1 var ZeParser = require('zeparser').ZeParser;
2 var Util = require('util');
4 module.exports = ActiveXObfuscator;
5 function ActiveXObfuscator(code) {
6 if (!(this instanceof ActiveXObfuscator)) {
7 var obfuscator = new ActiveXObfuscator(code);
9 return obfuscator.toString();
12 this._parser = ZeParser.createParser(code);
15 var OBFUSCATED_ACTIVE_X_OBJECT = ActiveXObfuscator.OBFUSCATED_ACTIVE_X_OBJECT =
16 "(['Active'].concat('Object').join('X'))";
17 var OBFUSCATED_ACTIVE_X = ActiveXObfuscator.OBFUSCATED_ACTIVE_X =
18 "(['Active'].concat('').join('X'))";
20 ActiveXObfuscator.prototype.execute = function() {
21 this._parser.tokenizer.fixValues();
22 this._obfuscate(this.getAst());
25 ActiveXObfuscator.prototype.getAst = function() {
26 return this._parser.stack;
29 ActiveXObfuscator.prototype.getWhiteTokens = function() {
30 return this._parser.tokenizer.wtree;
33 ActiveXObfuscator.prototype._obfuscate = function(ast) {
36 ast.forEach(function(node, index) {
37 if (Array.isArray(node)) {
38 self._obfuscate(node);
44 if (!node.isPropertyName) {
45 node.value = 'window[' + OBFUSCATED_ACTIVE_X_OBJECT + ']';
49 var dot = ast[index - 1]
50 var whiteTokens = self.getWhiteTokens();
51 whiteTokens[dot.tokposw].value = '';
53 node.value = '[' + OBFUSCATED_ACTIVE_X_OBJECT + ']';
55 case "'ActiveXObject'":
56 case '"ActiveXObject"':
57 node.value = OBFUSCATED_ACTIVE_X_OBJECT;
61 node.value = OBFUSCATED_ACTIVE_X;
64 if (!/ActiveX/i.test(node.value)) {
68 if (!node.isComment) {
69 throw new Error('Unknown ActiveX occurence in: ' + Util.inspect(node));
72 node.value = node.value.replace(/ActiveX/i, 'Ac...eX');
78 ActiveXObfuscator.prototype.toString = function() {
79 var whiteTokens = this.getWhiteTokens();
80 return whiteTokens.reduce(function(output, node) {
81 return output += node.value;