js-confuser 1.5.9 → 1.7.0

package/src/options.ts

@@ -10,9 +10,9 @@ export interface ObfuscateOptions {
    *
    * | Preset | Transforms | Performance Reduction | Sample |
    * | --- | --- | --- | --- |
-   * | High | 21/22 | 98% | [Sample](https://github.com/MichaelXF/js-confuser/blob/master/samples/high.js) |
-   * | Medium | 15/22 | 52% | [Sample](https://github.com/MichaelXF/js-confuser/blob/master/samples/medium.js) |
-   * | Low | 10/22 | 30% | [Sample](https://github.com/MichaelXF/js-confuser/blob/master/samples/low.js) |
+   * | High | 22/25 | 98% | [Sample](https://github.com/MichaelXF/js-confuser/blob/master/samples/high.js) |
+   * | Medium | 19/25 | 52% | [Sample](https://github.com/MichaelXF/js-confuser/blob/master/samples/medium.js) |
+   * | Low | 15/25 | 30% | [Sample](https://github.com/MichaelXF/js-confuser/blob/master/samples/low.js) |
    *
    * You can extend each preset or all go without them entirely. (`"high"/"medium"/"low"`)
    *
@@ -53,7 +53,7 @@ export interface ObfuscateOptions {
   /**
    * ### `hexadecimalNumbers`
    *
-   * Uses the hexadecimal representation (`50` -> `0x32`) for numbers. (`true/false`)
+   * Uses the hexadecimal representation for numbers. (`true/false`)
    */
   hexadecimalNumbers?: boolean;
 
@@ -141,37 +141,6 @@ export interface ObfuscateOptions {
     "hexadecimal" | "randomized" | "zeroWidth" | "mangled" | "number"
   >;
 
-  /**
-   * ### `nameRecycling`
-   *
-   * Attempts to reuse released names.
-   *
-   * - Potency Medium
-   * - Resilience High
-   * - Cost Low
-   *
-   * ```js
-   * // Input
-   * function percentage(x) {
-   *   var multiplied = x * 100;
-   *   var floored = Math.floor(multiplied);
-   *   var output = floored + "%"
-   *   return output;
-   * }
-   *
-   * // Output
-   * function percentage(x) {
-   *   var multiplied = x * 100;
-   *   var floored = Math.floor(multiplied);
-   *   multiplied = floored + "%";
-   *   return multiplied;
-   * }
-   * ```
-   *
-   * [See all settings here](https://github.com/MichaelXF/js-confuser/blob/master/README.md#options)
-   */
-  nameRecycling?: ProbabilityMap<boolean>;
-
   /**
    * ### `controlFlowFlattening`
    *
@@ -189,19 +158,6 @@ export interface ObfuscateOptions {
    */
   controlFlowFlattening?: ProbabilityMap<boolean>;
 
-  /**
-   * ### `hideInitializingCode`
-   *
-   * Hides initializing code with complex ternary expressions. (`true/false`)
-   *
-   * - Potency High
-   * - Resilience High
-   * - Cost High
-   *
-   * [See all settings here](https://github.com/MichaelXF/js-confuser/blob/master/README.md#options)
-   */
-  hideInitializingCode?: ProbabilityMap<boolean>;
-
   /**
    * ### `globalConcealing`
    *
@@ -297,48 +253,15 @@ export interface ObfuscateOptions {
    */
   dispatcher?: ProbabilityMap<boolean>;
 
-  /**
-   * ### `eval`
-   *
-   * #### **`Security Warning`**
-   *
-   * From [MDN](<(https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval)**>): Executing JavaScript from a string is an enormous security risk. It is far too easy
-   * for a bad actor to run arbitrary code when you use eval(). Never use eval()!
-   *
-   * Wraps defined functions within eval statements.
-   *
-   * - **`false`** - Avoids using the `eval` function. _Default_.
-   * - **`true`** - Wraps function's code into an `eval` statement.
-   *
-   * ```js
-   * // Output.js
-   * var Q4r1__ = {
-   *   Oo$Oz8t: eval(
-   *     "(function(YjVpAp){var gniSBq6=kHmsJrhOO;switch(gniSBq6){case'RW11Hj5x':return console;}});"
-   *   ),
-   * };
-   * Q4r1__.Oo$Oz8t("RW11Hj5x");
-   * ```
-   *
-   * [See all settings here](https://github.com/MichaelXF/js-confuser/blob/master/README.md#options)
-   */
-  eval?: ProbabilityMap<boolean>;
-
   /**
    * ### `rgf`
    *
    * RGF (Runtime-Generated-Functions) uses the [`new Function(code...)`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/Function) syntax to construct executable code from strings. (`"all"/true/false`)
    *
-   * - **This can break your code. This is also as dangerous as `eval`.**
+   * - **This can break your code.
    * - **Due to the security concerns of arbitrary code execution, you must enable this yourself.**
    * - The arbitrary code is also obfuscated.
    *
-   * | Mode | Description |
-   * | --- | --- |
-   * | `"all"` | Recursively applies to every scope (slow) |
-   * | `true` | Applies to the top level only |
-   * | `false` | Feature disabled |
-   *
    * ```js
    * // Input
    * function log(x){
@@ -353,7 +276,7 @@ export interface ObfuscateOptions {
    *
    * [See all settings here](https://github.com/MichaelXF/js-confuser/blob/master/README.md#options)
    */
-  rgf?: ProbabilityMap<boolean | "all">;
+  rgf?: ProbabilityMap<boolean>;
 
   /**
    * ### `stack`
@@ -483,20 +406,6 @@ export interface ObfuscateOptions {
      */
     context?: string[];
 
-    /**
-     * ### `lock.nativeFunctions`
-     *
-     * Set of global functions that are native. Such as `require`, `fetch`. If these variables are modified the program crashes.
-     * Set to `true` to use the default set of native functions. (`string[]/true/false`)
-     *
-     * - Potency Low
-     * - Resilience Medium
-     * - Cost Medium
-     *
-     * [See all settings here](https://github.com/MichaelXF/js-confuser/blob/master/README.md#options)
-     */
-    nativeFunctions?: string[] | Set<string> | boolean;
-
     /**
      * ### `lock.startDate`
      *
@@ -689,9 +598,7 @@ const validProperties = new Set([
   "renameVariables",
   "renameGlobals",
   "identifierGenerator",
-  "nameRecycling",
   "controlFlowFlattening",
-  "hideInitializingCode",
   "globalConcealing",
   "stringCompression",
   "stringConcealing",
@@ -699,7 +606,6 @@ const validProperties = new Set([
   "stringSplitting",
   "duplicateLiteralsRemoval",
   "dispatcher",
-  "eval",
   "rgf",
   "objectExtraction",
   "flatten",
@@ -726,7 +632,7 @@ const validBrowsers = new Set([
 ]);
 
 export function validateOptions(options: ObfuscateOptions) {
-  if (Object.keys(options).length <= 1) {
+  if (!options || Object.keys(options).length <= 1) {
     /**
      * Give a welcoming introduction to those who skipped the documentation.
      */
@@ -880,6 +786,10 @@ export async function correctOptions(
         "alert",
         "confirm",
         "location",
+        "btoa",
+        "atob",
+        "unescape",
+        "encodeURIComponent",
       ].forEach((x) => options.globalVariables.add(x));
     } else {
       // node
@@ -888,6 +798,8 @@ export async function correctOptions(
         "Buffer",
         "require",
         "process",
+        "exports",
+        "module",
         "__dirname",
         "__filename",
       ].forEach((x) => options.globalVariables.add(x));
@@ -899,6 +811,7 @@ export async function correctOptions(
       "parseInt",
       "parseFloat",
       "Math",
+      "JSON",
       "Promise",
       "String",
       "Boolean",
@@ -918,8 +831,6 @@ export async function correctOptions(
       "setImmediate",
       "clearImmediate",
       "queueMicrotask",
-      "exports",
-      "module",
       "isNaN",
       "isFinite",
       "Set",

