js-confuser 1.5.9 → 1.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.github/workflows/node.js.yml +2 -2
- package/CHANGELOG.md +55 -0
- package/README.md +346 -165
- package/dist/constants.js +6 -2
- package/dist/index.js +9 -21
- package/dist/obfuscator.js +19 -31
- package/dist/options.js +5 -5
- package/dist/order.js +1 -3
- package/dist/presets.js +6 -7
- package/dist/probability.js +2 -4
- package/dist/templates/bufferToString.js +13 -0
- package/dist/templates/crash.js +3 -3
- package/dist/templates/es5.js +18 -0
- package/dist/templates/functionLength.js +16 -0
- package/dist/transforms/calculator.js +77 -21
- package/dist/transforms/controlFlowFlattening/controlFlowFlattening.js +980 -367
- package/dist/transforms/controlFlowFlattening/expressionObfuscation.js +4 -1
- package/dist/transforms/controlFlowFlattening/switchCaseObfuscation.js +25 -26
- package/dist/transforms/deadCode.js +33 -25
- package/dist/transforms/dispatcher.js +8 -4
- package/dist/transforms/es5/antiDestructuring.js +2 -0
- package/dist/transforms/es5/es5.js +31 -34
- package/dist/transforms/extraction/duplicateLiteralsRemoval.js +92 -58
- package/dist/transforms/finalizer.js +82 -0
- package/dist/transforms/flatten.js +229 -148
- package/dist/transforms/identifier/globalAnalysis.js +88 -0
- package/dist/transforms/identifier/globalConcealing.js +10 -83
- package/dist/transforms/identifier/movedDeclarations.js +35 -88
- package/dist/transforms/identifier/renameVariables.js +124 -59
- package/dist/transforms/identifier/variableAnalysis.js +58 -62
- package/dist/transforms/lock/lock.js +0 -37
- package/dist/transforms/minify.js +60 -57
- package/dist/transforms/opaquePredicates.js +1 -1
- package/dist/transforms/preparation/preparation.js +2 -2
- package/dist/transforms/preparation.js +231 -0
- package/dist/transforms/renameLabels.js +1 -1
- package/dist/transforms/rgf.js +139 -247
- package/dist/transforms/stack.js +128 -26
- package/dist/transforms/string/encoding.js +150 -179
- package/dist/transforms/string/stringCompression.js +14 -15
- package/dist/transforms/string/stringConcealing.js +25 -8
- package/dist/transforms/string/stringEncoding.js +13 -24
- package/dist/transforms/transform.js +12 -19
- package/dist/traverse.js +24 -10
- package/dist/util/gen.js +17 -1
- package/dist/util/identifiers.js +37 -3
- package/dist/util/insert.js +35 -4
- package/dist/util/random.js +15 -0
- package/docs/ControlFlowFlattening.md +595 -0
- package/{Countermeasures.md → docs/Countermeasures.md} +1 -15
- package/{Integrity.md → docs/Integrity.md} +2 -2
- package/docs/RGF.md +419 -0
- package/package.json +5 -5
- package/src/constants.ts +3 -0
- package/src/index.ts +2 -2
- package/src/obfuscator.ts +19 -31
- package/src/options.ts +14 -103
- package/src/order.ts +1 -5
- package/src/presets.ts +6 -7
- package/src/probability.ts +2 -3
- package/src/templates/bufferToString.ts +68 -0
- package/src/templates/crash.ts +15 -19
- package/src/templates/es5.ts +131 -0
- package/src/templates/functionLength.ts +14 -0
- package/src/transforms/calculator.ts +122 -59
- package/src/transforms/controlFlowFlattening/controlFlowFlattening.ts +1583 -571
- package/src/transforms/controlFlowFlattening/expressionObfuscation.ts +4 -1
- package/src/transforms/deadCode.ts +383 -26
- package/src/transforms/dispatcher.ts +9 -4
- package/src/transforms/es5/antiDestructuring.ts +2 -0
- package/src/transforms/es5/es5.ts +32 -77
- package/src/transforms/extraction/duplicateLiteralsRemoval.ts +133 -129
- package/src/transforms/{hexadecimalNumbers.ts → finalizer.ts} +29 -13
- package/src/transforms/flatten.ts +357 -300
- package/src/transforms/identifier/globalAnalysis.ts +85 -0
- package/src/transforms/identifier/globalConcealing.ts +14 -103
- package/src/transforms/identifier/movedDeclarations.ts +49 -102
- package/src/transforms/identifier/renameVariables.ts +149 -78
- package/src/transforms/identifier/variableAnalysis.ts +66 -73
- package/src/transforms/lock/lock.ts +1 -42
- package/src/transforms/minify.ts +91 -75
- package/src/transforms/opaquePredicates.ts +2 -2
- package/src/transforms/preparation.ts +238 -0
- package/src/transforms/renameLabels.ts +2 -2
- package/src/transforms/rgf.ts +213 -405
- package/src/transforms/stack.ts +156 -36
- package/src/transforms/string/encoding.ts +115 -212
- package/src/transforms/string/stringCompression.ts +27 -18
- package/src/transforms/string/stringConcealing.ts +39 -9
- package/src/transforms/string/stringEncoding.ts +18 -18
- package/src/transforms/transform.ts +21 -23
- package/src/traverse.ts +23 -4
- package/src/types.ts +2 -1
