实战还原 V8 bytenode 保护 JS（V8 字节码分析记录）#

1
const vm = require('vm');
2
const v8 = require('v8');
3
const zlib = require('zlib');
4
const fs = require('fs');
5
const path = require('path');
6
const Module = require('module');
7
v8.setFlagsFromString('--no-lazy');
8
v8.setFlagsFromString('--no-flush-bytecode');
9
global.generateScript=function(cachedData, filename) {
10
   cachedData = zlib.brotliDecompressSync(cachedData);
11
   fixBytecode(cachedData);
12
   const length = readSourceHash(cachedData);
13
   let dummyCode = '';
14
   if (length > 1) {
15
         dummyCode = '"' + '\u200b'.repeat(length - 2) + '"';
16
   }
17
   const script = new vm.Script(dummyCode, {
18
         cachedData,
19
         filename
20
   });
21
   if (script.cachedDataRejected) {
22
         throw new Error('');
23
   }
24
   return script;
25
}
26
global.compileCode = function(javascriptCode, compress) {
27
   const script = new vm.Script(javascriptCode, {
28
         produceCachedData: true
29
   });
30
   let bytecodeBuffer = (script.createCachedData && script.createCachedData.call) ?
31
         script.createCachedData() :
32
         script.cachedData;
33
   if (compress) bytecodeBuffer = zlib.brotliCompressSync(bytecodeBuffer);
34
   return bytecodeBuffer;
35
};
36
global.fixBytecode = function(bytecodeBuffer) {
37
   const dummyBytecode = compileCode('');
38
   dummyBytecode.subarray(12, 16).copy(bytecodeBuffer, 12);
39
};
40
global.readSourceHash = function(bytecodeBuffer) {
41
   return bytecodeBuffer.subarray(8, 12).reduce((sum, number, power) => sum += number * Math.pow(256, power), 0);
42
};
43
try {
44
   Module._extensions['.jsc'] = function(fileModule, filename) {
45
         const data = fs.readFileSync(filename, 'utf8')
46
         const bytecodeBuffer = Buffer.from(data, 'base64');
47
         const script = generateScript(bytecodeBuffer, filename);
48

49
         function require(id) {
50
            return fileModule.require(id);
51
         }
52
         require.resolve = function(request, options) {
53
            return Module._resolveFilename(request, fileModule, false, options);
54
         };
55
         if (process.main) {
56
            require.main = process.main;
57
         }
58
         require.extensions = Module._extensions;
59
         require.cache = Module._cache;
60
         const compiledWrapper = script.runInThisContext({
61
            filename: filename,
62
            lineOffset: 0,
63
            columnOffset: 0,
64
            displayErrors: true
65
         });
66
         const dirname = path.dirname(filename);
67
         const args = [
68
            fileModule.exports, require, fileModule, filename, dirname, process, global
69
         ];
70
         return compiledWrapper.apply(fileModule.exports, args);
71
   };
72
} catch (ex) {
73
   console.error('xrequire:' + ex.message);
74
}
75
require("${codeScript}")

1
dcheck_always_on = false
2
is_clang = false
3
is_component_build = false
4
is_debug = false
5
target_cpu = "x64"
6
use_custom_libcxx = false
7
v8_monolithic = true
8
v8_use_external_startup_data = false
9
v8_static_library = true
10
v8_enable_disassembler = true
11
v8_enable_object_print = true
12
treat_warnings_as_errors = false
13
v8_enable_pointer_compression = false
14
v8_enable_31bit_smis_on_64bit_arch = false
15
v8_enable_lite_mode = false
16
v8_enable_i18n_support = true
17
v8_enable_webassembly = true

1
@@ SerializedCodeData::SanityCheck
2
-  SanityCheckResult result = SanityCheckWithoutSource();
3
-  if (result != CHECK_SUCCESS) return result;
4
-  ...
5
-  return CHECK_SUCCESS;
6
+  return SerializedCodeData::SanityCheckResult::CHECK_SUCCESS;
7

8
@@ SerializedCodeData::SanityCheckWithoutSource
9
-  if (this->size_ < kHeaderSize) return INVALID_HEADER;
10
-  uint32_t magic_number = GetMagicNumber();
11
-  if (magic_number != kMagicNumber) return MAGIC_NUMBER_MISMATCH;
12
-  ...
13
-  if (Checksum(ChecksummedContent()) != c) return CHECKSUM_MISMATCH;
14
-  return CHECK_SUCCESS;
15
+  return SerializedCodeData::SanityCheckResult::CHECK_SUCCESS;

1
@@ Deserializer<IsolateT>::Deserializer
2
-  CHECK_EQ(magic_number_, SerializedData::kMagicNumber);
3
+  /*
4
+  CHECK_EQ(magic_number_, SerializedData::kMagicNumber);
5
+  */
6
@@ ReadSingleBytecodeData
7
+  std::fprintf(stderr, "[FATAL] Unknown serializer bytecode: 0x%02x\n", data);

1
thread_local int g_in_bytecode_disasm = 0;
2
...
3
  ++g_in_bytecode_disasm;
4
  hbc->Disassemble(*(c->os));
5
  --g_in_bytecode_disasm;
6
@@ SharedFunctionInfoPrint
7
  PrintSourceCode(os);
8
  // PrintSourceCode(os);
9
  int exc = SehWrapCall(DoBcDisasm, &ctx);
10
  if (exc != 0) { os << "<BytecodeArray Disassemble CRASHED ...>"; }

1
extern thread_local int g_in_bytecode_disasm;
2
void SafePrintSharedFunctionInfo(...);
3
void SafePrintFixedArray(...);
4
...
5
 case SHARED_FUNCTION_INFO_TYPE:
6
  if (g_in_bytecode_disasm > 0) { break; }
7
  SafePrintSharedFunctionInfo(shared, os);
8
 case FIXED_ARRAY_TYPE:
9
  SafePrintFixedArray(FixedArray::cast(*this), os);

1
void Shell::LoadBytecode(...)
2
std::deque<i::Handle<i::SharedFunctionInfo>> queue;
3
std::unordered_set<i::Address> seen;
4
while (!queue.empty()) { ... }
5
global_template->Set(isolate, "loadBytecode",
6
                     FunctionTemplate::New(isolate, LoadBytecode));