package/src/order.ts

@@ -32,8 +32,6 @@ export enum ObfuscateOrder {
 
   StringCompression = 18,
 
-  HideInitializingCode = 19,
-
   Stack = 20,
 
   DuplicateLiteralsRemoval = 22,
@@ -52,9 +50,7 @@ export enum ObfuscateOrder {
 
   ES5 = 31,
 
-  StringEncoding = 32,
-
   AntiTooling = 34,
 
-  HexadecimalNumbers = 35,
+  Finalizer = 35,
 }

package/src/presets.ts

@@ -17,7 +17,7 @@ import { ObfuscateOptions } from "./options";
  * 10. Minified output
  *
  * ## **`Disabled features`**
- * - `eval` Use at your own risk!
+ * - `rgf` Use at your own risk!
  *
  * ### Potential Issues
  * 1. *String Encoding* can corrupt files. Disable `stringEncoding` manually if this happens.
@@ -51,7 +51,6 @@ const highPreset: ObfuscateOptions = {
   stringSplitting: 0.75,
 
   // Use at own risk
-  eval: false,
   rgf: false,
 };
 
@@ -66,9 +65,9 @@ const mediumPreset: ObfuscateOptions = {
   calculator: true,
   compact: true,
   hexadecimalNumbers: true,
-  controlFlowFlattening: 0.5,
+  controlFlowFlattening: 0.25,
   deadCode: 0.025,
-  dispatcher: 0.75,
+  dispatcher: 0.5,
   duplicateLiteralsRemoval: 0.5,
   globalConcealing: true,
   identifierGenerator: "randomized",
@@ -95,10 +94,10 @@ const lowPreset: ObfuscateOptions = {
   calculator: true,
   compact: true,
   hexadecimalNumbers: true,
-  controlFlowFlattening: 0.25,
+  controlFlowFlattening: 0.1,
   deadCode: 0.01,
-  dispatcher: 0.5,
-  duplicateLiteralsRemoval: true,
+  dispatcher: 0.25,
+  duplicateLiteralsRemoval: 0.5,
   identifierGenerator: "randomized",
   minify: true,
   movedDeclarations: true,

package/src/probability.ts

@@ -87,6 +87,8 @@ export function ComputeProbabilityMap<T>(
  * @param map
  */
 export function isProbabilityMapProbable<T>(map: ProbabilityMap<T>): boolean {
+  ok(!Number.isNaN(map), "Numbers cannot be NaN");
+
   if (!map || typeof map === "undefined") {
     return false;
   }
@@ -97,9 +99,6 @@ export function isProbabilityMapProbable<T>(map: ProbabilityMap<T>): boolean {
     if (map > 1 || map < 0) {
       throw new Error(`Numbers must be between 0 and 1 for 0% - 100%`);
     }
-    if (isNaN(map)) {
-      throw new Error("Numbers cannot be NaN");
-    }
   }
   if (Array.isArray(map)) {
     ok(