- package/src/util/gen.ts +28 -3
- package/src/util/identifiers.ts +43 -2
- package/src/util/insert.ts +38 -3
- package/src/util/random.ts +13 -0
- package/test/code/Cash.test.ts +1 -1
- package/test/code/Dynamic.test.ts +12 -10
- package/test/code/ES6.src.js +146 -0
- package/test/code/ES6.test.ts +28 -2
- package/test/index.test.ts +2 -1
- package/test/probability.test.ts +44 -0
- package/test/templates/template.test.ts +1 -1
- package/test/transforms/antiTooling.test.ts +22 -0
- package/test/transforms/calculator.test.ts +40 -0
- package/test/transforms/controlFlowFlattening/controlFlowFlattening.test.ts +702 -160
- package/test/transforms/controlFlowFlattening/expressionObfuscation.test.ts +173 -0
- package/test/transforms/deadCode.test.ts +66 -15
- package/test/transforms/dispatcher.test.ts +20 -1
- package/test/transforms/es5/antiDestructuring.test.ts +16 -0
- package/test/transforms/flatten.test.ts +399 -86
- package/test/transforms/identifier/movedDeclarations.test.ts +63 -8
- package/test/transforms/identifier/renameVariables.test.ts +119 -0
- package/test/transforms/lock/antiDebug.test.ts +2 -2
- package/test/transforms/lock/lock.test.ts +1 -48
- package/test/transforms/minify.test.ts +104 -0
- package/test/transforms/preparation.test.ts +157 -0
- package/test/transforms/rgf.test.ts +261 -381
- package/test/transforms/stack.test.ts +143 -21
- package/test/transforms/string/stringCompression.test.ts +39 -0
- package/test/transforms/string/stringConcealing.test.ts +82 -0
- package/test/transforms/string/stringEncoding.test.ts +53 -2
- package/test/transforms/transform.test.ts +66 -0
- package/test/traverse.test.ts +139 -0
- package/test/util/identifiers.test.ts +113 -1
- package/test/util/insert.test.ts +57 -3
- package/src/transforms/controlFlowFlattening/choiceFlowObfuscation.ts +0 -87
- package/src/transforms/controlFlowFlattening/controlFlowObfuscation.ts +0 -203
- package/src/transforms/controlFlowFlattening/switchCaseObfuscation.ts +0 -130
- package/src/transforms/eval.ts +0 -89
- package/src/transforms/hideInitializingCode.ts +0 -432
- package/src/transforms/identifier/nameRecycling.ts +0 -280
- package/src/transforms/label.ts +0 -64
- package/src/transforms/preparation/nameConflicts.ts +0 -102
- package/src/transforms/preparation/preparation.ts +0 -176
- package/test/transforms/controlFlowFlattening/controlFlowObfuscation.test.ts +0 -101
- package/test/transforms/controlFlowFlattening/switchCaseObfuscation.test.ts +0 -120
- package/test/transforms/eval.test.ts +0 -131
- package/test/transforms/hideInitializingCode.test.ts +0 -336
- package/test/transforms/identifier/nameRecycling.test.ts +0 -205
- package/test/transforms/preparation/nameConflicts.test.ts +0 -52
- package/test/transforms/preparation/preparation.test.ts +0 -62
package/README.md
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
# JS Confuser
|
|
2
2
|
|
|
3
|
-
JS-Confuser is a JavaScript obfuscation tool to make your programs _impossible_ to read. [Try the web version](https://
|
|
3
|
+
JS-Confuser is a JavaScript obfuscation tool to make your programs _impossible_ to read. [Try the web version](https://js-confuser.com).
|
|
4
4
|
|
|
5
|
-
[](https://npmjs.com/package/js-confuser) [](https://github.com/MichaelXF/js-confuser) [](https://
|
|
5
|
+
[](https://npmjs.com/package/js-confuser) [](https://github.com/MichaelXF/js-confuser) [](https://js-confuser.com)
|
|
6
6
|
|
|
7
7
|
## Key features
|
|
8
8
|
|
|
@@ -11,7 +11,7 @@ JS-Confuser is a JavaScript obfuscation tool to make your programs _impossible_
|
|
|
11
11
|
- String concealing
|
|
12
12
|
- Function obfuscation
|
|
13
13
|
- Locks (domainLock, date)
|
|
14
|
-
- [Detect changes to source code](https://github.com/MichaelXF/js-confuser/blob/master/Integrity.md)
|
|
14
|
+
- [Detect changes to source code](https://github.com/MichaelXF/js-confuser/blob/master/docs/Integrity.md)
|
|
15
15
|
|
|
16
16
|
## Presets
|
|
17
17
|
|
|
@@ -19,9 +19,9 @@ JS-Confuser comes with three presets built into the obfuscator.
|
|
|
19
19
|
|
|
20
20
|
| Preset | Transforms | Performance Reduction | Sample |
|
|
21
21
|
| --- | --- | --- | --- |
|
|
22
|
-
| High |
|
|
23
|
-
| Medium |
|
|
24
|
-
| Low |
|
|
22
|
+
| High | 22/25 | 98% | [Sample](https://github.com/MichaelXF/js-confuser/blob/master/samples/high.js) |
|
|
23
|
+
| Medium | 19/25 | 52% | [Sample](https://github.com/MichaelXF/js-confuser/blob/master/samples/medium.js) |
|
|
24
|
+
| Low | 15/25 | 30% | [Sample](https://github.com/MichaelXF/js-confuser/blob/master/samples/low.js) |
|
|
25
25
|
|
|
26
26
|
You can extend each preset or all go without them entirely.
