diff --git a/backend/src/index.js b/backend/src/index.js index 1ecb0c7..2d3e30c 100644 --- a/backend/src/index.js +++ b/backend/src/index.js @@ -1,4 +1,3 @@ - const express = require('express'); const cors = require('cors'); const app = express(); @@ -109,7 +108,8 @@ app.use('/api/projects', passport.authenticate('jwt', {session: false}), project app.use('/api/scripts', passport.authenticate('jwt', {session: false}), scriptsRoutes); -app.use('/api/builds', passport.authenticate('jwt', {session: false}), buildsRoutes); +// Build routes are now public-facing for the playground +app.use('/api/builds', buildsRoutes); app.use('/api/vm_configs', passport.authenticate('jwt', {session: false}), vm_configsRoutes); @@ -163,4 +163,4 @@ db.sequelize.sync().then(function () { }); }); -module.exports = app; +module.exports = app; \ No newline at end of file diff --git a/backend/src/routes/builds.js b/backend/src/routes/builds.js index 8d015aa..d9eaf37 100644 --- a/backend/src/routes/builds.js +++ b/backend/src/routes/builds.js @@ -1,8 +1,8 @@ - const express = require('express'); - +const passport = require('passport'); const BuildsService = require('../services/builds'); const BuildsDBApi = require('../db/api/builds'); +const ObfuscatorService = require('../services/obfuscator'); const wrapAsync = require('../helpers').wrapAsync; @@ -15,8 +15,54 @@ const { checkCrudPermissions, } = require('../middlewares/check-permissions'); -router.use(checkCrudPermissions('builds')); +/** + * @swagger + * /api/builds/protect: + * post: + * tags: [Builds] + * summary: Obfuscate Luau code + * requestBody: + * required: true + * content: + * application/json: + * schema: + * properties: + * source: + * type: string + * config: + * type: object + * responses: + * 200: + * description: Obfuscated code + * content: + * application/json: + * schema: + * properties: + * protectedCode: + * type: string + */ +router.post('/protect', wrapAsync(async (req, res) => { + const { source, config } = req.body; + const protectedCode = ObfuscatorService.obfuscate(source, config); + + // Log the build if possible, but don't fail if no user + try { + await BuildsService.create({ + version: '1.0.0', + notes: `Playground build: ${source.substring(0, 20)}...`, + success: true + }, req.currentUser); + } catch (e) { + console.error('Failed to log playground build:', e.message); + } + + res.status(200).send({ protectedCode }); +})); + +// Apply authentication and permission checks to all other routes +router.use(passport.authenticate('jwt', { session: false })); +router.use(checkCrudPermissions('builds')); /** * @swagger @@ -429,4 +475,4 @@ router.get('/:id', wrapAsync(async (req, res) => { router.use('/', require('../helpers').commonErrorHandler); -module.exports = router; +module.exports = router; \ No newline at end of file diff --git a/backend/src/services/obfuscator.js b/backend/src/services/obfuscator.js new file mode 100644 index 0000000..9afbbd2 --- /dev/null +++ b/backend/src/services/obfuscator.js @@ -0,0 +1,216 @@ +const crypto = require('crypto'); + +class ObfuscatorService { + static obfuscate(sourceCode, config = {}) { + const seed = crypto.randomBytes(4).readUInt32BE(0); + const opcodeMap = this.generateRandomOpcodeMap(seed); + const { bytecode, constants } = this.compile(sourceCode, opcodeMap); + return this.generateVMRunner(bytecode, constants, opcodeMap, seed, config); + } + + static generateRandomOpcodeMap(seed) { + const baseOpcodes = [ + 'LOADK', 'GETGLOBAL', 'SETGLOBAL', 'CALL', 'RETURN', + 'MOVE', 'ADD', 'SUB', 'MUL', 'DIV', 'MOD', 'POW', + 'UNM', 'NOT', 'LEN', 'CONCAT', 'JMP', 'EQ', 'LT', 'LE', + 'FORLOOP', 'FORPREP', 'TFORCALL', 'TFORLOOP', 'SETLIST', + 'CLOSE', 'CLOSURE', 'VARARG', 'FAKE' + ]; + + // Add many fake opcodes for "noise" + for (let i = 0; i < 30; i++) { + baseOpcodes.push(`NOISE_${i}`); + } + + const shuffled = [...baseOpcodes].sort(() => this.seededRandom(seed++) - 0.5); + const map = {}; + shuffled.forEach((op, index) => { + map[op] = index + 5; // Offset by 5 + }); + return map; + } + + static seededRandom(seed) { + const x = Math.sin(seed) * 10000; + return x - Math.floor(x); + } + + static compile(code, opcodeMap) { + const constants = []; + const bytecode = []; + + const getConstant = (val) => { + let idx = constants.indexOf(val); + if (idx === -1) { + idx = constants.length; + constants.push(val); + } + return idx; + }; + + const lines = code.split('\n').map(l => l.trim()).filter(l => l.length > 0 && !l.startsWith('--')); + + lines.forEach(line => { + // Basic call: print("hello") + const callMatch = line.match(/^(\w+)\s*\(.