【JS逆向解混淆】利用AST还原字符串花指令

const fs = require('fs')
const parser = require('@babel/parser')
const traverse = require('@babel/traverse').default
const t = require('@babel/types')
const generator = require('@babel/generator').default

let jscode = fs.readFileSync('./initCode.js', { encoding: 'utf-8' }).toString()

let ast = parser.parse(jscode)

let totalObj = {}  //提取所有对象表达式

function generatorObj(ast){
    traverse(ast,{
        VariableDeclarator(path){
            if(t.isObjectExpression(path.node.init)){
                let objName = path.node.id.name
                if(!totalObj[objName])totalObj[objName]={}
                
                path.node.init.properties.map(p=>{
                        totalObj[objName][p.key.value] = p.value
                    }
                )
            }
        }
    })
}

generatorObj(ast)

traverse(ast,{
    VariableDeclarator(path){
        if(t.isObjectExpression(path.node.init)){
            path.node.init.properties.map(property=>{
                let realNode = findRealValue(property.value)
                realNode && (property.value = realNode)
            })
        }
    }
})

function findRealValue(node){ //找到真实节点
    if(t.isMemberExpression(node) && node.computed == true){
        let key = node.object.name
        let value = node.property.value
        if(totalObj[key] && totalObj[key][value]){s
            return findRealValue(totalObj[key][value])
        }else{
            false
        }
    }else{
        return node
    }
}

generatorObj(ast)

traverse(ast,{
   MemberExpression(path){
        let objName = path.node.object.name
        let propValue = path.node.property.value
        totalObj[objName] && t.isStringLiteral(totalObj[objName][propValue]) && path.replaceInline(totalObj[objName][propValue])
   }
})

let code = generator(ast).code

fs.writeFileSync('./newCode.js', code)