上一篇文章给出了 obfuscator混淆控制流平坦化
混淆前:
window = {};
window.atob = function(r) {
e = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
var o = String(r).replace(/=+$/, "");
if(o.length % 4 == 1) throw new t("'atob' failed: The string to be decoded is not correctly encoded.");
for(var n, a, i = 0, c = 0, d = ""; a = o.charAt(c++); ~a && (n = i % 4 ? 64 * n + a : a, i++ % 4) ? d += String.fromCharCode(255 & n >> (-2 * i & 6)) : 0) a = e.indexOf(a);
return d
}
混淆后:
window = {};
window.atob = function ($_0x3f12) {
var $_0xegb3 = 4;
while ($_0xegb3 != 5) {
switch ($_0xegb3) {
case 0:
return $_0xee94;
$_0xegb3 = 5;
break;
case 1:
var $_0xg5gf = String($_0x3f12).replace(/=+$/, "");
$_0xegb3 = 2;
break;
case 2:
if ($_0xg5gf.length % 4 == 1) throw new t("'atob' failed: The string to be decoded is not correctly encoded.");
$_0xegb3 = 3;
break;
case 3:
for (var $_0x7c25, $_0xa3c4, $_0xc8b9 = 0, $_0x22ed = 0, $_0xee94 = ""; $_0xa3c4 = $_0xg5gf.charAt($_0x22ed++); ~$_0xa3c4 && ($_0x7c25 = $_0xc8b9 % 4 ? 64 * $_0x7c25 + $_0xa3c4 : $_0xa3c4, $_0xc8b9++ % 4) ? $_0xee94 += String.fromCharCode(255 & $_0x7c25 >> (-2 * $_0xc8b9 & 6)) : 0) $_0xa3c4 = e.indexOf($_0xa3c4);
$_0xegb3 = 0;
break;
case 4:
e = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
$_0xegb3 = 1;
break;
}
}
};
更改很简单,只是将之前的分发器变了,不再以数组形式给出,而是在每个case语句下面重新赋值,获取下一个case分支。
这样,就让混淆代码复杂了些,如果case分支足够多,调试起来不那么容易。
混淆思路:
随机生成一个body长度的数组,用于打乱body执行顺序
构造一个VariableDeclaration节点,取上面的数组第一个元素作为初始值
构造BinaryExpression节点,取数组长度 + 1 作为结束值。
构造SwitchCase节点,注意分发器赋值为下一个数组元素
构造While节点,替换。
源代码:
https://t.zsxq.com/fA2zvjE
感谢阅读,欢迎关注本人微信公众号,学习更多AST混淆与解混淆知识。