(path) {
|
|
if (
|
|
t.isIdentifier(path.node.id) &&
|
|
t.isIdentifier(path.node.init) &&
|
|
allDecoders.has(path.node.init.name) &&
|
|
!allDecoders.has(path.node.id.name)
|
|
) {
|
|
const s = path.node.init.name;
|
|
const d = path.node.id.name;
|
|
if (group1Names.has(s)) group1Names.add(d);
|
|
else if (group2Names.has(s)) group2Names.add(d);
|
|
allDecoders.add(d);
|
|
}
|
|
},
|
|
AssignmentExpression(path) {
|
|
if (
|
|
t.isIdentifier(path.node.left) &&
|
|
t.isIdentifier(path.node.right) &&
|
|
allDecoders.has(path.node.right.name) &&
|
|
!allDecoders.has(path.node.left.name)
|
|
) {
|
|
const s = path.node.right.name;
|
|
const d = path.node.left.name;
|
|
if (group1Names.has(s)) group1Names.add(d);
|
|
else if (group2Names.has(s)) group2Names.add(d);
|
|
allDecoders.add(d);
|
|
}
|
|
},
|
|
});
|
|
} while (allDecoders.size > prevSize);
|
|
|
|
console.log(`[+] 解码器1别名 (${group1Names.size}): ${[...group1Names].join(", ")}`);
|
|
console.log(`[+] 解码器2别名 (${group2Names.size}): ${[...group2Names].join(", ")}`);
|
|
|
|
// ═══════════════════════════════════════════
|
|
// Phase 4: Pass 2 — 常量传播 + 解码替换
|
|
// ═══════════════════════════════════════════
|
|
|
|
console.log("[*] Phase 4: 常量传播 + 字符串解码...");
|
|
|
|
let resolvedCount = 0;
|
|
let constPropCount = 0;
|
|
|
|
function resolveNumericValue(node, scopePath) {
|
|
if (t.isNumericLiteral(node)) return node.value;
|
|
if (t.isUnaryExpression(node) && node.operator === "-" && t.isNumericLiteral(node.argument)) {
|
|
return -node.argument.value;
|
|
}
|
|
if (t.isIdentifier(node)) {
|
|
const binding = scopePath.scope.getBinding(node.name);
|
|
if (binding && binding.constant && binding.path.isVariableDeclarator()) {
|
|
const init = binding.path.node.init;
|
|
if (t.isNumericLiteral(init)) return init.value;
|
|
}
|
|
// 非 constant binding 但 init 是数字且只赋值一次
|
|
if (binding && binding.path.isVariableDeclarator()) {
|
|
const init = binding.path.node.init;
|
|
if (t.isNumericLiteral(init) && !binding.constantViolations.length) {
|
|
return init.value;
|
|
}
|
|
}
|
|
}
|
|
return null;
|
|
}
|
|
|
|
traverse(ast, {
|
|
CallExpression(path) {
|
|
const callee = path.node.callee;
|
|
if (
|
|
t.isIdentifier(callee) &&
|
|
allDecoders.has(callee.name) &&
|
|
path.node.arguments.length >= 1
|
|
) {
|
|
const arg = path.node.arguments[0];
|
|
const numVal = resolveNumericValue(arg, path);
|
|
if (numVal === null) return;
|
|
|
|
const map = getMapForDecoder(callee.name);
|
|
if (!map) return;
|
|
|
|
if (map.has(numVal)) {
|
|
path.replaceWith(t.stringLiteral(map.get(numVal)));
|
|
resolvedCount++;
|
|
if (!t.isNumericLiteral(arg)) constPropCount++;
|
|
}
|
|
}
|
|
},
|
|
});
|
|
|
|
console.log(`[+] 解码替换: ${resolvedCount} (常量传播: ${constPropCount})`);
|
|
|
|
// ═══════════════════════════════════════════
|
|
// Phase 5: Pass 3 — 属性简化
|
|
// ═══════════════════════════════════════════
|
|
|
|
console.log("[*] Phase 5: 属性访问简化...");
|
|
|
|
let memberCount = 0;
|
|
const RESERVED = new Set([
|
|
"break","case","catch","continue","debugger","default","delete","do",
|
|
"else","finally","for","function","if","in","instanceof","new","return",
|
|
"switch","this","throw","try","typeof","var","void","while","with",
|
|
"class","const","enum","export","extends","import","super","implements",
|
|
"interface","let","package","private","protected","public","static","yield",
|
|
]);
|
|
|
|
traverse(ast, {
|
|
MemberExpression(path) {
|
|
if (
|
|
path.node.computed &&
|
|
t.isStringLiteral(path.node.property) &&
|
|
/^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(path.node.property.value) &&
|
|
!RESERVED.has(path.node.property.value)
|
|
) {
|
|
path.node.computed = false;
|
|