|
|
27
27
|
|
|
@@ -109,7 +109,7 @@ JsConfuser.obfuscate(`<source code>`, {
|
|
|
109
109
|
target: "node",
|
|
110
110
|
preset: "high" // | "medium" | "low"
|
|
111
111
|
}).then(obfuscated=>{
|
|
112
|
-
console.log(obfuscated) // obfuscated is a string
|
|
112
|
+
console.log(obfuscated); // obfuscated is a string
|
|
113
113
|
})
|
|
114
114
|
```
|
|
115
115
|
|
|
@@ -119,7 +119,7 @@ Remove's whitespace from the final output. Enabled by default. (`true/false`)
|
|
|
119
119
|
|
|
120
120
|
### `hexadecimalNumbers`
|
|
121
121
|
|
|
122
|
-
Uses the hexadecimal representation
|
|
122
|
+
Uses the hexadecimal representation for numbers. (`true/false`)
|
|
123
123
|
|
|
124
124
|
### `minify`
|
|
125
125
|
|
|
@@ -135,14 +135,79 @@ Does not cover all cases such as Promises or Generator functions. Use [Babel](ht
|
|
|
135
135
|
|
|
136
136
|
Determines if variables should be renamed. (`true/false`)
|
|
137
137
|
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
138
|
+
```js
|
|
139
|
+
// Input
|
|
140
|
+
var twoSum = function (nums, target) {
|
|
141
|
+
var hash = {};
|
|
142
|
+
var len = nums.length;
|
|
143
|
+
for (var i = 0; i < len; i++) {
|
|
144
|
+
if (nums[i] in hash) return [hash[nums[i]], i];
|
|
145
|
+
hash[target - nums[i]] = i;
|
|
146
|
+
}
|
|
147
|
+
return [-1, -1];
|
|
148
|
+
};
|
|
149
|
+
|
|
150
|
+
var test = function () {
|
|
151
|
+
var inputNums = [2, 7, 11, 15];
|
|
152
|
+
var inputTarget = 9;
|
|
153
|
+
var expectedResult = [0, 1];
|
|
154
|
+
|
|
155
|
+
var actualResult = twoSum(inputNums, inputTarget);
|
|
156
|
+
ok(actualResult[0] === expectedResult[0]);
|
|
157
|
+
ok(actualResult[1] === expectedResult[1]);
|
|
158
|
+
};
|
|
159
|
+
|
|
160
|
+
test();
|
|
161
|
+
|
|
162
|
+
// Output
|
|
163
|
+
var _O2mOcF = function (kB4uXM, w_07HXS) {
|
|
164
|
+
var ZLTJcx = {};
|
|
165
|
+
var sXQOaUx = kB4uXM["length"];
|
|
166
|
+
for (var JYYxEk = 0; JYYxEk < sXQOaUx; JYYxEk++) {
|
|
167
|
+
if (kB4uXM[JYYxEk] in ZLTJcx) {
|
|
168
|
+
return [ZLTJcx[kB4uXM[JYYxEk]], JYYxEk];
|
|
169
|
+
}
|
|
170
|
+
ZLTJcx[w_07HXS - kB4uXM[JYYxEk]] = JYYxEk;
|
|
171
|
+
}
|
|
172
|
+
return [-1, -1];
|
|
173
|
+
};
|
|
174
|
+
var qFaI6S = function () {
|
|
175
|
+
var fZpeOw = [2, 7, 11, 15];
|
|
176
|
+
var UJ62R2c = 9;
|
|
177
|
+
var dG6R0cV = [0, 1];
|
|
178
|
+
var WgYXwn = _O2mOcF(fZpeOw, UJ62R2c);
|
|
179
|
+
void (ok(WgYXwn[0] === dG6R0cV[0]), ok(WgYXwn[1] === dG6R0cV[1]));
|
|
180
|
+
};
|
|
181
|
+
qFaI6S();
|
|
182
|
+
```
|
|
141
183
|
|
|
142
184
|
### `renameGlobals`
|
|
143
185
|
|
|
144
186
|
Renames top-level variables, turn this off for web-related scripts. Enabled by default. (`true/false`)
|
|
145
187
|
|
|
188
|
+
```js
|
|
189
|
+
// Output (Same input from above)
|
|
190
|
+
var twoSum = function (Oc4nmjB, Fk3nptX) {
|
|
191
|
+
var on_KnCm = {};
|
|
192
|
+
var lqAauc = Oc4nmjB["length"];
|
|
193
|
+
for (var mALijp8 = 0; mALijp8 < lqAauc; mALijp8++) {
|
|
194
|
+
if (Oc4nmjB[mALijp8] in on_KnCm) {
|
|
195
|
+
return [on_KnCm[Oc4nmjB[mALijp8]], mALijp8];
|
|
196
|
+
}
|
|
197
|
+
on_KnCm[Fk3nptX - Oc4nmjB[mALijp8]] = mALijp8;
|
|
198
|
+
}
|
|
199
|
+
return [-1, -1];
|
|
200
|
+
};
|
|
201
|
+
var test = function () {
|
|
202
|
+
var y5ySeZ = [2, 7, 11, 15];
|
|
203
|
+
var gHYMOm = 9;
|
|
204
|
+
var aAdj3v = [0, 1];
|
|
205
|
+
var GnLVHX = twoSum(y5ySeZ, gHYMOm);
|
|
206
|
+
!(ok(GnLVHX[0] === aAdj3v[0]), ok(GnLVHX[1] === aAdj3v[1]));
|
|
207
|
+
};
|
|
208
|
+
test();
|
|
209
|
+
```
|
|
210
|
+
|
|
146
211
|
### `identifierGenerator`
|
|
147
212
|
|
|
148
213
|
Determines how variables are renamed.
|
|
@@ -179,169 +244,325 @@ JsConfuser.obfuscate(code, {
|
|
|
179
244
|
|
|
180
245
|
JSConfuser tries to reuse names when possible, creating very potent code.
|
|
181
246
|
|
|
182
|
-
### `
|
|
247
|
+
### `controlFlowFlattening`
|
|
248
|
+
|
|
249
|
+
**⚠️ Significantly impacts performance, use sparingly!**
|
|
183
250
|
|
|
184
|
-
|
|
251
|
+
Control-flow Flattening hinders program comprehension by creating convoluted switch statements. (`true/false/0-1`)
|
|
185
252
|
|
|
186
|
-
|
|
253
|
+
Use a number to control the percentage from 0 to 1.
