js-confuser 1.6.0 → 1.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +42 -0
- package/README.md +215 -172
- package/dist/constants.js +6 -2
- package/dist/obfuscator.js +0 -6
- package/dist/options.js +4 -4
- package/dist/presets.js +6 -7
- package/dist/templates/crash.js +2 -2
- package/dist/templates/functionLength.js +16 -0
- package/dist/transforms/dispatcher.js +10 -1
- package/dist/transforms/extraction/duplicateLiteralsRemoval.js +95 -59
- package/dist/transforms/extraction/objectExtraction.js +6 -1
- package/dist/transforms/flatten.js +224 -147
- package/dist/transforms/identifier/movedDeclarations.js +38 -85
- package/dist/transforms/identifier/renameVariables.js +94 -41
- package/dist/transforms/lock/lock.js +0 -37
- package/dist/transforms/minify.js +2 -2
- package/dist/transforms/rgf.js +145 -244
- package/dist/transforms/stack.js +42 -1
- package/dist/transforms/transform.js +1 -1
- package/dist/util/gen.js +2 -1
- package/dist/util/identifiers.js +38 -4
- package/dist/util/insert.js +24 -3
- package/docs/ControlFlowFlattening.md +595 -0
- package/{Countermeasures.md → docs/Countermeasures.md} +1 -15
- package/docs/ES5.md +197 -0
- package/{Integrity.md → docs/Integrity.md} +2 -2
- package/docs/RGF.md +419 -0
- package/package.json +2 -2
- package/src/constants.ts +3 -0
- package/src/obfuscator.ts +0 -4
- package/src/options.ts +9 -86
- package/src/presets.ts +6 -7
- package/src/templates/crash.ts +10 -10
- package/src/templates/functionLength.ts +14 -0
- package/src/transforms/dispatcher.ts +15 -1
- package/src/transforms/extraction/duplicateLiteralsRemoval.ts +135 -130
- package/src/transforms/extraction/objectExtraction.ts +4 -0
- package/src/transforms/flatten.ts +357 -290
- package/src/transforms/identifier/movedDeclarations.ts +50 -96
- package/src/transforms/identifier/renameVariables.ts +120 -56
- package/src/transforms/lock/lock.ts +1 -42
- package/src/transforms/minify.ts +11 -2
- package/src/transforms/rgf.ts +221 -402
- package/src/transforms/stack.ts +62 -0
- package/src/transforms/transform.ts +6 -2
- package/src/util/gen.ts +7 -2
- package/src/util/identifiers.ts +48 -4
- package/src/util/insert.ts +26 -2
- package/test/code/ES6.src.js +24 -0
- package/test/transforms/dispatcher.test.ts +27 -0
- package/test/transforms/extraction/duplicateLiteralsRemoval.test.ts +21 -8
- package/test/transforms/extraction/objectExtraction.test.ts +35 -15
- package/test/transforms/flatten.test.ts +352 -88
- package/test/transforms/identifier/globalConcealing.test.ts +23 -2
- package/test/transforms/identifier/movedDeclarations.test.ts +37 -9
- package/test/transforms/identifier/renameVariables.test.ts +37 -0
- package/test/transforms/lock/integrity.test.ts +24 -0
- package/test/transforms/lock/lock.test.ts +1 -48
- package/test/transforms/minify.test.ts +19 -0
- package/test/transforms/rgf.test.ts +262 -353
- package/test/transforms/stack.test.ts +52 -0
- package/test/util/identifiers.test.ts +134 -1
- package/test/util/insert.test.ts +57 -3
- package/src/transforms/eval.ts +0 -89
- package/src/transforms/identifier/nameRecycling.ts +0 -280
- package/test/transforms/eval.test.ts +0 -131
- package/test/transforms/identifier/nameRecycling.test.ts +0 -205
package/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,45 @@
|
|
|
1
|
+
# `1.7.1`
|
|
2
|
+
Updates
|
|
3
|
+
|
|
4
|
+
- Fixed [#107](https://github.com/MichaelXF/js-confuser/issues/107)
|
|
5
|
+
- - RGF and Integrity clash issue fixed
|
|
6
|
+
|
|
7
|
+
- Fixed [#106](https://github.com/MichaelXF/js-confuser/issues/106)
|
|
8
|
+
- - Object Extraction to properly handle `const` objects
|
|
9
|
+
|
|
10
|
+
- Fixed [#105](https://github.com/MichaelXF/js-confuser/issues/105)
|
|
11
|
+
- - Duplicate Literals Removal updated to not cause this error
|
|
12
|
+
|
|
13
|
+
- Fixed [#103](https://github.com/MichaelXF/js-confuser/issues/103)
|
|
14
|
+
- - Dispatcher will no longer apply to these types of functions to prevent this error
|
|
15
|
+
|
|
16
|
+
- Added documentation page for [ES5](https://github.com/MichaelXF/js-confuser/blob/master/docs/ES5.md)
|
|
17
|
+
|
|
18
|
+
- Rollup Plugin created: https://github.com/ayecue/rollup-js-confuser (Thanks @ayecue !)
