Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,11 @@ obfuscation-detector --help
- **stopAfterFirst**: If `true`, returns after the first positive detection (default). If `false`, returns all detected types.
- **Returns**: An array of detected obfuscation type names. Returns an empty array if no known type is detected.

### `detectObfuscationFlatAST(tree: ASTNode[], stopAfterFirst: boolean = true): string[]`
- **code**: JavaScript source code as an AST Tree; returned by flast's generateFlatAST.
- **stopAfterFirst**: If `true`, returns after the first positive detection (default). If `false`, returns all detected types.
- **Returns**: An array of detected obfuscation type names. Returns an empty array if no known type is detected.

## Supported Obfuscation Types
Descriptions and technical details for each type are available in [src/detectors/README.md](src/detectors/README.md):
- [Array Replacements](src/detectors/arrayReplacements.js)
Expand Down
25 changes: 21 additions & 4 deletions src/index.js
Original file line number Diff line number Diff line change
Expand Up @@ -10,14 +10,13 @@ import * as detectors from './detectors/index.js';
/**
* Detects obfuscation types in JavaScript code by analyzing its AST.
*
* @param {string} code - The JavaScript source code to analyze.
* @param {ASTNode[]} tree - Existing AST tree from generateFlatAST to analyze.
* @param {boolean} [stopAfterFirst=true] - If true, returns after the first positive detection; if false, returns all matches.
* @returns {string[]} An array of detected obfuscation type names. Returns an empty array if no known type is detected.
*/
function detectObfuscation(code, stopAfterFirst = true) {
function detectObfuscationFlatAST(tree, stopAfterFirst = true) {
const detectedObfuscations = [];
try {
const tree = generateFlatAST(code);
for (const detectorName of Object.keys(detectors)) {
try {
const detectionType = detectors[detectorName](tree, detectedObfuscations);
Expand All @@ -35,4 +34,22 @@ function detectObfuscation(code, stopAfterFirst = true) {
return detectedObfuscations;
}

export {detectObfuscation};

/**
* Detects obfuscation types in JavaScript code by analyzing its AST.
*
* @param {string} code - The JavaScript source code to analyze.
* @param {boolean} [stopAfterFirst=true] - If true, returns after the first positive detection; if false, returns all matches.
* @returns {string[]} An array of detected obfuscation type names. Returns an empty array if no known type is detected.
*/
function detectObfuscation(code, stopAfterFirst = true) {
let tree;
try {
tree = generateFlatAST(code);
} catch (e) {
logger.debug(e.message); // Keep for debugging
}
return detectObfuscationFlatAST(tree, stopAfterFirst);
}

export {detectObfuscation, detectObfuscationFlatAST};