@@ -102,7 +102,6 @@ function decodeGlobal(ast) {
102102 string_var : null ,
103103 string_path : null ,
104104 def : [ ] ,
105- rotate : { } ,
106105 }
107106 traverse ( ast , {
108107 Identifier : ( path ) => {
@@ -141,32 +140,10 @@ function decodeGlobal(ast) {
141140 console . info ( `Drop string table: ${ var_string_table } ` )
142141 }
143142 } else if ( up1 . isAssignmentExpression ( ) && path . key === 'left' ) {
144- const right = up1 . get ( 'right' )
145- const name = up1 . parentPath . get ( 'left.expressions.1.name' ) . node
146- if ( right . isIdentifier ( ) ) {
147- let top = up1
148- while ( ! t . isProgram ( top . parentPath ) ) {
149- top = top . parentPath
150- }
151- refs . rotate [ name ] = {
152- code : [ top ] ,
153- }
154- } else if ( right . isCallExpression ( ) ) {
155- const name2 = right . node . callee . name
156- const path1 = right . scope . getBinding ( name2 ) . path
157- const name1 = path1 . node . init . name
158- let top = up1
159- while ( ! t . isProgram ( top . parentPath ) ) {
160- top = top . parentPath
161- }
162- refs . rotate [ name ] = {
163- code : [ path1 . parentPath , top ] ,
164- alias : name2 ,
165- origin : name1 ,
166- }
167- } else {
168- console . warn ( `Unexpected ref var_version: ${ up1 } ` )
169- }
143+ // We don't need to execute this reference
144+ // Instead, we can delete it directly
145+ const up2 = up1 . parentPath
146+ up2 . replaceWith ( up2 . node . left )
170147 } else {
171148 console . warn ( `Unexpected ref var_version: ${ up1 } ` )
172149 }
@@ -178,22 +155,36 @@ function decodeGlobal(ast) {
178155 console . error ( 'Cannot find string table' )
179156 return false
180157 }
181- // check if exists rotate function
182- const var_rotate = refs . rotate [ var_string_table ]
183- if ( var_rotate ) {
184- for ( let rm of var_rotate . code ) {
185- decrypt_code . push ( rm . node )
186- rm . remove ( )
187- }
188- }
189- // check if contains decrypt variable
158+ // check if contains rotate function and decrypt variable
190159 let decrypt_val
191160 let binds = refs . string_path . scope . getBinding ( var_string_table )
161+ // remove path of string table
162+ decrypt_code [ 1 ] = refs . string_path . node
163+ refs . string_path . remove ( )
164+ // iterate refs
192165 for ( let bind of binds . referencePaths ) {
193166 if ( bind . findParent ( ( path ) => path . removed ) ) {
194167 continue
195168 }
196169 const parent = bind . parentPath
170+ if ( parent . isCallExpression ( ) && bind . listKey === 'arguments' ) {
171+ // This is the rotate function.
172+ // However, we can delete it later.
173+ continue
174+ }
175+ if ( parent . isSequenceExpression ( ) ) {
176+ // rotate function
177+ decrypt_code . push ( t . expressionStatement ( parent . node ) )
178+ const up2 = parent . parentPath
179+ if ( up2 . isIfStatement ( ) ) {
180+ // In the new version, rotate function will be enclosed by an
181+ // empty IfStatement
182+ up2 . remove ( )
183+ } else {
184+ parent . remove ( )
185+ }
186+ continue
187+ }
197188 if ( t . isVariableDeclarator ( parent . node ) ) {
198189 // main decrypt val
199190 let top = parent . getFunctionParent ( )
@@ -224,14 +215,6 @@ function decodeGlobal(ast) {
224215 }
225216 console . log ( `Main call wrapper name: ${ decrypt_val } ` )
226217
227- // remove path of string table
228- let top = refs . string_path
229- while ( top . parentPath . parentPath ) {
230- top = top . parentPath
231- }
232- decrypt_code [ 1 ] = top . node
233- top . remove ( )
234-
235218 // 运行解密语句
236219 let content_code = ast . program . body
237220 ast . program . body = decrypt_code
@@ -289,21 +272,6 @@ function decodeGlobal(ast) {
289272 traverse ( ast , {
290273 VariableDeclarator : dfs ,
291274 } )
292- // The decoding has finished in the old version
293- if ( ! var_rotate ?. alias ) {
294- return ast
295- }
296- // Since we removed a VariableDeclarator manually,
297- // we need to decode from the alias
298- cur_val = var_rotate . alias
299- console . log ( `Main call wrapper alias: ${ cur_val } ` )
300- traverse ( ast , {
301- CallExpression : funToStr ,
302- MemberExpression : memToStr ,
303- } )
304- traverse ( ast , {
305- VariableDeclarator : dfs ,
306- } )
307275 return ast
308276}
309277
0 commit comments