AST批量解决switch混淆

处理函数类型如下：

function $_BHH(t) {
      var $_DAHEv = bVnHz.$_DO()[3][13];

      for (; $_DAHEv !== bVnHz.$_DO()[9][12];) {
        switch ($_DAHEv) {
          case bVnHz.$_DO()[3][13]:
            return {
              ".popup_ghost": {},
              ".popup_box": {
                ".popup_header": {
                  "span.popup_tip": {},
                  "span.popup_close": {}
                },
                ".popup_wrap": t
              }
            };
            break;
        }
      }
}

        特征就是第一句是定义表达式，有bVnHz.$_DO()函数，下边是一个for嵌套者switch语句。

       思路就是先把case语句里内容取下来，然后把第一句包含bVnHz.$_DO()函数的变量表达式还有for加switch中break框架给删除。ast语句如下：

const fs =require('fs');
//js转AST代码
const parser =require('@babel/parser');
//遍历ASR节点
const traverse =require('@babel/traverse').default;
//用来判断节点类型产生新的节点
const t =require('@babel/types');
//用来把AST转换成js代码
const generator =require('@babel/generator').default;
const jscode=fs.readFileSync("./testdemo2.js", {
    encoding:"utf-8"
});
//console.log(sxplain(230));
let codeAarryList=[];
const deceil={
    VariableDeclaration(path){
        if(path.node.declarations.length==1&&path.node.declarations[0].type=="VariableDeclarator"){
            if(path.node.declarations[0].init!=null&&path.node.declarations[0].init.type=="MemberExpression"){
                if(path.node.declarations[0].init.object!=null&&path.node.declarations[0].init.object.type=="MemberExpression"){
                    if(path.node.declarations[0].init.object.object!=null&&path.node.declarations[0].init.object.object.type=="CallExpression"){
                        if(path.node.declarations[0].init.object.object.callee!=null&&path.node.declarations[0].init.object.object.callee.type=="MemberExpression"){
                            if(path.node.declarations[0].init.object.object.callee.property!=null&&path.node.declarations[0].init.object.object.callee.property.type=="Identifier"){
                                if(path.node.declarations[0].init.object.object.callee.property.name=="$_DO"){
                                    let ee =generator(path.node.declarations[0].init).code;
//                                    console.log(ee);
                                    path.remove();
                                }
                            }
                        }
                    }
                    //console.log(path.node.declarations[0].init.object.object.callee);
                }
            }
        }
    }
}
const deceil1={
    ForStatement(path){
        if(path.node.test.type=="BinaryExpression"&&path.node.test.right!=null&&path.node.test.right.type=="MemberExpression"){
            if(path.node.test.right.object!=null&&path.node.test.right.object.type=="MemberExpression"){
                if(path.node.test.right.object.object!=null){
                    if(path.node.test.right.object.object.callee!=null&&path.node.test.right.object.object.callee.type=="MemberExpression"){
                        if(path.node.test.right.object.object.callee.property.name=="$_DO"){
                            if(path.node.body.body[0].type=="SwitchStatement"){
                                path.traverse(deceil2);
                                path.remove();
                            }
                        }
                    }
                }
            }
        }
        //console.log(path.node.body.body[0].discriminant.name);
    }
}
const deceil2={
    SwitchStatement(path){
        //console.log(path.node.cases[i].consequent);
        console.log(path.node.cases.length);
        for(let i=0;i<path.node.cases.length;i++){
            for(let j=0;j<path.node.cases[i].consequent.length;j++){
                //console.log(path.node.cases[i].consequent[j]);
                path.traverse(deceil3);
                let codedemo =generator(path.node.cases[i].consequent[j]).code;
                codeAarryList.push(path.node.cases[i].consequent[j]);
                console.log(codedemo);
                console.log("分隔符");
            }
        }

    }
}
const deceil3={
    "BreakStatement|ExpressionStatement"(path){
         if(path.node.type=="BreakStatement"){
             path.remove();
         }
         if(path.node!=null){
            if(path.node.type=="ExpressionStatement"){
                if(path.node.expression!=null&&path.node.expression!="AssignmentExpression"){
                    //console.log(path.node.expression);
                    if(path.node.expression.right!=null&&path.node.expression.right.type=="MemberExpression"){
                        //console.log(path.node.expression.right);
                        if(path.node.expression.right.object!=null&&path.node.expression.right.object.type=="MemberExpression"){
                            if(path.node.expression.right.object.object!=null&&path.node.expression.right.object.object.type=="CallExpression"){
                                if(path.node.expression.right.object.object.callee!=null&&path.node.expression.right.object.object.callee.type=="MemberExpression"){
                                    if(path.node.expression.right.object.object.callee.object!=null){
                                        if(path.node.expression.right.object.object.callee.object.name=="bVnHz"){
                                             path.remove();
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
         }
    }
}
const visitor = {
    FunctionDeclaration(path) {
        if(path.node.body.body.length==2){
            if(path.node.body.body[0].type=="VariableDeclaration"){
                if(path.node.body.body.length>1&&path.node.body.body[1].type=="ForStatement"){
                    if(path.node.body.body[1].body.body[0].type=="SwitchStatement"){
                    //path.traverse(deceil);
                        //path.body.body.push();
                        path.traverse(deceil1);
                        path.traverse(deceil);
                        console.log("看这里");
                        //console.log(codeAarryList);
                        for (let i=0;i<codeAarryList.length;i++){
                             path.node.body.body.push(codeAarryList[i]);
                        }
                        codeAarryList=[];
                    }
                }
            }
        }
    }
}
let ast=parser.parse(jscode);
traverse(ast,visitor);
let code =generator(ast).code;
fs.writeFile('./testfter.js',code,(err)=>{});

 运行语句以后，原来的js如下：

function $_BHH(t) {
     return {
         ".popup_ghost": {},
         ".popup_box": {
             ".popup_header": {
                 "span.popup_tip": {},
                 "span.popup_close": {}
             },
             ".popup_wrap": t
          }
     };
}