path.node.property = t.identifier(path.node.property.value);
|
|
memberCount++;
|
|
}
|
|
},
|
|
});
|
|
|
|
console.log(`[+] 属性简化: ${memberCount}`);
|
|
|
|
// ═══════════════════════════════════════════
|
|
// Phase 6: Pass 4 — 字符串拼接折叠
|
|
// ═══════════════════════════════════════════
|
|
|
|
console.log("[*] Phase 6: 字符串拼接折叠...");
|
|
|
|
let concatCount = 0;
|
|
let round;
|
|
do {
|
|
round = 0;
|
|
traverse(ast, {
|
|
CallExpression(path) {
|
|
if (
|
|
t.isMemberExpression(path.node.callee) &&
|
|
!path.node.callee.computed &&
|
|
t.isIdentifier(path.node.callee.property, { name: "concat" }) &&
|
|
t.isStringLiteral(path.node.callee.object) &&
|
|
path.node.arguments.length === 1 &&
|
|
t.isStringLiteral(path.node.arguments[0])
|
|
) {
|
|
path.replaceWith(
|
|
t.stringLiteral(
|
|
path.node.callee.object.value + path.node.arguments[0].value
|
|
)
|
|
);
|
|
round++;
|
|
}
|
|
},
|
|
});
|
|
concatCount += round;
|
|
} while (round > 0);
|
|
|
|
console.log(`[+] 拼接折叠: ${concatCount}`);
|
|
|
|
// ═══════════════════════════════════════════
|
|
// Phase 7: Pass 5 — 常量折叠 (typeof, 简单比较)
|
|
// ═══════════════════════════════════════════
|
|
|
|
console.log("[*] Phase 7: 常量表达式折叠...");
|
|
|
|
let constFoldCount = 0;
|
|
|
|
traverse(ast, {
|
|
// "string" == typeof x → 保留 (运行时), 但 typeof "xxx" → "string"
|
|
UnaryExpression(path) {
|
|
if (path.node.operator === "typeof" && t.isStringLiteral(path.node.argument)) {
|
|
path.replaceWith(t.stringLiteral("string"));
|
|
constFoldCount++;
|
|
}
|
|
},
|
|
// void 0 → undefined (可选, 增加可读性)
|
|
// 暂时不做, 可能影响语义
|
|
});
|
|
|
|
console.log(`[+] 常量折叠: ${constFoldCount}`);
|
|
|
|
// ═══════════════════════════════════════════
|
|
// Phase 8: Pass 6 — 清理无用别名声明
|
|
// ═══════════════════════════════════════════
|
|
|
|
console.log("[*] Phase 8: 清理无用别名...");
|
|
|
|
let deadCount = 0;
|
|
|
|
traverse(ast, {
|
|
VariableDeclarator(path) {
|
|
if (
|
|
t.isIdentifier(path.node.id) &&
|
|
t.isIdentifier(path.node.init) &&
|
|
allDecoders.has(path.node.init.name) &&
|
|
allDecoders.has(path.node.id.name)
|
|
) {
|
|
const binding = path.scope.getBinding(path.node.id.name);
|
|
if (binding && binding.references === 0) {
|
|
path.remove();
|
|
deadCount++;
|
|
}
|
|
}
|
|
},
|
|
});
|
|
|
|
console.log(`[+] 清理: ${deadCount}`);
|
|
|
|
// ═══════════════════════════════════════════
|
|
// Phase 9: 生成输出
|
|
// ═══════════════════════════════════════════
|
|
|
|
console.log("[*] Phase 9: 生成代码...");
|
|
|
|
const output = generate(ast, {
|
|
comments: true,
|
|
compact: false,
|
|
retainLines: false,
|
|
concise: false,
|
|
}).code;
|
|
|
|
fs.writeFileSync(OUT, output, "utf-8");
|
|
|
|
const origKB = (fs.statSync(SRC).size / 1024).toFixed(1);
|
|
const newKB = (Buffer.byteLength(output) / 1024).toFixed(1);
|
|
|
|
console.log(`\n${"═".repeat(50)}`);
|
|
console.log(`[=] 解混淆完成`);
|
|
console.log(` 原始: ${origKB} KB`);
|
|
console.log(` 输出: ${newKB} KB`);
|
|
console.log(` 解码替换: ${resolvedCount} (常量传播 ${constPropCount})`);
|
|
console.log(` 属性简化: ${memberCount}`);
|
|
console.log(` 拼接折叠: ${concatCount}`);
|
|
console.log(` 常量折叠: ${constFoldCount}`);
|
|
console.log(` 死代码清理: ${deadCount}`);
|
|
console.log(` PW/QQ 别名: ${group1Names.size} | Qg 别名: ${group2Names.size}`);
|
|
console.log(` 输出: ${OUT}`);
|
|
console.log(`${"═".repeat(50)}`);
|
|
|
|
// 导出映射表
|
|
const mapOut = path.join(__dirname, "hsw.string-map.json");
|
|
const mapObj = { "decoder1_PW_QQ": {}, "decoder2_Qg": {} };
|
|
for (const [k, v] of map1) mapObj.decoder1_PW_QQ[k] = v;
|
|
for (const [k, v] of map2) mapObj.decoder2_Qg[k] = v;
|
|
fs.writeFileSync(mapOut, JSON.stringify(mapObj, null, 2), "utf-8");
|
|
console.log(` 映射: ${mapOut}`);
|