Divergence: formatting a script can turn it into a different program, across 37+ JavaScript processors

Divergence

Why would you want this

Against LLM agents

Against reimplementation

The Tetris / Snake demo

Playground

Before the examples

The six types of divergence

Rerouted: Chromium DevTools

How the formatter works

(()=>{
console.log("Hello World!");
});

=>       ArrowFunctionExpression  ->  sts   space, token, space
{        BlockStatement           ->  tn>   token, newline, indent
console  Identifier               ->  t     token only

output = ''
for each token:
    output += (spacing/newline/indent the rules decide)
    output += originalText.substring(token.start, token.end)

( () => {
    console.log("Hello World!");
});

Stacked unary plus mutates the operand

var m = 0;
+ +m;
console.log(m); // 0

var m = 0;
++m; // "+ +" -> "++"
console.log(m); // 1

return AT.keyword(token) && !AT.keyword(token, 'this') ? 'ts' : 't';

Rewritten: WebCrack

How the transforms work

logicalExpression(          a || (a = 1)
  operator,                 ||
  left,                     a          <- captured
  assignmentExpression(     (a = 1)
    '=',
    fromCapture(left),      a          <- has to look the same as the captured one
    right                   1
  )
)

Logical assignment evaluates the left side once instead of twice

var calls = 0;
function getConfig() {
  calls++;
  return {};
}
getConfig().ready || (getConfig().ready = true);
console.log(calls); // 2

var calls = 0;
function getConfig() {
  calls++;
  return {};
}
getConfig().ready ||= true; // two calls -> one call
console.log(calls); // 1

const left = m.capture(m.or(m.identifier(), m.memberExpression()));
const idMatcher = m.logicalExpression(
  operator,
  left,
  m.assignmentExpression('=', m.fromCapture(left), right),
);

// ...

path.replaceWith(
  t.assignmentExpression(operator.current + '=', left.current, right.current),
);

Folded: Restringer

How Restringer works

Builtin calls get resolved even after the builtin was replaced

globalThis.atob = function () { return 'Hello, World!'; };
console.log(atob('R29vZGJ5ZSwgV29ybGQh')); // Hello, World!

globalThis.atob = function () {
  return 'Hello, World!';
};
console.log('Goodbye, World!'); // Goodbye, World!

if (n.callee?.declNode || n?.callee?.object?.declNode || ...) {
  continue;
}

if (n.type === 'CallExpression' && AVAILABLE_SAFE_IMPLEMENTATIONS.includes(n.callee.name)) {
  matches.push(n);
}

export function atob(val) {
  return Buffer.from(val, 'base64').toString();
}

Stripped: new-datadome-deobfuscator

How new-datadome-deobfuscator works

new is dropped from a sequence

var count = 0;
function Tick() {
  count++;
}
function step(x) {
  return (new Tick(), x);
}
step(1);
console.log(count); // 1

var count = 0;
function Tick() {
  count++;
}
function step(x) {
  return x; // "new Tick()" is gone
}
console.log(count); // 0

if (isIIFE(expr)) {
  hasSideEffects = true;
}
else if (t.isCallExpression(expr)) {
  hasSideEffects = true;
}
// ...AssignmentExpression, UpdateExpression, MemberExpression, Identifier, bitwise BinaryExpression...
else if (hasSideEffectsOrRuntimeDeps(expr)) {
  hasSideEffects = true;
}

if (usefulExpressions.length === 1) {
  path.replaceWith(usefulExpressions[0]);
}

Pruned: obfuscator-io-deobfuscator

How obfuscator-io-deobfuscator works

null is a truthy condition

if (null) {
  console.log('decoy');
} else {
  console.log('real'); // runs
}

console.log('decoy'); // the if, the else and 'real' are gone

IfStatement(path) {
    if (self.isSemiLiteral(path.node.test)) {
        if (self.isTruthy(path.node.test)) {
            const statements = t.isBlockStatement(path.node.consequent)
                ? path.node.consequent.body
                : [path.node.consequent];
            path.replaceWithMultiple(statements);
// ...

isSemiLiteral(node) {
    return t.isLiteral(node) || t.isArrayExpression(node) || t.isObjectExpression(node);
}

isTruthy(literal) {
    return t.isBooleanLiteral(literal) || t.isNumericLiteral(literal) || t.isStringLiteral(literal)
        ? !!literal.value
        : true;
}

Erased: Terser

How Terser works

An in that throws is treated as pure

function guard() {
  var unused = 0 in 1; // TypeError: Cannot use 'in' operator to search for '0' in 1
}
try {
  guard();
  console.log('decoy');
} catch (e) {
  console.log('real'); // runs
}

function guard(){}try{guard(),console.log("decoy")}catch(o){console.log("real")} // decoy

def_has_side_effects(AST_Constant, return_false);
def_has_side_effects(AST_Binary, function(compressor) {
    return this.left.has_side_effects(compressor)
        || this.right.has_side_effects(compressor);
});

def_drop_side_effect_free(AST_Constant, return_null);
def_drop_side_effect_free(AST_Binary, function (compressor, first_in_statement) {
    var right = this.right.drop_side_effect_free(compressor);
    if (!right)
        return this.left.drop_side_effect_free(compressor, first_in_statement);

CSS

<style>
 .raw{display:none!important}
.raw{display:none}.cr{display:none}.ff{display:none}
.state{&:not(button:hover){.raw{display:block}}}
@media (min-width:1px){[data-k]/*
*/ .cr{display:block}}
.state .ff{display:block 
</style>