|
|
187
254
|
|
|
188
|
-
|
|
189
|
-
- Resilience High
|
|
190
|
-
- Cost Low
|
|
255
|
+
[Learn more here.](https://github.com/MichaelXF/js-confuser/blob/master/docs/ControlFlowFlattening.md)
|
|
191
256
|
|
|
192
257
|
```js
|
|
193
258
|
// Input
|
|
194
|
-
function
|
|
195
|
-
var
|
|
196
|
-
|
|
197
|
-
|
|
198
|
-
return output;
|
|
259
|
+
function countTo(num){
|
|
260
|
+
for ( var i = 1; i <= num; i++ ) {
|
|
261
|
+
console.log(i);
|
|
262
|
+
}
|
|
199
263
|
}
|
|
200
264
|
|
|
265
|
+
var number = 10;
|
|
266
|
+
countTo(number); // 1,2,3,4,5,6,7,8,9,10
|
|
267
|
+
|
|
201
268
|
// Output
|
|
202
|
-
|
|
203
|
-
|
|
204
|
-
|
|
205
|
-
|
|
206
|
-
|
|
269
|
+
var n2DUka,
|
|
270
|
+
O7yZ0oU,
|
|
271
|
+
mJMdMhJ = -337,
|
|
272
|
+
A1Nyvv = -94,
|
|
273
|
+
xDwpOk6 = 495,
|
|
274
|
+
uKcJl2 = {
|
|
275
|
+
TGCpW6t: "log",
|
|
276
|
+
qUrjFe: function () {
|
|
277
|
+
return xDwpOk6 == (126 > mJMdMhJ ? -16 : 34);
|
|
278
|
+
},
|
|
279
|
+
YN20IBx: function () {
|
|
280
|
+
return (A1Nyvv -= 53);
|
|
281
|
+
},
|
|
282
|
+
CTW4vwx: -73,
|
|
283
|
+
PLzWYDx: function () {
|
|
284
|
+
return (O7yZ0oU = [[385, -94, -282], [10]]);
|
|
285
|
+
},
|
|
286
|
+
bW2FK2: function () {
|
|
287
|
+
return (mJMdMhJ *= 2), (mJMdMhJ += 366);
|
|
288
|
+
},
|
|
289
|
+
AfOoRT: function () {
|
|
290
|
+
return xDwpOk6 == xDwpOk6 + 867;
|
|
291
|
+
},
|
|
292
|
+
KTNMdj: function () {
|
|
293
|
+
if (uKcJl2.AfOoRT()) {
|
|
294
|
+
typeof ((mJMdMhJ += 0), uKcJl2.Q0I6e4f(), (xDwpOk6 += 0));
|
|
295
|
+
return "cobTe8G";
|
|
296
|
+
}
|
|
297
|
+
typeof (uKcJl2.htRXYx(),
|
|
298
|
+
(mJMdMhJ += 59),
|
|
299
|
+
(A1Nyvv -= 537),
|
|
300
|
+
(xDwpOk6 += uKcJl2.mLuSzZ < mJMdMhJ ? 449 : -33));
|
|
301
|
+
return "cobTe8G";
|
|
302
|
+
},
|
|
303
|
+
};
|
|
304
|
+
while (mJMdMhJ + A1Nyvv + xDwpOk6 != 83) {
|
|
305
|
+
var yQNDJh = (mJMdMhJ + A1Nyvv + xDwpOk6) * 58 + 54;
|
|
306
|
+
switch (yQNDJh) {
|
|
307
|
+
case 750:
|
|
308
|
+
if (A1Nyvv == 24) {
|
|
309
|
+
uKcJl2.FxREGd6();
|
|
310
|
+
break;
|
|
311
|
+
}
|
|
312
|
+
case 1214:
|
|
313
|
+
if (uKcJl2.qUrjFe()) {
|
|
314
|
+
typeof ((mJMdMhJ *= -8 > xDwpOk6 ? -109 : 2),
|
|
315
|
+
(mJMdMhJ += 1168),
|
|
316
|
+
(xDwpOk6 += xDwpOk6 - 1290));
|
|
317
|
+
break;
|
|
318
|
+
}
|
|
319
|
+
function _VSsIw() {
|
|
320
|
+
var [yQNDJh, _VSsIw] = O7yZ0oU,
|
|
321
|
+
[L9B14E] = _VSsIw,
|
|
322
|
+
uTyFFb = 322;
|
|
323
|
+
while (uTyFFb != 23) {
|
|
324
|
+
var cBx3ysg = uTyFFb * 48 - 77;
|
|
325
|
+
switch (cBx3ysg) {
|
|
326
|
+
case 15379:
|
|
327
|
+
var IOoqIZ = 1;
|
|
328
|
+
uTyFFb -= 306;
|
|
329
|
+
break;
|
|
330
|
+
case 691:
|
|
331
|
+
uTyFFb += IOoqIZ <= L9B14E ? 976 : 7;
|
|
332
|
+
break;
|
|
333
|
+
case 47539:
|
|
334
|
+
typeof (console[uKcJl2.TGCpW6t](IOoqIZ), (uTyFFb -= 795));
|
|
335
|
+
break;
|
|
336
|
+
case 9379:
|
|
337
|
+
!(IOoqIZ++, (uTyFFb -= 181));
|
|
338
|
+
}
|
|
339
|
+
}
|
|
340
|
+
return ([mJMdMhJ, A1Nyvv, xDwpOk6] = yQNDJh), (n2DUka = void 0);
|
|
341
|
+
}
|
|
342
|
+
(xDwpOk6 == -73 ? parseInt : _VSsIw)();
|
|
343
|
+
break;
|
|
344
|
+
case 576:
|
|
345
|
+
typeof (mJMdMhJ == -4 ? clearImmediate : void 0,
|
|
346
|
+
uKcJl2.bky8kL(),
|
|
347
|
+
(xDwpOk6 -= 463));
|
|
348
|
+
break;
|
|
349
|
+
case 4172:
|
|
350
|
+
var L9B14E = 10;
|
|
351
|
+
void ((O7yZ0oU = [[385, -94, -282], [10]]),
|
|
352
|
+
(mJMdMhJ -= 187),
|
|
353
|
+
uKcJl2.YN20IBx(),
|
|
354
|
+
(xDwpOk6 += 189));
|
|
355
|
+
break;
|
|
356
|
+
case 3766:
|
|
357
|
+
!((uKcJl2.Fpp8x5 = -167),
|
|
358
|
+
(uKcJl2.mLuSzZ = 144),
|
|
359
|
+
(uKcJl2.FxREGd6 = function () {
|
|
360
|
+
return (mJMdMhJ += uKcJl2.Fpp8x5), (xDwpOk6 += 164);
|
|
361
|
+
}),
|
|
362
|
+
(uKcJl2.bky8kL = function () {
|
|
363
|
+
return (A1Nyvv += 537);
|
|
364
|
+
}),
|
|
365
|
+
(uKcJl2.Q0I6e4f = function () {
|
|
366
|
+
return (A1Nyvv += 0);
|
|
367
|
+
}),
|
|
368
|
+
(uKcJl2.htRXYx = function () {
|
|
369
|
+
return (xDwpOk6 = -82);
|
|
370
|
+
}));
|
|
371
|
+
var L9B14E = 10;
|
|
372
|
+
void (uKcJl2.PLzWYDx(), uKcJl2.bW2FK2(), (xDwpOk6 += uKcJl2.CTW4vwx));
|
|
373
|
+
break;
|
|
374
|
+
default:
|
|
375
|
+
if (uKcJl2.KTNMdj() == "cobTe8G") {
|
|
376
|
+
break;
|
|
377
|
+
}
|
|
378
|
+
}
|
|
207
379
|
}
|
|
208
380
|
```
|
|
209
381
|
|
|
210
|
-
### `controlFlowFlattening`
|
|
211
|
-
|
|
212
|
-
⚠️ Significantly impacts performance, use sparingly!