package/src/templates/bufferToString.ts

@@ -0,0 +1,68 @@
+import Template from "./template";
+
+export const BufferToStringTemplate = Template(`
+  function __getGlobal(){
+    try {
+      return global||window|| ( new Function("return this") )();
+    } catch ( e ) {
+      try {
+        return this;
+      } catch ( e ) {
+        return {};
+      }
+    }
+  }
+
+  var __globalObject = __getGlobal() || {};
+  var __TextDecoder = __globalObject["TextDecoder"];
+  var __Uint8Array = __globalObject["Uint8Array"];
+  var __Buffer = __globalObject["Buffer"];
+  var __String = __globalObject["String"] || String;
+  var __Array = __globalObject["Array"] || Array;
+
+  var utf8ArrayToStr = (function () {
+    var charCache = new __Array(128);  // Preallocate the cache for the common single byte chars
+    var charFromCodePt = __String["fromCodePoint"] || __String["fromCharCode"];
+    var result = [];
+
+    return function (array) {
+        var codePt, byte1;
+        var buffLen = array["length"];
+
+        result["length"] = 0;
+
+        for (var i = 0; i < buffLen;) {
+            byte1 = array[i++];
+
+            if (byte1 <= 0x7F) {
+                codePt = byte1;
+            } else if (byte1 <= 0xDF) {
+                codePt = ((byte1 & 0x1F) << 6) | (array[i++] & 0x3F);
+            } else if (byte1 <= 0xEF) {
+                codePt = ((byte1 & 0x0F) << 12) | ((array[i++] & 0x3F) << 6) | (array[i++] & 0x3F);
+            } else if (__String["fromCodePoint"]) {
+                codePt = ((byte1 & 0x07) << 18) | ((array[i++] & 0x3F) << 12) | ((array[i++] & 0x3F) << 6) | (array[i++] & 0x3F);
+            } else {
+                codePt = 63;    // Cannot convert four byte code points, so use "?" instead
+                i += 3;
+            }
+
+            result["push"](charCache[codePt] || (charCache[codePt] = charFromCodePt(codePt)));
+        }
+
+        return result["join"]('');
+    };
+  })();
+
+  function {name}(buffer){
+    if(typeof __TextDecoder !== "undefined" && __TextDecoder) {
+      return new __TextDecoder()["decode"](new __Uint8Array(buffer));
+    } else if(typeof __Buffer !== "undefined" && __Buffer) {
+      return __Buffer["from"](buffer)["toString"]("utf-8");
+    } else {          
+      return utf8ArrayToStr(buffer);
+    }
+  }
+
+  
+`);

package/src/templates/crash.ts

@@ -1,28 +1,24 @@
 import Template from "./template";
 
 export const CrashTemplate1 = Template(`
-try {
-    if(typeof process !== "undefined") {
-        Math.random() > 0.5 && process && process.exit();
-    }
-} catch ( e ) {
-    
-}
-
 var {var} = "a";
 while(1){
-    {var} = {var} += "a";    //add as much as the browser can handle
+    {var} = {var} += "a";
 }
 `);
 
 export const CrashTemplate2 = Template(`
 while(true) {
-    for(var {var} = 99; {var} == {var}; {var} *= {var}) {
+    var {var} = 99;
+    for({var} = 99; {var} == {var}; {var} *= {var}) {
         !{var} && console.log({var});
         if ({var} <= 10){
             break;
         }
     };
+    if({var} === 100) {
+        {var}--
+    }
  };`);
 
 export const CrashTemplate3 = Template(`
@@ -44,16 +40,16 @@ try {
       });
       
       {$1}();
-} catch ( e ) {
-    while(e ? e : !e){
-        var b;
-        var c = 0;
-        (e ? !e : e) ? (function(e){
-            c = e ? 0 : !e ? 1 : 0;
-        })(e) : b = 1;
+} catch ( {$1}e ) {
+    while({$1}e ? {$1}e : !{$1}e){
+        var {$1}b;
+        var {$1}c = 0;
+        ({$1}e ? !{$1}e : {$1}e) ? (function({$1}e){
+            {$1}c = {$1}e ? 0 : !{$1}e ? 1 : 0;
+        })({$1}e) : {$1}b = 1;
 
-        if(b&&c){break;}
-        if(b){continue;}
+        if({$1}b&&{$1}c){break;}
+        if({$1}b){continue;}
     }
 }
 `);

