feat: enhance logging capabilities and improve deobfuscation process with detailed summaries and error handling

Author: kuizuo

packages/deob/src/ast-utils/generator.ts

@@ -18,7 +18,7 @@ export function codePreview(node: t.Node): string {
     ...defaultOptions,
   })
   if (code.length > 100) {
-    return `${code.slice(0, 70)} … ${code.slice(-30)}`
+    return `${code.slice(0, 70)} …… ${code.slice(-30)}`
   }
   return code
 }

packages/deob/src/ast-utils/index.ts

@@ -5,3 +5,4 @@ export * from './matcher'
 export * from './rename'
 export * from './scope'
 export * from './transform'
+export * from './logger'

packages/deob/src/ast-utils/logger.ts

@@ -0,0 +1,11 @@
+import debug from 'debug'
+
+export const deobLogger = debug('Deob')
+
+export function createLogger(namespace: string) {
+  return debug(namespace)
+}
+
+export function enableLogger(namespace = 'Deob') {
+  debug.enable(namespace)
+}

packages/deob/src/ast-utils/transform.ts

@@ -6,8 +6,6 @@ import type {
 import traverse, { visitors } from '@babel/traverse'
 import debug from 'debug'
 
-const logger = debug('webcrack:transforms')
-
 export async function applyTransformAsync<TOptions>(
   ast: Node,
   transform: AsyncTransform<TOptions>,
@@ -52,8 +50,6 @@ export function applyTransforms(
   options: { noScope?: boolean; name?: string; log?: boolean } = {},
 ): TransformState {
   options.log ??= true
-  const name = options.name ?? transforms.map(t => t.name).join(', ')
-  if (options.log) logger(`${name}: started`)
   const state: TransformState = { changes: 0 }
 
   for (const transform of transforms) {
@@ -68,7 +64,6 @@ export function applyTransforms(
     traverse(ast, visitor, undefined, state)
   }
 
-  if (options.log) logger(`${name}: finished with ${state.changes} changes`)
   return state
 }
 

packages/deob/src/deobfuscate/inline-decoder-wrappers.ts

@@ -6,6 +6,7 @@ import type {
 import {
   inlineFunctionAliases,
   inlineVariableAliases,
+  deobLogger as logger,
 } from '../ast-utils'
 
 /**
@@ -21,8 +22,11 @@ export default {
     const decoderName = decoder.node.id.name
     const decoderBinding = decoder.parentPath.scope.getBinding(decoderName)
     if (decoderBinding) {
-      state.changes += inlineVariableAliases(decoderBinding).changes
-      state.changes += inlineFunctionAliases(decoderBinding).changes
+      const varState = inlineVariableAliases(decoderBinding).changes
+      const fnState = inlineFunctionAliases(decoderBinding).changes
+      state.changes += varState
+      state.changes += fnState
+      logger(`解密函数包装内联: ${decoderName} | 变量别名 ${varState} 处, 函数别名 ${fnState} 处`)
     }
   },
 } satisfies Transform<NodePath<t.FunctionDeclaration>>

packages/deob/src/deobfuscate/inline-object-props.ts

@@ -5,6 +5,7 @@ import type {
 import {
   constKey,
   constMemberExpression,
+  deobLogger as logger,
   inlineObjectProperties,
   isReadonlyObject,
 } from '../ast-utils'
@@ -70,6 +71,7 @@ export default {
             m.or(m.stringLiteral(), m.numericLiteral()),
           ),
         )
+        logger(`对象属性内联: ${varId.current!.name} -> ${objectProperties.current!.length} 个字面量属性`)
       },
     }
   },

packages/deob/src/deobfuscate/self-defending.ts

@@ -5,7 +5,9 @@ import type {
   Transform,
 } from '../ast-utils'
 import {
+  codePreview,
   constMemberExpression,
+  deobLogger as logger,
   emptyIife,
   falseMatcher,
   findParent,
@@ -26,6 +28,15 @@ export default {
   tags: ['safe'],
   scope: true,
   visitor() {
+    const removedSnippets: string[] = []
+    const MAX_SNIPPETS = 5
+
+    const recordRemoval = (node: t.Node, reason: string) => {
+      if (removedSnippets.length >= MAX_SNIPPETS)
+        return
+      removedSnippets.push(`${reason}: ${codePreview(node)}`)
+    }
+
     const callController = m.capture(m.anyString())
     const firstCall = m.capture(m.identifier())
     const rfn = m.capture(m.identifier())
@@ -126,27 +137,38 @@ export default {
               // callControllerFunctionName(this, function () { ... })();
               // ^ ref
               ref.parentPath.parentPath?.remove()
+              recordRemoval(ref.parentPath.parentPath?.node!, '移除自卫入口调用')
             }
             else {
               // const selfDefendingFunctionName = callControllerFunctionName(this, function () {
               // selfDefendingFunctionName();      ^ ref
-              removeSelfDefendingRefs(ref as NodePath<t.Identifier>)
+              removeSelfDefendingRefs(ref as NodePath<t.Identifier>, recordRemoval)
             }
 
