Skip to content

[BUG] Destroy Private Fields #1056

Closed
Closed

Description

@BlackYuzia

Expected Behavior

You could use private fields after obfuscation without errors

Current Behavior

You can't use private fields after obfuscation, but you could did it without (obfuscate).

Steps to Reproduce

  1. Use private fields
  2. Lose the keys Get error.

Your Environment

  • Obfuscator version used: 3.4.4
  • Node version used: 16.17.1

Stack trace

Minimal working example that will help to reproduce issue

class Kruzya {
    #keys; // private, you can't steal my keys!
    #count;

    constructor(name, count = 0) {
        this.#keys = [];
        this.name = name;
        this.#count = count;
    }

    stealKeys() {
        for (const iterator of new Array(this.#count).fill(0)) {
            this.#keys.push(iterator);
        }
    }

    getInfo() {
        console.log("%s, steal [%s] of your keys!", this.name, this.#keys.length);
    }

}

const kruzya = new Kruzya("Kruzya", ~~(Math.random() * 500));
kruzya.stealKeys();
kruzya.getInfo()

Activity

  1. sanex3339 commented on Feb 9, 2022

    @sanex3339
    Member

    Try to evaluate the code above directly in the browser's console.
    I don't see any difference between original and obfuscated code:

    const g = b;
    class Kruzya {
        #keys;
        #count;
        constructor(c, d = 0x0) {
            const e = b;
            this.#keys = [];
            this[e(0x18d)] = c;
            this.#count = d;
        }
        ['stealKeys']() {
            const f = b;
            for (const c of new Array(this.#count)[f(0x187)](0x0)) {
                this.#keys[f(0x18a)](c);
            }
        }
        [g(0x18b)]() {
            const h = g;
            console[h(0x18c)](h(0x189), this['name'], this.#keys['length']);
        }
    }
    function b(c, d) {
        const e = a();
        b = function (f, g) {
            f = f - 0x187;
            let h = e[f];
            return h;
        };
        return b(c, d);
    }
    const kruzya = new Kruzya(g(0x188), ~~(Math['random']() * 0x1f4));
    kruzya['stealKeys']();
    function a() {
        const i = [
            'fill',
            'Kruzya',
            '%s,\x20steal\x20[%s]\x20of\x20your\x20keys!',
            'push',
            'getInfo',
            'log',
            'name'
        ];
        a = function () {
            return i;
        };
        return a();
    }
    kruzya[g(0x18b)]();
    
    
  2. BlackYuzia commented on Feb 9, 2022

    @BlackYuzia
    ContributorAuthor

    hmm, I could give you my current config. Maybe some function(s) do not enabled in your code? Idk what exactly function broke the code.

    My Config
    {
      "compact": true,
      "controlFlowFlattening": true,
      "controlFlowFlatteningThreshold": 1,
      "deadCodeInjection": true,
      "deadCodeInjectionThreshold": 1,
      "debugProtection": false,
      "debugProtectionInterval": false,
      "disableConsoleOutput": false,
      "identifierNamesGenerator": "hexadecimal",
      "log": true,
      "numbersToExpressions": true,
      "renameGlobals": true,
      "renameProperties": true,
      "renamePropertiesMode": "safe",
      "selfDefending": true,
      "simplify": true,
      "splitStrings": true,
      "splitStringsChunkLength": 3,
      "stringArray": true,
      "stringArrayCallsTransform": true,
      "stringArrayEncoding": [
          "rc4"
      ],
      "stringArrayIndexShift": true,
      "stringArrayRotate": true,
      "stringArrayShuffle": true,
      "stringArrayWrappersCount": 5,
      "stringArrayWrappersChainedCalls": true,
      "stringArrayWrappersParametersMaxCount": 5,
      "stringArrayWrappersType": "function",
      "stringArrayThreshold": 1,
      "transformObjectKeys": true,
      "unicodeEscapeSequence": false,
      "ignoreRequireImports": false
    }
  3. sanex3339 commented on Feb 9, 2022

    @sanex3339
    Member

    It's because deadCodeInjection adds some statements with private fields to other parts of the code

  4. BlackYuzia commented on Feb 9, 2022

    @BlackYuzia
    ContributorAuthor

    meme, so that bug?

  5. sanex3339 commented on Feb 9, 2022

    @sanex3339
    Member
  6. BlackYuzia commented on Feb 9, 2022

    @BlackYuzia
    ContributorAuthor

    @sanex3339 what about not ignore, just add before constructor fields?
    like:

    class {
     #private
     // ... mb any else?
     constructor() {this.#private = ...}
    }

    Because, If you use any private field(s), that could help you deobfuscate code?

  7. sanex3339 commented on Feb 9, 2022

    @sanex3339
    Member

    Such statements might be added to any places outside of a class

  8. BlackYuzia commented on Feb 9, 2022

    @BlackYuzia
    ContributorAuthor

    Should I test it with new build?

  9. sanex3339 commented on Feb 9, 2022

    @sanex3339
    Member

    Released as 3.2.5

  10. BlackYuzia commented on Feb 10, 2022

    @BlackYuzia
    ContributorAuthor

    Yep, fixed
    image

    #1053 trouble isn't fixed yet :c

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions