一种针对WEB前端混淆防护的通用对抗方法

1var input=document.getElementById("username");

1var a=document;
2var b="getElem";
3var c="entById";
4var d="username";
5b+=c;
6c=a[b];
7var input=c.call(a,d)

 1var m=[5,4,7,3,2,1,6];//按照这个顺序去执行下面的switch分支
 2var a,b,c,d,input;
 3for(var i=0;i<m.length;++i)
 4{
 5switch(m[i])
 6{
 7    case 7:
 8        c="entById";
 9        break; 
10    case 2:
11        b+=c;
12        break; 
13    case 5:
14        a=document;
15        break; 
16    case 1:
17        c=a[b];
18        break; 
19    case 6:
20        input=c.call(a,d);
21        break; 
22    case 3:
23        d="username";
24        break; 
25    case 4:
26        b="getElem";
27        break;
28}
29}

1//新建静态函数：
2static String JSTracerFilterGetValue(String);

 1//实现h文件中新建的静态函数：
 2String HTMLFormControlElement::JSTracerFilterGetValue(String value) {
 3  // HTMLFormControlElement::value()返回的是WTF::String，比起Attribute::Value()方便得多
 4  static std::atomic_int INDEX = {0};
 5
 6  char tsource[1024], tdestination[1024], tfilepath[64];
 7  FILE* tfile = fopen(".\\JSTracer\\getValueReplace.config", "r");
 8  if (!tfile)
 9    return value;
10  //这里使用fscanf的话，没法处理包含空白符的替换配置。后续可能需要注意修改
11  if (!::fscanf(tfile, "%s%s", tsource, tdestination)) {
12    ::fclose(tfile);
13    return value;
14  }
15  ::fclose(tfile);
16
17  std::string tvalue = value.Utf8();
18  for (bool treplaced = false; true; treplaced = true) {
19    size_t tindex = tvalue.find(tsource);
20    if (tindex == tvalue.npos) {  //没有其它可替换的tsource了，返回结果
21      if (treplaced) {  //之前发生过替换，需要生成新的WTF::String对象
22        int tindex = INDEX++;
23
24        sprintf(tfilepath, ".\\JSTracer\\Logs\\%lld_getValue_Replaced_%d.log",
25                time(0), tindex);
26        FILE* tfile = fopen(tfilepath, "w");
27        fprintf(tfile, "%s -> %s", value.Utf8().c_str(), tvalue.c_str());
28        fclose(tfile);
29
30        return String::FromUTF8(tvalue.c_str());
31      } else {  //没有发生过替换，返回原值即可
32        sprintf(tfilepath, ".\\JSTracer\\Logs\\%lld_getValue_%d.log", time(0),
33                rand());
34        FILE* tfile = fopen(tfilepath, "w");
35        fprintf(tfile, "%s", value.Utf8().c_str());
36        fclose(tfile);
37
38        return value;
39      }
40      break;
41    }
42    tvalue = tvalue.replace(tindex, strlen(tsource), tdestination);
43  }
44}

 1//调用上面新建的静态函数，对value()的返回值进行处理
 2String HTMLInputElement::value() const {
 3  switch (input_type_->GetValueMode()) {
 4    case ValueMode::kFilename:
 5      return JSTracerFilterGetValue(input_type_->ValueInFilenameValueMode());
 6    case ValueMode::kDefault:
 7      return JSTracerFilterGetValue(FastGetAttribute(html_names::kValueAttr));
 8    case ValueMode::kDefaultOn: {
 9      AtomicString value_string = FastGetAttribute(html_names::kValueAttr);
10      return JSTracerFilterGetValue(value_string.IsNull() ? "on"
11                                                          : value_string);
12    }
13    case ValueMode::kValue:
14      return JSTracerFilterGetValue(non_attribute_value_);
15  }
16  NOTREACHED();
17  return g_empty_string;

1//调用上面新建的静态函数，对value()的返回值进行处理
2String HTMLSelectElement::value() const {
3  if (HTMLOptionElement* option = SelectedOption())
4    return JSTracerFilterGetValue(option->value());
5  return "";
6}

1//调用上面新建的静态函数，对value()的返回值进行处理
2String HTMLTextAreaElement::value() const {
3  return JSTracerFilterGetValue(value_);
4}