             // leftover (function () {})() from debug protection function call
-            findParent(ref, emptyIife)?.remove()
+            const leftover = findParent(ref, emptyIife)
+            if (leftover) {
+              recordRemoval(leftover.node, '移除多余 IIFE')
+              leftover.remove()
+            }
 
             this.changes++
           })
 
+        logger([
+          '移除自卫代码片段预览:',
+          ...removedSnippets,
+          removedSnippets.length >= MAX_SNIPPETS ? '... 更多片段已省略' : '',
+        ].filter(Boolean).join('\n'))
+
         path.remove()
         this.changes++
       },
     }
   },
 } satisfies Transform
 
-function removeSelfDefendingRefs(path: NodePath<t.Identifier>) {
+function removeSelfDefendingRefs(path: NodePath<t.Identifier>, recordRemoval: (node: t.Node, reason: string) => void) {
   const varName = m.capture(m.anyString())
   const varMatcher = m.variableDeclarator(
     m.identifier(varName),
@@ -161,9 +183,12 @@ function removeSelfDefendingRefs(path: NodePath<t.Identifier>) {
     const binding = varDecl.scope.getBinding(varName.current!)
 
     binding?.referencePaths.forEach((ref) => {
-      if (callMatcher.match(ref.parentPath?.parent))
+      if (callMatcher.match(ref.parentPath?.parent)) {
+        recordRemoval(ref.parentPath?.parentPath?.node!, '移除自卫函数调用')
         ref.parentPath?.parentPath?.remove()
+      }
     })
+    recordRemoval(varDecl.node, '移除自卫函数声明')
     varDecl.remove()
   }
 }

packages/deob/src/index.ts

@@ -2,8 +2,7 @@ import { join, normalize } from 'node:path'
 import * as parser from '@babel/parser'
 import { codeFrameColumns } from '@babel/code-frame'
 import type * as t from '@babel/types'
-import debug from 'debug'
-import { applyTransform, applyTransforms, codePrettier, generate } from './ast-utils'
+import { applyTransform, applyTransforms, codePrettier, codePreview, enableLogger, generate, deobLogger as logger } from './ast-utils'
 import type { Options } from './options'
 import { defaultOptions, mergeOptions } from './options'
 import type { StringArray } from './deobfuscate/string-array'
@@ -59,8 +58,6 @@ function handleError(error: any, rawCode: string) {
   }
 }
 
-const logger = debug('Deob')
-
 function shorten(value: string, max = 120) {
   const clean = value.replace(/\s+/g, ' ').trim()
   if (clean.length <= max)
@@ -69,7 +66,7 @@ function shorten(value: string, max = 120) {
 }
 
 function buildDecryptionSummaryLog(map: Map<string, string>) {
-  const lines = []
+  const lines = ['=== 解密结果预览 ===']
 
   lines.push(`- 解密条目: ${map.size} 个`)
   if (map.size) {
@@ -101,8 +98,7 @@ export class Deob {
     mergeOptions(options)
     this.options = options
 
-    // debug.enable('webcrack:*')
-    debug.enable('Deob')
+    enableLogger('Deob')
 
     if (!rawCode)
       throw new Error('请载入js代码')
@@ -143,11 +139,11 @@ export class Deob {
   }
 
   prepare() {
-    applyTransforms(this.ast, [blockStatements, sequence, splitVariableDeclarations, varFunctions, rawLiterals])
+    return applyTransforms(this.ast, [blockStatements, sequence, splitVariableDeclarations, varFunctions, rawLiterals])
   }
 
   unminify() {
-    applyTransform(this.ast, unminify)
+    return applyTransform(this.ast, unminify)
   }
 
   run(): DeobResult {
@@ -187,7 +183,9 @@ export class Deob {
           decoders = designDecoder(this.ast, options.designDecoderName!)
         }
 
-        logger(`${stringArray ? `字符串数组: ${stringArray?.name}` : '没找到字符串数组'} | ${decoders.length ? `解密器函数: ${decoders.map(d => d.name)}` : '没找到解密器函数'}`)
+        logger(`${stringArray ? `字符串数组: ${stringArray?.name} (${stringArray?.length} 个) 引用 ${stringArray?.references.length} 处` : '没找到字符串数组'} | ${decoders.length ? `解密器函数: ${decoders.map(d => d.name)}` : '没找到解密器函数'}`)
+        if (rotators.length)
+          logger(`字符串数组旋转器: ${rotators.length} 个`)
 
         evalCode(setupCode)
 
