AST混淆实战|仿obfuscator混淆控制流平坦化(加强版)

上一篇文章给出了 obfuscator混淆控制流平坦化

混淆前:

window = {};
window.atob = function(r) {
    e = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
    var o = String(r).replace(/=+$/, "");
    if(o.length % 4 == 1) throw new t("'atob' failed: The string to be decoded is not correctly encoded.");
    for(var n, a, i = 0, c = 0, d = ""; a = o.charAt(c++); ~a && (n = i % 4 ? 64 * n + a : a, i++ % 4) ? d += String.fromCharCode(255 & n >> (-2 * i & 6)) : 0) a = e.indexOf(a);
    return d
}

混淆后:

window = {};


window.atob = function ($_0x3f12) {
  var $_0xegb3 = 4;


  while ($_0xegb3 != 5) {
    switch ($_0xegb3) {
      case 0:
        return $_0xee94;
        $_0xegb3 = 5;
        break;


      case 1:
        var $_0xg5gf = String($_0x3f12).replace(/=+$/, "");
        $_0xegb3 = 2;
        break;


      case 2:
        if ($_0xg5gf.length % 4 == 1) throw new t("'atob' failed: The string to be decoded is not correctly encoded.");
        $_0xegb3 = 3;
        break;


      case 3:
        for (var $_0x7c25, $_0xa3c4, $_0xc8b9 = 0, $_0x22ed = 0, $_0xee94 = ""; $_0xa3c4 = $_0xg5gf.charAt($_0x22ed++); ~$_0xa3c4 && ($_0x7c25 = $_0xc8b9 % 4 ? 64 * $_0x7c25 + $_0xa3c4 : $_0xa3c4, $_0xc8b9++ % 4) ? $_0xee94 += String.fromCharCode(255 & $_0x7c25 >> (-2 * $_0xc8b9 & 6)) : 0) $_0xa3c4 = e.indexOf($_0xa3c4);


        $_0xegb3 = 0;
        break;


      case 4:
        e = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
        $_0xegb3 = 1;
        break;
    }
  }
};

更改很简单，只是将之前的分发器变了，不再以数组形式给出，而是在每个case语句下面重新赋值，获取下一个case分支。

这样，就让混淆代码复杂了些，如果case分支足够多，调试起来不那么容易。

混淆思路:

1. 随机生成一个body长度的数组，用于打乱body执行顺序
   

2. 构造一个VariableDeclaration节点，取上面的数组第一个元素作为初始值

3. 构造BinaryExpression节点，取数组长度 + 1 作为结束值。

4. 构造SwitchCase节点，注意分发器赋值为下一个数组元素

5. 构造While节点，替换。
   

源代码:

https://t.zsxq.com/fA2zvjE

感谢阅读，欢迎关注本人微信公众号，学习更多AST混淆与解混淆知识。