merge pull request #9 from lorenzoferre/vm-module

evaluation of functions with literal node type as inputs

src/deobfuscator.js

@@ -16,6 +16,7 @@ import replaceNullToUndefined from "./techniques/replace-null-to-undefined.js";
 import evaluateConditionStatement from "./techniques/evaluate-condition-statement.js";
 import controlFlowUnflattening from "./techniques/control-flow-unflattening.js";
 import removeEmptyStatement from "./techniques/remove-empty-statement.js";
+import evaluateFunction from "./techniques/evaluate-function.js";
 
 export default function deobfuscate(code) {
   do {
@@ -38,6 +39,7 @@ export default function deobfuscate(code) {
         evaluateConditionStatement,
         controlFlowUnflattening,
         removeEmptyStatement,
+        evaluateFunction,
       ],
       comments: false,
       compact: false,

src/techniques/evaluate-function.js

@@ -0,0 +1,36 @@
+import { setChanged } from "../utils/util.js";
+import _generate from "@babel/generator";
+const generate = _generate.default;
+import vm from "vm";
+
+const context = vm.createContext();
+var functionName;
+
+export default function (babel) {
+  const { types: t } = babel;
+
+  return {
+    name: "evaluate-function",
+    visitor: {
+      FunctionDeclaration(path) {
+        const { node } = path;
+        functionName = node.id.name;
+        const func = generate(node).code;
+        vm.runInContext(func, context);
+      },
+      CallExpression(path) {
+        const { node } = path;
+        const { callee } = node;
+        if (callee.name !== functionName) return;
+        const args = node.arguments;
+        if (!args.every(arg => t.isLiteral(arg))) return;
+        const expressionCode = generate(node).code;
+        const value = vm.runInContext(expressionCode, context);
+        if (value) {
+          path.replaceWith(t.valueToNode(value));
+          setChanged(true);
+        }
+      },
+    },
+  };
+}

test/test.js

@@ -39,7 +39,6 @@ test("hex to value", () => {
 
 test("bracket to dot", () => {
   assert.strictEqual(deobfuscate(`console["log"]("a")`), `console.log("a");`);
-  assert.strictEqual(deobfuscate(`console.log(o["a"]);`), `console.log(o.a);`);
 });
 
 test("remove empty statement", () => {