@@ -206,17 +204,37 @@ export class Deob {
         logger(buildDecryptionSummaryLog(map))
 
         if (options.isRemoveDecoder && !options.isStrongRemove) {
-          stringArray?.path.remove()
-          rotators.forEach(r => r.remove())
-          decoders.forEach(d => d.path?.remove())
+          const removedSnippets: string[] = []
+          const MAX_SNIPPETS = 3
+          const addSnippet = (node: t.Node) => {
+            if (removedSnippets.length < MAX_SNIPPETS)
+              removedSnippets.push(codePreview(node))
+          }
+
+          if (stringArray?.path) {
+            addSnippet(stringArray.path.node)
+            stringArray.path.remove()
+          }
+          rotators.forEach((r) => {
+            addSnippet(r.node)
+            r.remove()
+          })
+          decoders.forEach((d) => {
+            addSnippet(d.path.node)
+            d.path?.remove()
+          })
+          logger(`已移除解密相关节点${removedSnippets.length ? `，片段:\n${removedSnippets.join('\n')}` : ''}`)
         }
+        return { changes: (map as any)?.size ?? decoders.length + rotators.length }
       },
       /** 对象引用替换 */
       () => applyTransform(this.ast, inlineObjectProps),
       /** 控制流平坦化 */
       () => {
+        logger(`控制流平坦化执行次数: ${options.execCount}`)
+        let changes = 0
         for (let i = 0; i < options.execCount; i++) {
-          applyTransforms(
+          const state = applyTransforms(
             this.ast,
             [
               mergeStrings,
@@ -225,31 +243,40 @@ export class Deob {
               controlFlowSwitch,
             ],
           )
+          changes += state.changes
         }
+        return { changes }
       },
       /** 合并对象 */
       () => applyTransform(this.ast, mergeObjectAssignments),
       /** 去 minify */
-      () => applyTransform(this.ast, unminify),
+      () => this.unminify(),
       /** 对象命名优化 */
       () => {
         const matcher = getMangleMatcher(options)
-        if (matcher)
-          applyTransform(this.ast, mangle, matcher)
+        if (matcher) {
+          return applyTransform(this.ast, mangle, matcher)
+        }
       },
       /** 移除自卫代码 */
-      () => {
-        return applyTransforms(
-          this.ast,
-          [
-            [selfDefending, debugProtection],
-          ].flat(),
-        )
-      },
+      () => applyTransforms(
+        this.ast,
+        [
+          [selfDefending, debugProtection],
+        ].flat(),
+      ),
       /** 标记关键字 */
-      options.isMarkEnable && (() => markKeyword(this.ast, options.keywords)),
+      options.isMarkEnable && (() => {
+        logger(`关键字列表: [${options.keywords.join(', ')}]`)
+        markKeyword(this.ast, options.keywords)
+        return { changes: options.keywords.length }
+      }),
       /** 输出代码 */
-      () => (outputCode = generate(this.ast)),
+      () => {
+        outputCode = generate(this.ast)
+        logger(`输出代码长度: ${outputCode.length} 字符`)
+        return { changes: outputCode.length }
+      },
     ].filter(Boolean) as (() => unknown)[]
 
     for (let i = 0; i < stages.length; i++) {

packages/deob/src/options.ts

@@ -2,7 +2,7 @@ export interface Options {
   /** 是否强力清除 */
   isStrongRemove?: boolean
 
-  /** 解密器嵌套深度 */
+  /** 解密函数包装深度 */
   inlineWrappersDepth?: number
   /** 解密器定位方式 */
   decoderLocationMethod?: 'obfuscate' | 'callCount' | 'stringArray' | 'evalCode'

packages/deob/src/transforms/decode-strings.ts

@@ -1,5 +1,6 @@
 import * as t from '@babel/types'
 import type { Decoder } from '../deobfuscate/decoder'
+import { deobLogger as logger } from '../ast-utils'
 
 /**
  * 执行解密器 (使用 eval 执行)
@@ -11,6 +12,7 @@ import type { Decoder } from '../deobfuscate/decoder'
  */
 export function decodeStrings(decoders: Decoder[]) {
   const map = new Map<string, string>() // 记录解密结果
+  let failures = 0
 
   for (const decoder of decoders) {
     decoder?.path.scope.getBinding(decoder.name)?.referencePaths.forEach((ref) => {
@@ -29,12 +31,16 @@ export function decodeStrings(decoders: Decoder[]) {
           callExpression.replaceWith(t.valueToNode(value))
         }
         catch (error) {
+          failures++
           // 解密失败 则添加注释
           callExpression.addComment('leading', `decode_error: ${(error as any).message}`, true)
         }
       }
     })
   }
 
+  if (failures)
+    logger(`\x1B[31m解密失败 ${failures} 处，已在代码中标记 decode_error\x1B[0m`)
+
   return map
 }