CN114253549A

CN114253549A - JavaScript obfuscation method implemented based on syntax tree AST editing

Info

Publication number: CN114253549A
Application number: CN202111465057.5A
Authority: CN
Inventors: 胡云锋
Original assignee: Individual
Current assignee: Individual
Priority date: 2021-12-03
Filing date: 2021-12-03
Publication date: 2022-03-29

Abstract

A JavaScript confusion method realized based on syntax tree AST editing comprises the following steps: compressing the JavaScript source code to remove redundant codes, and analyzing to generate an AST syntax tree; traversing AST syntax tree, and performing editing conversion on syntax; creating an array arrayA, extracting character strings of the AST syntax tree, and converting the character strings into a data dictionary of a two-dimensional array through a specific algorithm; creating a decoding method, and randomly inserting the decoding method and a random redundancy method into the array ARRAyA in the last step; creating a self-execution method function, transmitting a two-dimensional array ARRAyA serving as an alignment parameter into the self-execution method function, and combining a decoding method with the self-execution method function to generate a new AST syntax tree; converting all character string nodes in the original AST syntax tree into a decoding method functional H; inserting the original AST syntax tree into the new AST syntax tree, and replacing all numbers and variables to obtain a new AST syntax tree with a brand new structure; restoring the JavaScript code to output: and restoring the new AST syntax tree into a JavaScript code, removing the space, performing line feed compression, and outputting to obtain an obfuscated code.

Description

JavaScript obfuscation method implemented based on syntax tree AST editing

Technical Field

The invention relates to the technical field of computers and communication, in particular to a JavaScript obfuscation method implemented based on AST editing of a syntax tree.

Background

JavaScript is a programming Language that runs on a web browser, is mainly added to a web site constructed using HTML (hypertext Markup Language) and CSS (Cascading Style Sheets), and plays a role in realizing various page dynamic effects. For example, a carousel style displayed on a web page, and a prompt message displayed after a content error input on the consultation platform. In addition, JavaScript is also needed for shopping cart use and cost estimation when goods are purchased in the website of the mall. So even though it is not obvious, it is still a language that is often used by encoding personnel, and JavaScript is the most important programming language in web front-end development.

In the early development of a Web (World Wide Web, also called World Wide Web) system, the JavaScript has not had much responsibility in the Web system, and only a simple submission form, and the JavaScript file is very simple and does not need any protection.

However, nowadays web applications are more and more abundant, along with the improvement of browser performance and network speed, JavaScript bears more work, a lot of back-end logic is transferred to the front end, and meanwhile, more lawbreakers are allowed to be organically multiplied. In the web model, JavaScript tends to be the first breach of a lawbreaker. Knowing the front-end logic, a lawbreaker can simulate a normal user to implement his own malicious behavior. Therefore, in many login, registration, payment, transaction and other pages, the JavaScript relied on by key services and the wind control system is not expected to be easily cracked by people.

Obviously, we need to secure our front-end JavaScript code. However, since the JavaScript has to download the code to explain the execution characteristics in the browser, absolute secrecy is impossible, and what we want to do is to increase the difficulty of cracking as much as possible, so that an attacker can go back with difficulty.

At present, eval encryption, code compression and code confusion are generally adopted in the industry to protect the security of codes in three ways; and where "code obfuscation" is more secure and flexible relative to the other two.

Code obfuscation: the JavaScript obfuscator is generally implemented by two kinds of Regular (Regular Expression, often abbreviated as regex, regexp, or RE) replacements and Syntax Tree (Abstract Syntax Tree, abbreviated as AST) replacements, and the Regular replacement implementation cost is low, but the effect is general, and is suitable for scenes with low obfuscation requirements; AST syntax tree replacement is more costly to implement, but is more flexible and secure. The AST syntax tree-based obfuscator is actually similar to a compiler, the basic principle is similar to the compiler, and the local variables are renamed, the code is compressed under the condition of the same semantic by removing code blanks, and the variables are replaced.

Although "code obfuscation" is safer and more flexible than the other two, it has major drawbacks. Common code obfuscation is obfuscated by renaming local variables, replacing constants, simply string transcoding and the like, but character strings such as attribute values, object method names/attribute names and the like still appear in codes, and an experienced attacker can easily guess codes and related functions so as to crack the codes.

Based on the above, the invention provides a JavaScript obfuscation method implemented based on syntax tree AST editing, so as to solve the above problems.

Disclosure of Invention

The technical problem to be solved by the invention is to provide a JavaScript obfuscation method implemented based on syntax tree AST editing, which can effectively solve the problems provided in the background art.