 1const AtomicString& Value() const {
 2    static std::atomic_int LOG_INDEX = {0};
 3    static std::atomic_int BUFFER_INDEX = {0};
 4    //因为是常函数又必须返回引用，只能期待实际修改的属性访问不多或者使用短暂...
 5    static AtomicString* BUFFER = new AtomicString[4096];
 6
 7    std::string tname = name_.LocalName().Utf8();
 8    if (tname != "id" && tname != "name" && tname != "style")
 9      return value_;  // DOM属性的访问操作实在太多，挑些关键的处理吧
10
11    char tsource[1024], tdestination[1024], tfilepath[64];
12    FILE* tfile = fopen(".\\JSTracer\\getAttrReplace.config", "r");
13    if (!tfile)
14      return value_;
15    //这里使用fscanf的话，没法处理包含空白符的替换配置。后续可能需要注意修改
16    if (!fscanf(tfile, "%s%s", tsource, tdestination)) {
17      fclose(tfile);
18      return value_;
19    }
20    fclose(tfile);
21
22    std::string tvalue = value_.Utf8();
23    size_t tpos = 0;
24    for (bool treplaced = false; true; treplaced = true) {
25      tpos = tvalue.find(tsource, tpos);
26      if (tpos == tvalue.npos) {//没有其它可替换的tsource了，返回结果
27        if (treplaced) {//之前发生过替换，需要用掉一个全局缓冲区来生成AtomicString引用
28          int tindex = BUFFER_INDEX++;
29          BUFFER[tindex % 4096] = AtomicString::FromUTF8(tvalue.c_str());
30
31          sprintf(tfilepath, ".\\JSTracer\\Logs\\%lld_getAttr_Replaced_%d.log",
32                  time(0), tindex);
33          tfile = fopen(tfilepath, "w");
34          fprintf(tfile, "%s -> %s -> %s", tname.c_str(), value_.Utf8().c_str(),
35                  tvalue.c_str());
36          fclose(tfile);
37
38          return BUFFER[tindex % 4096];
39        } else {//没有发生过替换，返回原值即可
40          sprintf(tfilepath, ".\\JSTracer\\Logs\\%lld_getAttr_%d.log", time(0),
41                  LOG_INDEX++);
42          tfile = fopen(tfilepath, "w");
43          fprintf(tfile, "%s -> %s", tname.c_str(), value_.Utf8().c_str());
44          fclose(tfile);
45
46          return value_;
47        }
48        break;
49      }
50      //在tvalue中找到了tsource，执行替换并继续搜索
51      tvalue = tvalue.replace(tpos, strlen(tsource), tdestination);
52      tpos += strlen(tdestination);
53    }
54  }  //{ return value_; };

 1//新增函数StartWith，用来过滤掉一些我们不关心的动态脚本编译操作
 2bool StartWith(char* a, char* b) {
 3  for (int i = 0; a[i] != 0 && b[i] != 0; ++i)
 4    if (a[i] != b[i]) return false;
 5  return true;
 6}
 7MaybeHandle<JSFunction> Compiler::GetFunctionFromEval(
 8    Handle<String> source, Handle<SharedFunctionInfo> outer_info,
 9    Handle<Context> context, LanguageMode language_mode,
10    ParseRestriction restriction, int parameters_end_pos,
11    int eval_scope_position, int eval_position) {
12  Isolate* isolate = context->GetIsolate();
13  int source_length = source->length();
14  isolate->counters()->total_eval_size()->Increment(source_length);
15  isolate->counters()->total_compile_size()->Increment(source_length);
16
17  //在此处添加hook代码
18  static std::atomic_int INDEX = {0};
19  int tlength = 0;
20  std::unique_ptr<char[]> tsource =
21      source->ToCString(DISALLOW_NULLS, FAST_STRING_TRAVERSAL, &tlength);
22  char* ttsource = tsource.get();
23  //看上去应该是DevTool内置的一些脚本。因为数量非常多所以专门屏蔽一下。
24  if (!StartWith(ttsource, (char*)"Root.Runtime.cachedResources") &&
25      !StartWith(ttsource, (char*)"import('./") &&
26      !StartWith(ttsource, (char*)"TextEditor.CodeMirrorTextEditorFactory")) {
27    char tfile[64];
28    sprintf(tfile, ".\\JSTracer\\Logs\\%lld_eval_%d.log", time(0), ++INDEX);
29    WriteChars(tfile, ttsource, tlength, true);
30  }
31
32  ……

 1template <typename Impl>
 2typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseStatement(
 3    ZonePtrList<const AstRawString>* labels,
 4    ZonePtrList<const AstRawString>* own_labels,
 5AllowLabelledFunctionStatement allow_function) {
 6
 7 ……
 8
 9  switch (peek()) {
10
11   ……
12
13    case Token::DEBUGGER:
14      //return ParseDebuggerStatement();
15      Next();
16      return factory()->EmptyStatement();
17
18……
19  }
20}
21
22  ……