|
|
213
|
-
|
|
214
|
-
[Control-flow Flattening](https://docs.jscrambler.com/code-integrity/documentation/transformations/control-flow-flattening) hinders program comprehension by creating convoluted switch statements. (`true/false/0-1`)
|
|
215
|
-
|
|
216
|
-
Use a number to control the percentage from 0 to 1.
|
|
217
|
-
|
|
218
|
-
- Potency High
|
|
219
|
-
- Resilience High
|
|
220
|
-
- Cost High
|
|
221
|
-
|
|
222
382
|
### `globalConcealing`
|
|
223
383
|
|
|
224
384
|
Global Concealing hides global variables being accessed. (`true/false`)
|
|
225
385
|
|
|
226
|
-
|
|
227
|
-
|
|
228
|
-
|
|
386
|
+
```js
|
|
387
|
+
// Input
|
|
388
|
+
console.log("Hello World");
|
|
389
|
+
|
|
390
|
+
// Output
|
|
391
|
+
yAt1T_y(-93)["log"]("Hello World");
|
|
392
|
+
```
|
|
229
393
|
|
|
230
394
|
### `stringCompression`
|
|
231
395
|
String Compression uses LZW's compression algorithm to compress strings. (`true/false/0-1`)
|
|
232
396
|
|
|
233
397
|
`"console"` -> `inflate('replaĕ!ğğuģģ<~@')`
|
|
234
|
-
- Potency High
|
|
235
|
-
- Resilience Medium
|
|
236
|
-
- Cost Medium
|
|
237
398
|
|
|
238
399
|
### `stringConcealing`
|
|
239
400
|
|
|
240
|
-
|
|
401
|
+
String Concealing involves encoding strings to conceal plain-text values. (`true/false/0-1`)
|
|
241
402
|
|
|
242
403
|
Use a number to control the percentage of strings.
|
|
243
404
|
|
|
244
405
|
`"console"` -> `decrypt('<~@rH7+Dert~>')`
|
|
245
406
|
|
|
246
|
-
- Potency High
|
|
247
|
-
- Resilience Medium
|
|
248
|
-
- Cost Medium
|
|
249
|
-
|
|
250
407
|
### `stringEncoding`
|
|
251
408
|
|
|
252
|
-
|
|
409
|
+
String Encoding transforms a string into an encoded representation. (`true/false/0-1`)
|
|
253
410
|
|
|
254
411
|
Use a number to control the percentage of strings.
|
|
255
412
|
|
|
256
413
|
`"console"` -> `'\x63\x6f\x6e\x73\x6f\x6c\x65'`
|
|
257
414
|
|
|
258
|
-
- Potency Low
|
|
259
|
-
- Resilience Low
|
|
260
|
-
- Cost Low
|
|
261
|
-
|
|
262
415
|
### `stringSplitting`
|
|
263
416
|
|
|
264
|
-
|
|
417
|
+
String Splitting splits your strings into multiple expressions. (`true/false/0-1`)
|
|
265
418
|
|
|
266
419
|
Use a number to control the percentage of strings.
