diff --git a/README.md b/README.md index 36ca935..4158040 100644 --- a/README.md +++ b/README.md @@ -66,6 +66,11 @@ obfuscation-detector --help - **stopAfterFirst**: If `true`, returns after the first positive detection (default). If `false`, returns all detected types. - **Returns**: An array of detected obfuscation type names. Returns an empty array if no known type is detected. +### `detectObfuscationFlatAST(tree: ASTNode[], stopAfterFirst: boolean = true): string[]` +- **code**: JavaScript source code as an AST Tree; returned by flast's generateFlatAST. +- **stopAfterFirst**: If `true`, returns after the first positive detection (default). If `false`, returns all detected types. +- **Returns**: An array of detected obfuscation type names. Returns an empty array if no known type is detected. + ## Supported Obfuscation Types Descriptions and technical details for each type are available in [src/detectors/README.md](src/detectors/README.md): - [Array Replacements](src/detectors/arrayReplacements.js) diff --git a/src/index.js b/src/index.js index 3cc143f..bca7f95 100644 --- a/src/index.js +++ b/src/index.js @@ -10,14 +10,13 @@ import * as detectors from './detectors/index.js'; /** * Detects obfuscation types in JavaScript code by analyzing its AST. * - * @param {string} code - The JavaScript source code to analyze. + * @param {ASTNode[]} tree - Existing AST tree from generateFlatAST to analyze. * @param {boolean} [stopAfterFirst=true] - If true, returns after the first positive detection; if false, returns all matches. * @returns {string[]} An array of detected obfuscation type names. Returns an empty array if no known type is detected. */ -function detectObfuscation(code, stopAfterFirst = true) { +function detectObfuscationFlatAST(tree, stopAfterFirst = true) { const detectedObfuscations = []; try { - const tree = generateFlatAST(code); for (const detectorName of Object.keys(detectors)) { try { const detectionType = detectors[detectorName](tree, detectedObfuscations); @@ -35,4 +34,22 @@ function detectObfuscation(code, stopAfterFirst = true) { return detectedObfuscations; } -export {detectObfuscation}; \ No newline at end of file + +/** + * Detects obfuscation types in JavaScript code by analyzing its AST. + * + * @param {string} code - The JavaScript source code to analyze. + * @param {boolean} [stopAfterFirst=true] - If true, returns after the first positive detection; if false, returns all matches. + * @returns {string[]} An array of detected obfuscation type names. Returns an empty array if no known type is detected. + */ +function detectObfuscation(code, stopAfterFirst = true) { + let tree; + try { + tree = generateFlatAST(code); + } catch (e) { + logger.debug(e.message); // Keep for debugging + } + return detectObfuscationFlatAST(tree, stopAfterFirst); +} + +export {detectObfuscation, detectObfuscationFlatAST}; \ No newline at end of file