rapid7 / jsobfu

Obfuscate JavaScript (beyond repair) with Ruby

JSObfu

JSObfu is a Javascript obfuscator written in Ruby, using the rkelly-remix library. The point is to obfuscate beyond repair, by randomizing as much as possible and removing easily-signaturable string constants.

Installation

To use JSObfu in your project, just add the following line to your Gemfile:

gem 'jsobfu'

Or, to install JSObfu on to your system, run:

$ gem install jsobfu

Documentation

Generated documentation is hosted on Github.

Example Usage

Obfuscating a Javascript string in ruby:

require 'jsobfu'

source = %Q|
  // some sample javascript code, to demonstrate usage:
  this.send_websocket_request = function(address, callback) {
    // create the websocket and remember when we started
    try {
      var socket = new WebSocket('ws://'+address);
    } catch (sec_exception) {
      if (callback) callback('error', sec_exception);
      return;
    }
    var try_payload = function(){
      TcpProbe.send("AAAAAAAAAAAAAAAAAAAAAAAAAA"+
                    "AAAAAAAAAAAAAAAAAAAAAAAAAA"+
                    "AAAAAAAAAAAAAAAAAAAAAAAAAA");
    }
    // wait a sec, then start the checks
    setTimeout(check_socket, WS_CHECK_INTERVAL);
  };
|

puts JSObfu.new(source).obfuscate

Will produce something that looks like:

this[((function () { var A="st",K="ket_reque",P="_send_webs",Z="oc"; return P+Z+K+A }
)())]=function(\u006b,U){var e;try{var B;var B=new window[(function () { var G="t",Rr
="e",C="We",$="bSock"; return C+$+Rr+G })()]((function () { var R9='/',x='s:/',xe='w'
; return xe+x+R9 })()+k);} catch(a){if(U)U((function () { var b='or',cF='r',E='e',f='
r'; return E+f+cF+b })(),a);return;}var e=function(){window[(function () { var t="e",
L="pProb",j="T",z="c"; return j+z+L+t })()][((function () { var zp="d",D="sen"; retur
n D+zp })())]((function () { var KL="AAAAAAAAAAAA",y6="AAAAAAAAAAAAAA"; return y6+KL
})()+String.fromCharCode(0x41,0x41,0101,0101,65,65,0x41,65,0101,65,0x41,0101,0x41,010
1,0101,0101,65,65,0x41,0x41,0x41,65,65,0101,0x41,0x41)+String.fromCharCode(0x41,0x41,
0x41,65,0x41,0101,0x41,0x41,0101,0101,0101,0101,0101,0101,0101,0101,0x41,65,65,65,010
1,0x41,0101,0x41,0101,0101));};setTimeout(this[((function () { var TF="et",D="k",B="c
heck_s",S="oc"; return B+S+D+TF })())],('Mcc'.length*51+47));};

Encode from the command line:

$ cat source.js | jsobfu 3

Options for obfuscation iterations and global object names can be passed:

JSObfu.new(blah).obfuscate(iterations: 3, global: 'this')

Memory Disruption

Obfuscation of this type can cause completely different memory footprints on every run. This can be annoying in some instances (like during a heap spray). To avoid this, a memory_sensitive option is provided:

JSObfu.new('var me = "BAR";\nvar description = "FOO" + me;').obfuscate(memory_sensitive: true)
#=> var y="BAR";var x="FOO"+y;

Note that the variables are still randomized and whitespace is stripped, but the String transformations are omitted.

Obfuscating multiple inputs

Typically you will want to create a new JSObfu instance per script you create, but sometimes you need the ability to generate obfuscated code on-demand that is compatible with other, already obfuscated scripts in the page. To do this you can reuse a JSObfu instance by replacing its code member:

j1 = JSObfu.new('var JSObfu = 1;')
j1.obfuscate           #=> 'var y = 1;'

j1.code = 'var Value2 = JSObfu + 2;'
j1.obfuscate           #=> 'var x = y + 2;'

Alternatively, you can persist the instance's #scope (which contains a map of top-level variable renames) and pass it into a new instance of JSObfu later:

j1 = JSObfu.new('var JSObfu = 1;')
j1.obfuscate           #=> 'var y = 1;'

j2 = JSObfu.new('var Value2 = JSObfu + 2;', scope: j1.scope)
j2.obfuscate           #=> 'var x = y + 2;'

Deobfuscation

Just as coding these transformations is possible, so is the inverse. Hats off to @m1el for creating a jsobfu deobfuscator! Don't forget, jsobfu will never stop a determined analyst; but it can be very helpful against static detection.

