AST混淆与解混淆笔记：逗号表达式混淆

本文主要是作者记笔记为主，温故而知新，记录混淆和解混淆的代码，后期可能会更新文章细节
以以下代码为例：

function test(a, b){
	const c = "123";
	a = a + 1 // a
	a = a + 2
	a = a * 1234
	a = a.toString()
	a = a.substring(0, 3)
	b = a + "00"
	return b;
}
test(2)
console.log(test(1))

首先导入库

const fs = require('fs');
const parser = require("@babel/parser");
const traverse = require("@babel/traverse").default;
const types = require("@babel/types");
const generator = require("@babel/generator").default;

const jscode = fs.readFileSync("./test2.js", {
    encoding: "utf-8"
});
let ast = parser.parse(jscode);

本次就是将return语句增加改为逗号表达式，来混淆部分阅读逻辑

// 混淆代码，转为逗号表达式混淆
const obcommafun ={
    FunctionDeclaration(path){
        let block = path.node.body
        let statements = block.body
        douhao = []

        path.traverse({
            ExpressionStatement(path){
                douhao.push(path.node.expression)
                path.remove()
            }
        })
        let last = statements[statements.length - 1]
        let last_ret = types.ExpressionStatement(last.argument).expression
        douhao.push(last_ret)
        let seq = types.sequenceExpression(douhao)


        let ret = types.returnStatement(seq)
        console.log(generator(ret).code)
        // 替换原来的函数体
        path.traverse({
            ReturnStatement(path){
                path.replaceWith(ret)
                path.stop()
            }
        })

    }
}
traverse(ast, obcommafun)

混淆后代码如下：

function test(a, b) {
  const c = "123";
  // a
  return a = a + 1, a = a + 2, a = a * 1234, a = a.toString(), a = a.substring(0, 3), b = a + "00", b;
}
test(2);
console.log(test(1));

还原混淆的代码如下：

// 混淆代码，转为逗号表达式混淆(解混淆)
const obcommafun = {
    ReturnStatement(path) {
        // 找到return的逗号表达式语句
        path.traverse({
            SequenceExpression(path2) {
                let exps = path2.node.expressions
                console.log(111)
                        last_ret = exps[exps.length - 1]
                last_ret = types.ReturnStatement(last_ret)
                block = []
                for(let i = 0; i < exps.length - 1; i++){
                    block.push(types.ExpressionStatement(exps[i]))
                }
                block.push(last_ret)
                block = types.BlockStatement(block)
                path.replaceWith(block)

            }
        })

    }
}
traverse(ast, obcommafun)