In order to solve the problems, the technical scheme adopted by the invention is as follows: a JavaScript confusion method realized based on syntax tree AST editing comprises the following steps:

s1, AST syntax tree generation analysis: compressing the JavaScript source code to remove redundant codes, and analyzing to generate an AST syntax tree;

s2, syntax editing and converting: traversing AST syntax tree, and performing editing conversion on syntax;

s3, creating an array arrayA, extracting character strings of the AST syntax tree, and converting the character strings into a data dictionary of a two-dimensional array through a specific algorithm;

s4, creating a decoding method, and randomly inserting the decoding method and the random redundancy method into the array A in the previous step;

s5, creating a self-execution method function nF, taking a two-dimensional array A as an alignment parameter and transmitting the two-dimensional array A into the self-execution method function nF, and combining a decoding method and the self-execution method function nF to generate a new AST syntax tree;

s6, converting character string nodes: converting all character string nodes in the original AST syntax tree into a decoding method functional H;

s7, inserting the original AST syntax tree into the new AST syntax tree, and replacing all numbers and variables to obtain a new AST syntax tree with a brand new structure;

s8, restoring the JavaScript code and outputting: and restoring the new AST syntax tree into a JavaScript code, removing the space, performing line feed compression and outputting.

As a further preferable solution of the present invention, the syntax involved in the editing and converting in step S2 includes: object definition, window global Object, and syntax with properties and method name obj.

As a further preferable aspect of the present invention, the edit conversion method of each grammar is:

the define Object syntax is converted into a self-executing method, generating (function (obj) { return obj [ "attr" ] ═ 0, obj;) ({ }) syntax;

defining a local variable to point to a window object through this, and converting all window global objects in a code block into a window [ "attr" ] grammar;

the syntax of all attributes and method names obj.

As a further preferable aspect of the present invention, the manner of extracting the character string in step S3 is:

traversing the AST syntax tree, storing all character strings in the AST syntax tree into an array arrayA, recording the position of the character strings in the arrayA if the character strings exist in the arrayA, and adding the character strings to the arrayA re-recording position if the character strings do not exist;

the detailed manner of converting into the two-dimensional array by the specific algorithm in the step S3 is as follows:

converting all character strings in the array arrayA into a two-dimensional array by a split (') method;

converting each character of the array arrayA into a number by a charCodeeAt method, and carrying out bit operation on the length of the original character and the number;

using an array, prototype, concat, and apply method to reduce the dimension of a two-dimensional array arrayA, recording the initial position of the original character string in the array, generating a random number randomB, and performing bit operation on all numbers in the array and the random number randomB again.

As a further preferable aspect of the present invention, the decoding method created in step S4 includes:

an array extraction method function C, an array dimensionality reduction method function D and a bit operation method function E.

As a further preferred aspect of the present invention, the function of the array extraction method function is to traverse the array arrayA, filter out non-array objects therein by typeof and return to all the digital arrays;

the array dimension reduction method functional D reduces the dimension of the two-dimensional array returned by the method functional C into a one-dimensional array, and conveniently intercepts the array according to the starting coordinate and the ending coordinate;

the function of the displacement operation method functional E is to obtain an original character string value by respectively operating with digital bits in an array according to the difference of the initial position and random number randomB, and then reducing the original character string value into an original character by using a string.

Compared with the prior art, the invention provides a JavaScript confusion method realized based on syntax tree AST editing, which has the following beneficial effects:

1. the invention breaks up the character string, transcodes and displaces the character string, then randomly combines the character string again, and can obtain the original character string only by a built-in decoding method and by inputting correct parameter values, otherwise, only can obtain null values or messy codes.

2. All the numerals of the obfuscated codes are 16-system numbers and similar variables of the 16-system codes, character strings are hardly visible on the bright surface, the codes are difficult to understand, the cracking difficulty of the codes is greatly increased, and the protectiveness is improved.

3. The invention generates script codes after a series of confusion operations, displays the codes as other numbers/variables/character strings except basic operators and reserved keywords as 0x or Ox (Ox, 0 x), adds random bits and operation, and ensures the randomness of each code generation by random array segmentation and redundancy methods, so that the whole grammar structure change reduces the readability of script reading.

4. Compared with the decoding method in other confusion schemes which only adopts simple decoding or single array subscript, the decoding method in the invention can acquire the character string only by inputting two parameters of the starting position and the ending position, meanwhile, the difference between the ending position and the starting position corresponds to the length of the character string, and the character string also participates in the character displacement operation and restoration, if the value is transmitted and returned in error, a string of messy codes is formed, so the difficulty of debugging and cracking is greatly increased.

