JavaScript反混淆插件十:删除DeadCode

最新推荐文章于 2022-09-01 23:22:52 发布

悦来客栈的老板

最新推荐文章于 2022-09-01 23:22:52 发布

阅读量1.5k

点赞数

文章标签： js eclipse javascript 操作系统 bug

本文链接：https://blog.csdn.net/qq523176585/article/details/114650665

版权

在还原部分著名的 obfuscator 混淆代码后，会遗留类似下面这样的代码:

if ("jZPVk" !== "boYNa") {
    var _0x115fe4 = _0x46f96b ? function() {
        var _0x42130b = {
            "mLuUC": "2|1|5|0|4|3"
        };


        if ("esUCW" !== "YVaOc") {
            if (_0x64f451) {
                if ("VPudA" !== "PlTuN") {
                    var _0x2a304c = _0x64f451["apply"](_0x40f1bc, arguments);


                    _0x64f451 = null;
                    return _0x2a304c;
                } else {
                    function _0x2d452d() {
                        var _0x3f7283 = "2|1|5|0|4|3"["split"]('|')
                          , _0x4c2460 = 0;


                        var _0x17e744 = _0x5d33d5["constructor"]["prototype"]["bind"](_0x476920);


                        var _0x219476 = _0x115ed3[_0x53f8ef];


                        var _0x268b00 = _0x1dbdcc[_0x219476] || _0x17e744;


                        _0x17e744["__proto__"] = _0x559202["bind"](_0x4e83d7);
                        _0x17e744["toString"] = _0x268b00["toString"]["bind"](_0x268b00);
                        _0x15fb48[_0x219476] = _0x17e744;
                    }
                }
            }
        } else {
            function _0x2b55e5() {
                sloYzO["PgbPP"](_0xb1234d, 0);
            }
        }
    }
    : function() {}
    ;


    _0x46f96b = false;
    return _0x115fe4;
} else {
    function _0x4e016() {
        sloYzO["RgqlK"](_0x6358d1);
    }
}

可以看到，有很多的类似下面的代码:

if ("jZPVk" !== "boYNa")
{
//...........
}
else
{
//...
}

这里的if条件恒为真，所以永远不会执行else里面的代码，我愿意称其为 DeadCode。在简化代码时，肯定会将其删除。

插件功能

删除代码中永远不会执行的代码片段。

处理实例

处理前:

if ("jZPVk" !== "boYNa") {
    var _0x115fe4 = _0x46f96b ? function() {
        var _0x42130b = {
            "mLuUC": "2|1|5|0|4|3"
        };


        if ("esUCW" !== "YVaOc") {
            if (_0x64f451) {
                if ("VPudA" !== "PlTuN") {
                    var _0x2a304c = _0x64f451["apply"](_0x40f1bc, arguments);


                    _0x64f451 = null;
                    return _0x2a304c;
                } else {
                    function _0x2d452d() {
                        var _0x3f7283 = "2|1|5|0|4|3"["split"]('|')
                          , _0x4c2460 = 0;


                        var _0x17e744 = _0x5d33d5["constructor"]["prototype"]["bind"](_0x476920);


                        var _0x219476 = _0x115ed3[_0x53f8ef];


                        var _0x268b00 = _0x1dbdcc[_0x219476] || _0x17e744;


                        _0x17e744["__proto__"] = _0x559202["bind"](_0x4e83d7);
                        _0x17e744["toString"] = _0x268b00["toString"]["bind"](_0x268b00);
                        _0x15fb48[_0x219476] = _0x17e744;
                    }
                }
            }
        } else {
            function _0x2b55e5() {
                sloYzO["PgbPP"](_0xb1234d, 0);
            }
        }
    }
    : function() {}
    ;


    _0x46f96b = false;
    return _0x115fe4;
} else {
    function _0x4e016() {
        sloYzO["RgqlK"](_0x6358d1);
    }
}

处理后:

var _0x115fe4 = _0x46f96b ? function() {
    var _0x42130b = {
        "mLuUC": "2|1|5|0|4|3"
    };
    {
        if (_0x64f451) {
            {
                var _0x2a304c = _0x64f451["apply"](_0x40f1bc, arguments);


                _0x64f451 = null;
                return _0x2a304c;
            }
        }
    }
}
: function() {}
;


_0x46f96b = false;
return _0x115fe4;

通过比对发现，处理后的代码，可读性明显提升了不少。