package/src/templates/es5.ts

@@ -0,0 +1,131 @@
+import Template from "./template";
+
+/**
+ * Provides ES5 polyfills for Array methods
+ *
+ * Source: https://vanillajstoolkit.com/polyfills/
+ */
+export const ES5Template = Template(`
+if (!Array.prototype.forEach) {
+  Array.prototype.forEach = function forEach (callback, thisArg) {
+    if (typeof callback !== 'function') {
+      throw new TypeError(callback + ' is not a function');
+    }
+    var array = this;
+    thisArg = thisArg || this;
+    for (var i = 0, l = array.length; i !== l; ++i) {
+      callback.call(thisArg, array[i], i, array);
+    }
+  };
+}
+if (!Array.prototype.filter)
+  Array.prototype.filter = function(func, thisArg) {
+	'use strict';
+	if ( ! ((typeof func === 'Function' || typeof func === 'function') && this) )
+		throw new TypeError();
+
+	var len = this.length >>> 0,
+		res = new Array(len), // preallocate array
+		t = this, c = 0, i = -1;
+	if (thisArg === undefined)
+	  while (++i !== len)
+		// checks to see if the key was set
+		if (i in this)
+		  if (func(t[i], i, t))
+			res[c++] = t[i];
+	else
+	  while (++i !== len)
+		// checks to see if the key was set
+		if (i in this)
+		  if (func.call(thisArg, t[i], i, t))
+			res[c++] = t[i];
+
+	res.length = c; // shrink down array to proper size
+	return res;
+};
+if (!Array.prototype.map) {
+  Array.prototype.map = function(callback, thisArg) {
+    var T, A, k;
+
+    if (this == null) {
+      throw new TypeError('this is null or not defined');
+    }
+
+    // 1. Let O be the result of calling ToObject passing the |this|
+    //    value as the argument.
+    var O = Object(this);
+
+    // 2. Let lenValue be the result of calling the Get internal
+    //    method of O with the argument "length".
+    // 3. Let len be ToUint32(lenValue).
+    var len = O.length >>> 0;
+
+    // 4. If IsCallable(callback) is false, throw a TypeError exception.
+    // See: http://es5.github.com/#x9.11
+    if (typeof callback !== 'function') {
+      throw new TypeError(callback + ' is not a function');
+    }
+
+    // 5. If thisArg was supplied, let T be thisArg; else let T be undefined.
+    if (arguments.length > 1) {
+      T = arguments[1];
+    }
+
+    // 6. Let A be a new array created as if by the expression new Array(len)
+    //    where Array is the standard built-in constructor with that name and
+    //    len is the value of len.
+    A = new Array(len);
+
+    // 7. Let k be 0
+    k = 0;
+
+    // 8. Repeat, while k < len
+    while (k < len) {
+
+      var kValue, mappedValue;
+
+      // a. Let Pk be ToString(k).
+      //   This is implicit for LHS operands of the in operator
+      // b. Let kPresent be the result of calling the HasProperty internal
+      //    method of O with argument Pk.
+      //   This step can be combined with c
+      // c. If kPresent is true, then
+      if (k in O) {
+
+        // i. Let kValue be the result of calling the Get internal
+        //    method of O with argument Pk.
+        kValue = O[k];
+
+        // ii. Let mappedValue be the result of calling the Call internal
+        //     method of callback with T as the this value and argument
+        //     list containing kValue, k, and O.
+        mappedValue = callback.call(T, kValue, k, O);
+
+        // iii. Call the DefineOwnProperty internal method of A with arguments
+        // Pk, Property Descriptor
+        // { Value: mappedValue,
+        //   Writable: true,
+        //   Enumerable: true,
+        //   Configurable: true },
+        // and false.
+
+        // In browsers that support Object.defineProperty, use the following:
+        // Object.defineProperty(A, k, {
+        //   value: mappedValue,
+        //   writable: true,
+        //   enumerable: true,
+        //   configurable: true
+        // });
+
+        // For best browser support, use the following:
+        A[k] = mappedValue;
+      }
+      // d. Increase k by 1.
+      k++;
+    }
+
+    // 9. return A
+    return A;
+  };
+}
+`);

package/src/templates/functionLength.ts

@@ -0,0 +1,14 @@
+import Template from "./template";
+
+/**
+ * Helper function to set `function.length` property.
+ */
+export const FunctionLengthTemplate = Template(`
+function {name}(functionObject, functionLength){
+  Object["defineProperty"](functionObject, "length", {
+    "value": functionLength,
+    "configurable": true
+  });
+  return functionObject;
+}
+`);