*\)$/); + if (callMatch) { + const funcName = callMatch[1]; + const argsStr = line.match(/\((.*)\)/)?.[1] || ""; + const args = argsStr ? this.splitArgs(argsStr) : []; + + bytecode.push(opcodeMap['GETGLOBAL'], 0, getConstant(funcName)); + args.forEach((arg, i) => { + const reg = i + 1; + this.pushValueToReg(arg, reg, bytecode, opcodeMap, getConstant); + }); + bytecode.push(opcodeMap['CALL'], 0, args.length + 1, 1); + return; + } + + // Basic assignment: x = 10 + const assignMatch = line.match(/^(\w+)\s*=\s*(.*)$/); + if (assignMatch) { + const varName = assignMatch[1]; + const val = assignMatch[2].trim(); + this.pushValueToReg(val, 0, bytecode, opcodeMap, getConstant); + bytecode.push(opcodeMap['SETGLOBAL'], 0, getConstant(varName)); + return; + } + + // Add "opaque predicates" simulation + if (Math.random() > 0.8) { + bytecode.push(opcodeMap['JMP'], 1); + bytecode.push(opcodeMap[`NOISE_${Math.floor(Math.random() * 10)}`], 0xFF); + } + }); + + bytecode.push(opcodeMap['RETURN'], 0, 1); + return { bytecode, constants }; + } + + static splitArgs(argsStr) { + const args = []; + let current = ""; + let inString = false; + for (let i = 0; i < argsStr.length; i++) { + const c = argsStr[i]; + if (c === '"' || c === "'") inString = !inString; + if (c === ',' && !inString) { + args.push(current.trim()); + current = ""; + } else { + current += c; + } + } + args.push(current.trim()); + return args.filter(a => a.length > 0); + } + + static pushValueToReg(val, reg, bytecode, opcodeMap, getConstant) { + if (val.startsWith('"') || val.startsWith("'")) { + bytecode.push(opcodeMap['LOADK'], reg, getConstant(val.substring(1, val.length - 1))); + } else if (!isNaN(val)) { + bytecode.push(opcodeMap['LOADK'], reg, getConstant(Number(val))); + } else if (val === "true") { + bytecode.push(opcodeMap['LOADK'], reg, getConstant(true)); + } else if (val === "false") { + bytecode.push(opcodeMap['LOADK'], reg, getConstant(false)); + } else { + bytecode.push(opcodeMap['GETGLOBAL'], reg, getConstant(val)); + } + } + + static generateVMRunner(bytecode, constants, opcodeMap, seed, config) { + const k1 = (seed % 250) + 1; + const k2 = ((seed >> 8) % 250) + 1; + + const encBytecode = []; + let rolling = k1; + bytecode.forEach((b) => { + const enc = (b ^ rolling) ^ k2; + encBytecode.push(enc); + rolling = (rolling + enc) % 256; + }); + + const encConstants = constants.map(c => { + if (typeof c === 'string') { + const chars = c.split('').map(char => { + let v = char.charCodeAt(0) ^ k1; + v = (v ^ 0xAA) ^ k2; + return v; + }); + return { t: 's', d: chars }; + } + if (typeof c === 'number') { + return { t: 'n', d: (c ^ k1) ^ 0x55 }; + } + if (typeof c === 'boolean') { + return { t: 'b', d: c ? 1 : 0 }; + } + return { t: 'z', d: 0 }; + }); + + const opsMapping = Object.entries(opcodeMap).map(([k, v]) => `[${v}] = "${k}"`).join(','); + const varL = "L_" + crypto.randomBytes(2).toString('hex'); + const varC = "C_" + crypto.randomBytes(2).toString('hex'); + const varK = "K_" + crypto.randomBytes(2).toString('hex'); + const varO = "O_" + crypto.randomBytes(2).toString('hex'); + const varB = "B_" + crypto.randomBytes(2).toString('hex'); + + const constantsStr = encConstants.map(c => { + const dataStr = Array.isArray(c.d) ? `{${c.d.join(',')}}` : c.d; + return `{t="${c.t}",d=${dataStr}}`; + }).join(','); + + const lua = `--[[ Luartex VM Protection ]] +local function Luartex_VM(...) + local ${varL} = {${encBytecode.join(',')}} + local ${varC} = {${constantsStr}} + local ${varK} = {${k1}, ${k2}} + local ${varO} = {${opsMapping}} + local ${varB} = bit32 or {bxor = function(a, b) local r, m = 0, 1 while a > 0 or b > 0 do if a % 2 ~= b % 2 then r = r + m end a, b, m = math.floor(a / 2), math.floor(b / 2), m * 2 end return r end} + local function _DECODE(v, k, k2) if v.t == "s" then local s = "" for i = 1, #v.d do local val = ${varB}.bxor(v.d[i], k2) s = s .. string.char(${varB}.bxor(val, k)) end return s elseif v.t == "n" then return ${varB}.bxor(${varB}.bxor(v.d, k), 0x55) elseif v.t == "b" then return v.d == 1 end return nil end + local function _EXECUTE() + local _ENV = getfenv() local _REG = {} local _PC = 1 local _RUNNING = true local _ROLLING = ${varK}[1] + while _RUNNING and _PC <= #${varL} do + local _RAW = ${varL}[_PC] local _OP = ${varB}.bxor(${varB}.bxor(_RAW, _ROLLING), ${varK}[2]) + _ROLLING = (_ROLLING + _RAW) % 256 _PC = _PC + 1 + local _MN = ${varO}[_OP] + if _MN == "LOADK" then + local _R = ${varB}.bxor(${varB}.bxor(${varL}[_PC], _ROLLING), ${varK}[2]) + _ROLLING = (_ROLLING + ${varL}[_PC]) % 256 _PC = _PC + 1 + local _CI = ${varB}.bxor(${varB}.bxor(${varL}[_PC], _ROLLING), ${varK}[2]) + _ROLLING = (_ROLLING + ${varL}[_PC]) % 256 _PC = _PC + 1 + _REG[_R] = _DECODE(${varC}[_CI + 1], ${varK}[1], ${varK}[2]) + elseif _MN == "GETGLOBAL" then + local _R = ${varB}.bxor(${varB}.bxor(${varL}[_PC], _ROLLING), ${varK}[2]) + _ROLLING = (_ROLLING + ${varL}[_PC]) % 256 _PC = _PC + 1 + local _CI = ${varB}.bxor(${varB}.bxor(${varL}[_PC], _ROLLING), ${varK}[2]) + _ROLLING = (_ROLLING + ${varL}[_PC]) % 256 _PC = _PC + 1 + _REG[_R] = _ENV[_DECODE(${varC}[_CI + 1], ${varK}[1], ${varK}[2])] + elseif _MN == "SETGLOBAL" then + local _R = ${varB}.bxor(${varB}.bxor(${varL}[_PC], _ROLLING), ${varK}[2]) + _ROLLING = (_ROLLING + ${varL}[_PC]) % 256 _PC = _PC + 1 + local _CI = ${varB}.bxor(${varB}.bxor(${varL}[_PC], _ROLLING), ${varK}[2]) + _ROLLING = (_ROLLING + ${varL}[_PC]) % 256 _PC = _PC + 1 + _ENV[_DECODE(${varC}[_CI + 1], ${varK}[1], ${varK}[2])] = _REG[_R] + elseif _MN == "CALL" then + local _R = ${varB}.bxor(${varB}.bxor(${varL}[_PC], _ROLLING), ${varK}[2]) + _ROLLING = (_ROLLING + ${varL}[_PC]) % 256 _PC = _PC + 1 + local _NA = ${varB}.bxor(${varB}.bxor(${varL}[_PC], _ROLLING), ${varK}[2]) + _ROLLING = (_ROLLING + ${varL}[_PC]) % 256 _PC = _PC + 1 + local _NR = ${varB}.bxor(${varB}.bxor(${varL}[_PC], _ROLLING), ${varK}[2]) + _ROLLING = (_ROLLING + ${varL}[_PC]) % 256 _PC = _PC + 1 + local _AS = {} + if _NA > 1 then for i = 1, _NA - 1 do _AS[i] = _REG[_R + i] end end + local _F = _REG[_R] + local _S, _RE = pcall(_F, unpack(_AS)) + if _NR > 1 then for i = 1, _NR - 1 do _REG[_R + i - 1] = _RE end end + elseif _MN == "RETURN" then _RUNNING = false + elseif _MN and _MN:find("NOISE") then _ROLLING = (_ROLLING + ${varL}[_PC]) % 256 _PC = _PC + 1 + end + end + end + pcall(_EXECUTE) +end +Luartex_VM(...); \ No newline at end of file diff --git a/frontend/src/components/NavBarItem.tsx b/frontend/src/components/NavBarItem.tsx index 72935e6..4ced3eb 100644 --- a/frontend/src/components/NavBarItem.tsx +++ b/frontend/src/components/NavBarItem.tsx @@ -1,6 +1,5 @@ -import React, {useEffect, useRef} from 'react' +import React, {useEffect, useRef, useState} from 'react' import Link from 'next/link' -import { useState } from 'react' import { mdiChevronUp, mdiChevronDown } from '@mdi/js' import BaseDivider from './BaseDivider' import BaseIcon from './BaseIcon' @@ -129,4 +128,4 @@ export default function NavBarItem({ item }: Props) { } return
- {`${widgetsRole?.role?.label || 'Users'}'s widgets`} -
- )} - -This is a React.js/Node.js app generated by the Flatlogic Web App Generator
-For guides and documentation please check - your local README.md and the Flatlogic documentation
-+ Heavyweight Luau Virtual Machine protection. + Transform your scripts into unreadable, irreversible bytecode. +
© 2026 {title}. All rights reserved
- - Privacy Policy - + +