AST混淆与解混淆笔记：字符串访问改为数组混淆

本文主要是作者记笔记为主，温故而知新，记录混淆和解混淆的代码，后期可能会更新文章细节
以以下代码为例：

function test(a, b){
	const c = "123";
	a = a + 1 // a
	a = a + 2
	a = a * 1234
	a = a.toString()
	a = a.substring(0, 3)
	b = a + "00"
	return b;
}
test(2)
console.log(test(1))

首先导入库

const fs = require('fs');
const parser = require("@babel/parser");
const traverse = require("@babel/traverse").default;
const types = require("@babel/types");
const generator = require("@babel/generator").default;

const jscode = fs.readFileSync("./test2.js", {
    encoding: "utf-8"
});
let ast = parser.parse(jscode);

首先将.toString , substring这些属性访问方式修改为括号方式后，建立一个大数组，将所有字符串放入大数组，以大数组下标的方式访问，混淆代码如下：

// 混淆代码，将访问的属性名改为括号访问形式
const obvarfun = {
    MemberExpression(path) {
        if (types.isIdentifier(path.node.property)) {
            path.node.property = types.stringLiteral(path.node.property.name);
        }
        path.node.computed = true;
    }
}

traverse(ast, obvarfun)

// 混淆代码，将加密后的字符串放入数组中，以数组形式访问
let bigarr = []
const obstrarrfun ={
    StringLiteral(path){
        if (types.isStringLiteral(path.node)) {
            let result = path.node.value
            if (bigarr.indexOf(result) == -1) {
                bigarr.push(result)
            }
            let index = bigarr.indexOf(result)
            let strcall = types.memberExpression(types.identifier("bigarr"), types.numericLiteral(index), true)
            path.replaceWith(strcall);
        }
        path.skip()
    }
}
traverse(ast, obstrarrfun)

混淆后的代码如下：

var bigarr = ["123","toString","substring","00","log"];
function test(a, b) {
  const c = bigarr[0];
  a = a + 1; // a
  a = a + 2;
  a = a * 1234;
  a = a[bigarr[1]]();
  a = a[bigarr[2]](0, 3);
  b = a + bigarr[3];
  return b;
}
test(2);
console[bigarr[4]](test(1));

还原混淆的代码如下：

// 混淆代码，将加密后的字符串放入数组中，以数组形式访问(解混淆)
const obstrarrfun = {
    MemberExpression(path) {
        //console.log(path.node.property)
        if (types.isMemberExpression(path.node) && types.isNumericLiteral(path.node.property)) {
            let arr = path.node.object.name;
            let value = path.node.property.value
            //console.log(arr,value)

            // 寻找大数组
            const processBigarrVariable = zhaobigarrfun.VariableDeclarator(arr);
            traverse(ast, {
                VariableDeclarator: processBigarrVariable
            });
            let result = bigarr[value]
            if (typeof result == "string") {
                path.replaceWith(types.StringLiteral(result));
            } else if (typeof result == "number") {
                path.replaceWith(types.numericLiteral(result));
            }

        }
    }
}
traverse(ast, obstrarrfun)

// 混淆代码，将访问的属性名改为括号访问形式(解混淆）
const obvarfun = {
    MemberExpression(path) {
        //(path.node.property)
       if (types.isStringLiteral(path.node.property)) {
            //console.log(path.node.property.name)
            path.node.property = types.Identifier(path.node.property.value);
       }
       path.node.computed = false;
    }
}
traverse(ast, obvarfun)