|
|
267
420
|
|
|
268
421
|
`"console"` -> `String.fromCharCode(99) + 'ons' + 'ole'`
|
|
269
422
|
|
|
270
|
-
- Potency Medium
|
|
271
|
-
- Resilience Medium
|
|
272
|
-
- Cost Medium
|
|
273
|
-
|
|
274
423
|
### `duplicateLiteralsRemoval`
|
|
275
424
|
|
|
276
|
-
|
|
277
|
-
|
|
278
|
-
- Potency Medium
|
|
279
|
-
- Resilience Low
|
|
280
|
-
- Cost High
|
|
425
|
+
Duplicate Literals Removal replaces duplicate literals with a single variable name. (`true/false`)
|
|
281
426
|
|
|
282
427
|
### `dispatcher`
|
|
283
428
|
|
|
284
429
|
Creates a middleman function to process function calls. (`true/false/0-1`)
|
|
285
430
|
|
|
286
|
-
|
|
287
|
-
|
|
288
|
-
|
|
431
|
+
```js
|
|
432
|
+
// Input
|
|
433
|
+
function print(x){
|
|
434
|
+
console.log(x);
|
|
435
|
+
}
|
|
436
|
+
|
|
437
|
+
print("Hello World"); // "Hello World"
|
|
438
|
+
|
|
439
|
+
// Output
|
|
440
|
+
var RfN5Yz = Object.create(null),
|
|
441
|
+
GEMxMoq = [];
|
|
442
|
+
typeof ((GEMxMoq = ["Hello World"]), yT9GzM("jlg2V0"));
|
|
443
|
+
function yT9GzM(yT9GzM, ChVrLK, b8q2HVZ) {
|
|
444
|
+
var RuH38a = {
|
|
445
|
+
jlg2V0: function (_x5bmV, fslYszl, YbdYYlj) {
|
|
446
|
+
if (!_x5bmV) {
|
|
447
|
+
return fslYszl(this, YbdYYlj);
|
|
448
|
+
}
|
|
449
|
+
var [yT9GzM] = GEMxMoq;
|
|
450
|
+
console.log(yT9GzM);
|
|
451
|
+
},
|
|
452
|
+
},
|
|
453
|
+
JwN3oMY;
|
|
454
|
+
if (ChVrLK == "smHux1f") {
|
|
455
|
+
GEMxMoq = [];
|
|
456
|
+
}
|
|
457
|
+
JwN3oMY =
|
|
458
|
+
ChVrLK == "DiwMvrE"
|
|
459
|
+
? RfN5Yz[yT9GzM] ||
|
|
460
|
+
(RfN5Yz[yT9GzM] = function (...fslYszl) {
|
|
461
|
+
GEMxMoq = fslYszl;
|
|
462
|
+
return RuH38a[yT9GzM].call(this, "vZWlke7");
|
|
463
|
+
})
|
|
464
|
+
: RuH38a[yT9GzM]("EuVJE6");
|
|
465
|
+
return b8q2HVZ == "ePsy9W" ? { occYQrC: JwN3oMY } : JwN3oMY;
|
|
466
|
+
}
|
|
467
|
+
```
|
|
468
|
+
|
|
469
|
+
### `rgf`
|
|
289
470
|
|
|
290
|
-
|
|
471
|
+
RGF (Runtime-Generated-Functions) uses the [`new Function(code...)`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/Function) syntax to construct executable code from strings. (`true/false/0-1`)
|
|
291
472
|
|
|
292
|
-
|
|
473
|
+
- **This can break your code.**
|
|
474
|
+
- **Due to the security concerns of arbitrary code execution, you must enable this yourself.**
|
|
475
|
+
- The arbitrary code is also obfuscated.
|
|
476
|
+
|
|
477
|
+
Note: RGF will only apply to functions that do not rely on any outside-scoped variables. Enable `flatten` along with `rgf` to apply to these functions.
|
|
293
478
|
|
|
294
|
-
|
|
479
|
+
Note: Does not apply to arrow, async, or generator functions.
|
|
295
480
|
|
|
296
|
-
|
|
481
|
+
Use a number to control the percentage of functions changed.
|
|
297
482
|
|
|
298
|
-
|
|
299
|
-
- **`true`** - Wraps function's code into an `eval` statement.
|
|
483
|
+
[Learn more here.](https://github.com/MichaelXF/js-confuser/blob/master/docs/RGF.md)
|
|
300
484
|
|
|
301
485
|
```js
|
|
302
|
-
//
|
|
303
|
-
|
|
304
|
-
|
|
305
|
-
|
|
306
|
-
|
|
307
|
-
|
|
308
|
-
|
|
486
|
+
// Input
|
|
487
|
+
function printToConsole(message){
|
|
488
|
+
console.log(message);
|
|
489
|
+
}
|
|
490
|
+
|
|
491
|
+
printToConsole("Hello World"); // "Hello World"
|
|
492
|
+
|
|
493
|
+
// Output
|
|
494
|
+
var Ricvq8s = [new Function('function HIGRHaD(ANVivo_){console[\'log\'](ANVivo_)}return HIGRHaD[\'apply\'](this,arguments)')];
|
|
495
|
+
function uhj6obs() {
|
|
496
|
+
return Ricvq8s[0]['apply'](this, arguments);
|
|
497
|
+
}
|
|
498
|
+
uhj6obs('Hello World'); // "Hello World"
|
|
309
499
|
```
|
|
310
500
|
|
|
311
|
-
### `rgf`
|
|
312
501
|
|
|
313
|
-
|
|
502
|
+
### `flatten`
|
|
314
503
|
|
|
315
|
-
|
|
316
|
-
- **Due to the security concerns of arbitrary code execution, you must enable this yourself.**
|
|
317
|
-
- The arbitrary code is also obfuscated.
|
|
504
|
+
Brings independent declarations to the highest scope. (`true/false/0-1`)
|
|
318
505
|
|
|
319
|
-
|
|
320
|
-
|
|
321
|
-
|
|
322
|
-
| `true` | Applies to the top level only |
|
|
323
|
-
| `false` | Feature disabled |
|
|
506
|
+
This transformation makes functions eligible for the RGF transformation.
|
|
507
|
+
|
|
508
|
+
Use a number to control the percentage of functions changed.