Development Environment

Setting up is easy:

$ cd jsobfu
$ bundle install

Generating documentation

$ yard && yard server --port 9999

Then open http://localhost:9999 in your browser.

Running specs

$ rake spec

To run without integration specs, set INTEGRATION=false as an environment variable.

License

BSD-3-Clause

jsobfu's Issues

spec.date is always 2014-04-09 in jsobfu.gemspec

I'm not familiar with this, but it doesn't make a lot of sense this date is always the same in Rubygems:
https://rubygems.org/gems/jsobfu

Egypt told me Rubygems should know the correct published date without spec.date, so maybe we should just remove it?

When iteration is 0 or -1, don't obfuscate

Code example:

1.9.3-p547 :006 > js = JSObfu.new(%Q|alert('test');|)
 => alert('test'); 
1.9.3-p547 :007 > js.obfuscate(:iteration=>0)
 => window[String.fromCharCode(0x61,0x6c,101,0162,0164)](String.fromCharCode(0164,0x65,115,0164));

JSObfu should have more constructor options

As per rapid7/metasploit-framework#4728:

It would be useful to expose the following options in the JSObfu constructor:

• rewrite_globals [boolean], in case you want to leave global vars alone
• obfuscate_strings [boolean], in case you don't want to obfuscate strings (this eats memory and can make heap sprays unreliable)
• strip_whitespace [boolean], in case you don't want to remove unnecessary whitespace.
• rename_vars [boolean], in case you don't want to rename vars.

Support jshint-style inline obfuscation options

It would be nice to declare in the code itself different options for obfuscation. For example:

/* jsobfu memory_sensitive: true */
for (var i = 0; i < 0x1337b33f; i++) {
  heapSprayChunk("AAAAA");
}
/* jsobfu memory_sensitive: false */
/* jsobfu enabled: false */
// this comment will be in the output
/* jsobfu enabled: true */
// this comment will not.

jsobfu 0.3.0 is noticeably slower

@wchen-r7 noticed which exploit/multi/browser/firefox_tostring_console_injection loads noticeably slower after trying to update metasploit-framework to use jsobfu 0.3.0. Definitely we should figure out what is going on before updating the used version in the framework.

See rapid7/metasploit-framework#4805 for details.

ping @joevennix because he is the jsobfu master :) but nothing like assignment or nothing like that, I can work on it indeed, I just need to finish some tasks before!

Multiple calls to #obfuscate causes the original js to be obfuscated multiple times

When you do this:

Js = JSObfu.new(%Q|alert(‘test’);|)
Js.obfuscate
Js.obfuscate
Js.obfuscate

It’s just like asking it to obfuscate 3 times instead of 1x.

Obfuscation sometimes duplicates variable names

The build sometimes fails because generated variable names are not unique. I'm not quite sure how this can happen.

From https://travis-ci.org/rapid7/jsobfu/jobs/86965174, you can see both 'Blah' and 'Foo' get renamed to 'p':

Failures:
  1) JSObfu#obfuscate preserving the variable map across calls when calling obfuscate twice after changing the code preserves the variable map
     Failure/Error: expect(obf1+obf2+obf3).to evaluate_to(code1+code2+code3)
       expected that the code:

       var Blah = 1;var Foo = 2;this.test = function(){ return Blah + Foo + 1; };:

       => 4

       evaluate to the same result as :

       var p='H'.length;var p='YE'.length;this[((function () { var x="t",H="tes"; return H+x })())]=function(){return p+p+'y'.length;};

       => 5
     # ./spec/jsobfu_spec.rb:126:in `block (5 levels) in <top (required)>'
Finished in 4 minutes 45.3 seconds (files took 0.53676 seconds to load)
179 examples, 1 failure

undefined method `accept' for nil:NilClass

obfuscate with chinese bug

just like this

a.js

alert('你好');

and i act like this:

cat a.js | jsobfu 1

and it usually case some bug。

like the pic:

and this bug will case probability.