Drawings

FIG. 1 is a flow diagram of the overall obfuscation process according to the present invention;

FIG. 2 is an effect diagram of the obfuscated JavaScript code in the Chrome browser debugging mode;

FIG. 3 is a diagram illustrating a front-to-back comparison of the syntax structure of Object definition for editing and converting objects according to the present invention;

FIG. 4 is a diagram illustrating a comparison between before and after editing and converting a window global object/attribute according to the present invention;

FIG. 5 is a diagram showing the comparison between the syntax of all the attributes and the method names obj.attr and the syntax of obj [ "attr" ] in the present invention;

FIG. 6 is a schematic diagram of extracting all String strings appearing in AST and adding arrays;

FIG. 7 is a schematic diagram of the present invention showing the scattering of all strings into a two-dimensional array;

FIG. 8 is a schematic diagram of the conversion of a string in array arrayA into a number by the charCodeeAt method according to the present invention;

FIG. 9 is a diagram of dimension reduction of two-dimensional array arrayA and re-bit operation with random numbers according to the present invention;

FIG. 10 is a functional C diagram of the array extraction method of the present invention;

FIG. 11 is a diagram illustrating an array dimension reduction method function D according to the present invention;

FIG. 12 is a schematic diagram of a bit operation method function E according to the present invention;

FIG. 13 is a diagram illustrating an array arrayA random partitioning and random insertion decoding method and redundancy method according to the present invention;

FIG. 14 is a diagram illustrating syntax structures of a self-execution method fnctinfs and arrayA according to the present invention;

FIG. 15 is a diagram illustrating the replacement of all strings in the original code according to the present invention;

fig. 16 is a diagram illustrating the edited new AST syntax structure according to the present invention;

FIG. 17 is a diagram of the code of the present invention after final obfuscation;

FIG. 18 is a diagram illustrating the scrambling code caused by inputting an error parameter according to the present invention.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments.

The invention provides a JavaScript confusion method realized based on syntax tree AST editing, which comprises the following steps:

referring to fig. 3, the definition Object syntax is converted into a self-executing method, generating a (function (obj) { return obj [ "attr" ] ═ 0, obj { }) syntax;

referring to FIG. 4, defining a local variable to point to a window object through this, all window global objects in a code block are converted into a window [ "attr" ] syntax;

referring to fig. 5, the syntax of all attributes and method names obj.

As a further preferable embodiment of the present invention, referring to fig. 6, the method for extracting the character string in step S3 is:

referring to fig. 7, all the character strings in the array arrayA are converted into a two-dimensional array by a split (') method;

referring to fig. 8, each character of the array arrayA is converted into a number by a charCodeAt method, and the length of the original character and the number are subjected to bit operation;

referring to fig. 9, a two-dimensional array a is reduced in dimension and the start position of the original character string in the array is recorded by using an array.

As a further preferred solution of the present invention, referring to fig. 10, the function of the array extraction method function is to traverse the array arrayA, filter out non-array objects therein by typeof and return to all the digital arrays;

referring to fig. 11, the array dimension reduction method functional d reduces the dimension of the two-dimensional array returned by the method functional c into a one-dimensional array, so as to conveniently intercept the array according to the start coordinate and the end coordinate;

referring to fig. 12, the function of the shift operation method function is to obtain an original character string value by respectively operating with the digit bits in the array according to the difference of the start positions and the random number randomB, and then reducing the original character string value to the original character by using the string.

Referring to fig. 13, as a further preferred embodiment of the present invention, the array arrayA is randomly divided again to become a two-dimensional array, and then the functionC, functionD, and functionE are randomly inserted into the array arrayA to generate several redundancy methods, and also randomly inserted into the array a.

Referring to fig. 14, the detailed method of the step S5 is as follows:

the method for extracting the method function C, the array dimension reduction method function D and the reverse displacement operation method function E are combined and restored to define a decoding method function G in the method function nF scope;

functionG＝functionE.call(functionD(functionC(arguments)))；

randomly generating redundancy methods funcA, funcB, funcC and a decoding method funcH, carrying out bit operation a ^ b on the transmitted initial position a and b parameters in the funcH, then respectively executing the redundancy methods funcA, funcB and funcC, wherein the three methods are only without practical meaning for air conditioners, and finally calling a funcG method to carry out decoding on the a and b parameters after bit operation.

Referring to fig. 15, the step S6 converts all the string nodes in the original AST syntax tree into decoding method functionH (start position, end position); wherein, the starting position and the ending position are dynamic values.

Since the function H parameter uses bit operation confusion, the incoming start position coordinates are disordered, and two parameters are required to be input correctly to solve a correct character string, and if the parameters are returned incorrectly, the character string is disordered or an empty character string.