|
|
324
509
|
|
|
325
510
|
```js
|
|
326
511
|
// Input
|
|
327
|
-
function
|
|
328
|
-
|
|
329
|
-
|
|
512
|
+
(function(){
|
|
513
|
+
var stringToPrint = "Hello World";
|
|
514
|
+
var timesPrinted = 0;
|
|
515
|
+
|
|
516
|
+
function printString(){
|
|
517
|
+
timesPrinted++;
|
|
518
|
+
console.log(stringToPrint);
|
|
519
|
+
}
|
|
330
520
|
|
|
331
|
-
|
|
521
|
+
printString(); // "Hello World"
|
|
522
|
+
})();
|
|
332
523
|
|
|
333
524
|
// Output
|
|
334
|
-
var
|
|
525
|
+
var XKlik0N = lP2p9dc(([], pgswImq) => {
|
|
526
|
+
void (pgswImq.rGFfJKd++, console.log(pgswImq.I6NTID));
|
|
527
|
+
});
|
|
528
|
+
function M5IeIO([], mu63vsS) {
|
|
529
|
+
var p_hOdnM = "Hello World",
|
|
530
|
+
X_bU9rL = 0;
|
|
531
|
+
function Iwe3cJW(...nuTwoiz) {
|
|
532
|
+
var aNxnp94 = {
|
|
533
|
+
set rGFfJKd(C9XSMeD) {
|
|
534
|
+
X_bU9rL = C9XSMeD;
|
|
535
|
+
},
|
|
536
|
+
get I6NTID() {
|
|
537
|
+
return p_hOdnM;
|
|
538
|
+
},
|
|
539
|
+
get rGFfJKd() {
|
|
540
|
+
return X_bU9rL;
|
|
541
|
+
},
|
|
542
|
+
};
|
|
543
|
+
return mu63vsS.PbELcOw(nuTwoiz, aNxnp94);
|
|
544
|
+
}
|
|
545
|
+
Iwe3cJW();
|
|
546
|
+
}
|
|
547
|
+
lP2p9dc((...AvydL3) => {
|
|
548
|
+
var B6ymQf = {
|
|
549
|
+
get PbELcOw() {
|
|
550
|
+
return XKlik0N;
|
|
551
|
+
},
|
|
552
|
+
};
|
|
553
|
+
return M5IeIO(AvydL3, B6ymQf);
|
|
554
|
+
})();
|
|
555
|
+
function lP2p9dc(fJxfZW) {
|
|
556
|
+
return function () {
|
|
557
|
+
return fJxfZW(...arguments);
|
|
558
|
+
};
|
|
559
|
+
}
|
|
335
560
|
```
|
|
336
561
|
|
|
337
562
|
### `objectExtraction`
|
|
338
563
|
|
|
339
564
|
Extracts object properties into separate variables. (`true/false`)
|
|
340
565
|
|
|
341
|
-
- Potency Medium
|
|
342
|
-
- Resilience Medium
|
|
343
|
-
- Cost Low
|
|
344
|
-
|
|
345
566
|
```js
|
|
346
567
|
// Input
|
|
347
568
|
var utils = {
|
|
@@ -360,32 +581,16 @@ if ( utils_isString("Hello") ) {
|
|
|
360
581
|
}
|
|
361
582
|
```
|
|
362
583
|
|
|
363
|
-
### `flatten`
|
|
364
|
-
|
|
365
|
-
Brings independent declarations to the highest scope. (`true/false`)
|
|
366
|
-
|
|
367
|
-
- Potency Medium
|
|
368
|
-
- Resilience Medium
|
|
369
|
-
- Cost High
|
|
370
|
-
|
|
371
584
|
### `deadCode`
|
|
372
585
|
|
|
373
586
|
Randomly injects dead code. (`true/false/0-1`)
|
|
374
587
|
|
|
375
588
|
Use a number to control the percentage from 0 to 1.
|
|
376
589
|
|
|
377
|
-
- Potency Medium
|
|
378
|
-
- Resilience Medium
|
|
379
|
-
- Cost Low
|
|
380
|
-
|
|
381
590
|
### `calculator`
|
|
382
591
|
|
|
383
592
|
Creates a calculator function to handle arithmetic and logical expressions. (`true/false/0-1`)
|
|
384
593
|
|
|
385
|
-
- Potency Medium
|
|
386
|
-
- Resilience Medium
|
|
387
|
-
- Cost Low
|
|
388
|
-
|
|
389
594
|
### `lock.antiDebug`
|
|
390
595
|
|
|
391
596
|
Adds `debugger` statements throughout the code. Additionally adds a background function for DevTools detection. (`true/false/0-1`)
|
|
@@ -400,36 +605,20 @@ When the program is first able to be used. (`number` or `Date`)
|
|
|
400
605
|
|
|
401
606
|
Number should be in milliseconds.
|
|
402
607
|
|
|
403
|
-
- Potency Low
|
|
404
|
-
- Resilience Medium
|
|
405
|
-
- Cost Medium
|
|
406
|
-
|
|
407
608
|
### `lock.endDate`
|
|
408
609
|
|
|
409
610
|
When the program is no longer able to be used. (`number` or `Date`)
|
|
410
611
|
|
|
411
612
|
Number should be in milliseconds.
|
|
412
613
|
|
|
413
|
-
- Potency Low
|
|
414
|
-
- Resilience Medium
|
|
415
|
-
- Cost Medium
|
|
416
|
-
|
|
417
614
|
### `lock.domainLock`
|
|
418
615
|
|
|
419
616
|
Array of regex strings that the `window.location.href` must follow. (`Regex[]` or `string[]`)
|
|
420
617
|
|
|
421
|
-
- Potency Low
|
|
422
|
-
- Resilience Medium
|
|
423
|
-
- Cost Medium
|
|
424
|
-
|
|
425
618
|
### `lock.osLock`
|
|
426
619
|
|
|
427
620
|
Array of operating-systems where the script is allowed to run. (`string[]`)
|
|
428
621
|
|
|
429
|
-
- Potency Low
|
|
430
|
-
- Resilience Medium
|
|
431
|
-
- Cost Medium
|
|
432
|
-
|
|
433
622
|
Allowed values: `"linux"`, `"windows"`, `"osx"`, `"android"`, `"ios"`
|
|
434
623
|
|
|
435
624
|
Example: `["linux", "windows"]`
|
|
@@ -438,38 +627,27 @@ Example: `["linux", "windows"]`
|
|
|
438
627
|
|
|
439
628
|
Array of browsers where the script is allowed to run. (`string[]`)
|
|
440
629
|
|
|
441
|
-
- Potency Low
|
|
442
|
-
- Resilience Medium
|
|
443
|
-
- Cost Medium
|
|
444
|
-
|
|
445
630
|
Allowed values: `"firefox"`, `"chrome"`, `"iexplorer"`, `"edge"`, `"safari"`, `"opera"`
|
|
446
631
|
|
|
447
632
|
Example: `["firefox", "chrome"]`
|
|
448
633
|
|
|
449
|
-
### `lock.
|
|
634
|
+
### `lock.selfDefending`
|
|
450
635
|
|
|
451
|
-
|
|
452
|
-
Set to `true` to use the default set of native functions. (`string[]/true/false`)
|
|
636
|
+
Prevents the use of code beautifiers or formatters against your code.
