AST混淆实战|仿obfuscator混淆控制流平坦化(加强版)

待我称王封你为后i 2022-09-12 09:59 148阅读 0赞

上一篇文章给出了 [obfuscator混淆控制流平坦化][obfuscator]

## 混淆前: ##

window = {};
    window.atob = function(r) {
        e = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
        var o = String(r).replace(/=+$/, "");
        if(o.length % 4 == 1) throw new t("'atob' failed: The string to be decoded is not correctly encoded.");
        for(var n, a, i = 0, c = 0, d = ""; a = o.charAt(c++); ~a && (n = i % 4 ? 64 * n + a : a, i++ % 4) ? d += String.fromCharCode(255 & n >> (-2 * i & 6)) : 0) a = e.indexOf(a);
        return d
    }

## 混淆后: ##

window = {};
    
    
    window.atob = function ($_0x3f12) {
      var $_0xegb3 = 4;
    
    
      while ($_0xegb3 != 5) {
        switch ($_0xegb3) {
          case 0:
            return $_0xee94;
            $_0xegb3 = 5;
            break;
    
    
          case 1:
            var $_0xg5gf = String($_0x3f12).replace(/=+$/, "");
            $_0xegb3 = 2;
            break;
    
    
          case 2:
            if ($_0xg5gf.length % 4 == 1) throw new t("'atob' failed: The string to be decoded is not correctly encoded.");
            $_0xegb3 = 3;
            break;
    
    
          case 3:
            for (var $_0x7c25, $_0xa3c4, $_0xc8b9 = 0, $_0x22ed = 0, $_0xee94 = ""; $_0xa3c4 = $_0xg5gf.charAt($_0x22ed++); ~$_0xa3c4 && ($_0x7c25 = $_0xc8b9 % 4 ? 64 * $_0x7c25 + $_0xa3c4 : $_0xa3c4, $_0xc8b9++ % 4) ? $_0xee94 += String.fromCharCode(255 & $_0x7c25 >> (-2 * $_0xc8b9 & 6)) : 0) $_0xa3c4 = e.indexOf($_0xa3c4);
    
    
            $_0xegb3 = 0;
            break;
    
    
          case 4:
            e = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
            $_0xegb3 = 1;
            break;
        }
      }
    };

更改很简单，只是将之前的分发器变了，不再以数组形式给出，而是在每个case语句下面重新赋值，获取下一个case分支。

这样，就让混淆代码复杂了些，如果case分支足够多，调试起来不那么容易。

混淆思路:

1.  随机生成一个body长度的数组，用于打乱body执行顺序  
    
2.  构造一个VariableDeclaration节点，取上面的数组第一个元素作为初始值
3.  构造BinaryExpression节点，取数组长度 + 1 作为结束值。
4.  构造SwitchCase节点，注意分发器赋值为下一个数组元素
5.  构造While节点，替换。

源代码:

https://t.zsxq.com/fA2zvjE

感谢阅读，欢迎关注本人微信公众号，学习更多AST混淆与解混淆知识。

[obfuscator]: https://blog.csdn.net/qq523176585/article/details/112914846