Referring to the example of FIG. 18:

input funtionh (13,13) returns "one ajax request example below"; input funtionh (0,1) returns an empty string; the input functionH (13) returns a garbled code "(+ # -2"5> $/$ 16(>/9> d "> ' &1<55 | $ 61 | $1$ '; ', + -; ' #42(# (1) encourage #44) ') 4) 0 she oches from compartment and '8 (?4 + ', $ -", which is more difficult to crack than other fixed values returned by array subscripts.

Referring to fig. 16, the step S7 inserts the original AST syntax tree into the new AST syntax tree, replaces all numbers and variables, and obtains a new AST syntax tree with a completely new structure;

replacing all the numbers in the new AST syntax tree with 16 systems for output; and replacing the variable with a _ + sequence to 16-system output according to the sequence.

Referring to fig. 17, after the 16-ary output is replaced by the new AST syntax tree, the new AST syntax tree is finally restored to JavaScript code, and the space is removed and the compressed data is output.

A pre-and post-comparison of source code obfuscation for the present invention is made with reference to the following table:

as a specific embodiment of the present invention:

referring to fig. 1 to 18, the present invention provides a JavaScript confusion method implemented based on syntax tree AST editing, which decomposes JavaScript codes into syntax nodes according to an abstract syntax tree, and converts and combines the JavaScript codes according to different syntax types.

Compressing the JavaScript source code to remove redundant codes, and analyzing to generate an AST syntax tree; traversing AST syntax tree, then converting definition Object syntax into self-executing method, generating (function (obj) { return obj [ "attr" ] ═ 0, obj; } ({ }) syntax, pointing definition local variable to window Object through this, converting all window global objects in code block into window [ "attr" ] syntax, and converting syntax of all attributes and method name obj.

Then creating an array arrayA, traversing the AST syntax tree, storing all character strings in the AST syntax tree into the array arrayA, returning the position of the character string if the character string exists in the array arrayA, and adding the character string to the array arrayA and returning the position of the character string if the character string does not exist in the array arrayA; then the array arrayA is converted into a data dictionary of a two-dimensional array through the following specific algorithm:

converting all character strings in the array arrayA into a two-dimensional array by a split (') method; converting each character of the array arrayA into a number by a charCodeeAt method, and carrying out bit operation on the length of the original character and the number; using an array, prototype, concat, and apply method to reduce the dimension of a two-dimensional array arrayA, recording the initial position of the original character string in the array, generating a random number randomB, and performing bit operation on all numbers in the array and the random number randomB again.

Then, creating decoding methods such as an array extraction method function C, an array dimensionality reduction method function D, a bit operation method function E and the like, and randomly inserting the decoding methods and random redundancy methods into the array A in the previous step; and creating a self-execution method function nF, then introducing the two-dimensional array A into the self-execution method function nF as an alignment parameter, and combining the decoding method and the self-execution method function nF to generate a new AST syntax tree.

Then all character string nodes in the original AST syntax tree are converted into a decoding method functional H; inserting the original AST syntax tree into a new AST syntax tree, replacing all numbers and variables to obtain a new AST syntax tree with a brand-new structure, then replacing all the numbers in the new AST syntax tree with 16 systems for output, and replacing the variables with _ + sequences to 16 systems for output according to the sequences; and finally, restoring the new AST syntax tree into a JavaScript code, removing the blank space, performing line feed compression and outputting.

Compared with the decoding method in other confusion schemes which only adopts simple decoding or single array subscript, the decoding method in the invention can acquire the character string only by inputting two parameters of the starting position and the ending position, meanwhile, the difference between the ending position and the starting position corresponds to the length of the character string, and the character string also participates in the character displacement operation and restoration, if the value is transmitted and returned in error, a string of messy codes is formed, so the difficulty of debugging and cracking is greatly increased.

The above examples are only intended to illustrate the technical solution of the present invention, but not to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions of the embodiments of the present invention.

Claims

1. A JavaScript confusion method realized based on syntax tree AST editing comprises the following steps:

2. The JavaScript obfuscation method according to claim 1, wherein the syntax involved in the editing and transforming in step S2 includes: object definition, window global Object, and syntax with properties and method name obj.

3. The JavaScript confusion method implemented on the basis of syntax tree AST editing of claim 2, wherein the editing and converting manner of each syntax is as follows:

the syntax of all attributes and method names obj.

4. The JavaScript confusion method implemented on the basis of the syntax tree AST editing of claim 1, wherein the strings in step S3 are extracted by:

5. The JavaScript confusion method implemented on the basis of the syntax tree AST editing of claim 1, wherein the decoding method created in step S4 comprises:

6. The JavaScript obfuscation method of claim 5, wherein,

the array extraction method function C is used for traversing an array arrayA, filtering out non-array objects in the array A through typeof ═ function ", and returning all the array objects to the array;