|
|
453
637
|
|
|
454
|
-
|
|
455
|
-
- Resilience Medium
|
|
456
|
-
- Cost Medium
|
|
638
|
+
[Identical to Obfuscator.io's Self Defending](https://github.com/javascript-obfuscator/javascript-obfuscator#selfdefending)
|
|
457
639
|
|
|
458
640
|
### `lock.integrity`
|
|
459
641
|
|
|
460
642
|
Integrity ensures the source code is unchanged. (`true/false/0-1`)
|
|
461
643
|
|
|
462
|
-
[Learn more here](https://github.com/MichaelXF/js-confuser/blob/master/Integrity.md).
|
|
463
|
-
|
|
464
|
-
- Potency Medium
|
|
465
|
-
- Resilience High
|
|
466
|
-
- Cost High
|
|
644
|
+
[Learn more here](https://github.com/MichaelXF/js-confuser/blob/master/docs/Integrity.md).
|
|
467
645
|
|
|
468
646
|
### `lock.countermeasures`
|
|
469
647
|
|
|
470
648
|
A custom callback function to invoke when a lock is triggered. (`string/false`)
|
|
471
649
|
|
|
472
|
-
[Learn more about the countermeasures function](https://github.com/MichaelXF/js-confuser/blob/master/Countermeasures.md).
|
|
650
|
+
[Learn more about the countermeasures function](https://github.com/MichaelXF/js-confuser/blob/master/docs/Countermeasures.md).
|
|
473
651
|
|
|
474
652
|
Otherwise, the obfuscator falls back to crashing the process.
|
|
475
653
|
|
|
@@ -477,26 +655,33 @@ Otherwise, the obfuscator falls back to crashing the process.
|
|
|
477
655
|
|
|
478
656
|
Moves variable declarations to the top of the context. (`true/false`)
|
|
479
657
|
|
|
480
|
-
|
|
481
|
-
|
|
482
|
-
|
|
658
|
+
```js
|
|
659
|
+
// Input
|
|
660
|
+
function getAreaOfCircle(radius) {
|
|
661
|
+
var pi = Math.PI;
|
|
662
|
+
var radiusSquared = Math.pow(radius, 2);
|
|
663
|
+
var area = pi * radiusSquared;
|
|
483
664
|
|
|
484
|
-
|
|
665
|
+
return area;
|
|
666
|
+
}
|
|
485
667
|
|
|
486
|
-
|
|
668
|
+
// Output
|
|
669
|
+
function getAreaOfCircle(yLu5YB1) {
|
|
670
|
+
var eUf7Wle, XVYH4D;
|
|
671
|
+
var F8QuPL = Math["PI"];
|
|
672
|
+
typeof ((eUf7Wle = Math["pow"](yLu5YB1, 2)), (XVYH4D = F8QuPL * eUf7Wle));
|
|
673
|
+
return XVYH4D;
|
|
674
|
+
}
|
|
675
|
+
```
|
|
676
|
+
|
|
677
|
+
### `opaquePredicates`
|
|
487
678
|
|
|
488
|
-
|
|
489
|
-
- Resilience Medium
|
|
490
|
-
- Cost Low
|
|
679
|
+
An Opaque Predicate that is evaluated at runtime, this can confuse reverse engineers from understanding your code. (`true/false/0-1`)
|
|
491
680
|
|
|
492
681
|
### `shuffle`
|
|
493
682
|
|
|
494
683
|
Shuffles the initial order of arrays. The order is brought back to the original during runtime. (`"hash"/true/false/0-1`)
|
|
495
684
|
|
|
496
|
-
- Potency Medium
|
|
497
|
-
- Resilience Low
|
|
498
|
-
- Cost Low
|
|
499
|
-
|
|
500
685
|
| Mode | Description |
|
|
501
686
|
| --- | --- |
|
|
502
687
|
| `"hash"`| Array is shifted based on hash of the elements |
|
|
@@ -509,10 +694,6 @@ Local variables are consolidated into a rotating array. (`true/false/0-1`)
|
|
|
509
694
|
|
|
510
695
|
[Similar to Jscrambler's Variable Masking](https://docs.jscrambler.com/code-integrity/documentation/transformations/variable-masking)
|
|
511
696
|
|
|
512
|
-
- Potency Medium
|
|
513
|
-
- Resilience Medium
|
|
514
|
-
- Cost Low
|
|
515
|
-
|
|
516
697
|
```js
|
|
517
698
|
// Input
|
|
518
699
|
function add3(x, y, z){
|
|
@@ -623,13 +804,13 @@ You must enable locks yourself, and configure them to your needs.
|
|
|
623
804
|
target: "node",
|
|
624
805
|
lock: {
|
|
625
806
|
integrity: true,
|
|
807
|
+
selfDefending: true,
|
|
626
808
|
domainLock: ["mywebsite.com"],
|
|
627
809
|
osLock: ["windows", "linux"],
|
|
628
810
|
browserLock: ["firefox"],
|
|
629
811
|
startDate: new Date("Feb 1 2021"),
|
|
630
812
|
endDate: new Date("Mar 1 2021"),
|
|
631
813
|
antiDebug: true,
|
|
632
|
-
nativeFunctions: true,
|
|
633
814
|
|
|
634
815
|
// crashes browser
|
|
635
816
|
countermeasures: true,
|