|
|
19
|
+
|
|
20
|
+
# `1.7.0`
|
|
21
|
+
Updates
|
|
22
|
+
|
|
23
|
+
- Fixed [#89](https://github.com/MichaelXF/js-confuser/issues/89)
|
|
24
|
+
- - Flatten to not break functions with invalid identifier names
|
|
25
|
+
|
|
26
|
+
- Fixed [#88](https://github.com/MichaelXF/js-confuser/issues/88)
|
|
27
|
+
- - Stack to not break functions with syncing arguments
|
|
28
|
+
|
|
29
|
+
- Fixed [#91](https://github.com/MichaelXF/js-confuser/issues/91)
|
|
30
|
+
- - Minify to preserve function.length property
|
|
31
|
+
|
|
32
|
+
- Fixed [#95](https://github.com/MichaelXF/js-confuser/issues/95)
|
|
33
|
+
- - Rename Variables optimized to obfuscate much faster
|
|
34
|
+
|
|
35
|
+
- Added documentation pages for [RGF](https://github.com/MichaelXF/js-confuser/blob/master/docs/RGF.md) and [Control Flow Flattening](https://github.com/MichaelXF/js-confuser/blob/master/docs/ControlFlowFlattening.md)
|
|
36
|
+
|
|
37
|
+
- Removed `eval` option in favor of `rgf` option.
|
|
38
|
+
|
|
39
|
+
- - Removed the `"all"` option from `rgf`.
|
|
40
|
+
|
|
41
|
+
- Removed `nameRecycling` option
|
|
42
|
+
|
|
1
43
|
# `1.6.0`
|
|
2
44
|
Website Redesign + Updates
|
|
3
45
|
|
package/README.md
CHANGED
|
@@ -11,7 +11,7 @@ JS-Confuser is a JavaScript obfuscation tool to make your programs _impossible_
|
|
|
11
11
|
- String concealing
|
|
12
12
|
- Function obfuscation
|
|
13
13
|
- Locks (domainLock, date)
|
|
14
|
-
- [Detect changes to source code](https://github.com/MichaelXF/js-confuser/blob/master/Integrity.md)
|
|
14
|
+
- [Detect changes to source code](https://github.com/MichaelXF/js-confuser/blob/master/docs/Integrity.md)
|
|
15
15
|
|
|
16
16
|
## Presets
|
|
17
17
|
|
|
@@ -135,14 +135,79 @@ Does not cover all cases such as Promises or Generator functions. Use [Babel](ht
|
|
|
135
135
|
|
|
136
136
|
Determines if variables should be renamed. (`true/false`)
|
|
137
137
|
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
138
|
+
```js
|
|
139
|
+
// Input
|
|
140
|
+
var twoSum = function (nums, target) {
|
|
141
|
+
var hash = {};
|
|
142
|
+
var len = nums.length;
|
|
143
|
+
for (var i = 0; i < len; i++) {
|
|
144
|
+
if (nums[i] in hash) return [hash[nums[i]], i];
|
|
145
|
+
hash[target - nums[i]] = i;
|
|
146
|
+
}
|
|
147
|
+
return [-1, -1];
|
|
148
|
+
};
|
|
149
|
+
|
|
150
|
+
var test = function () {
|
|
151
|
+
var inputNums = [2, 7, 11, 15];
|
|
152
|
+
var inputTarget = 9;
|
|
153
|
+
var expectedResult = [0, 1];
|
|
154
|
+
|
|
155
|
+
var actualResult = twoSum(inputNums, inputTarget);
|
|
156
|
+
ok(actualResult[0] === expectedResult[0]);
|
|
157
|
+
ok(actualResult[1] === expectedResult[1]);
|
|
158
|
+
};
|
|
159
|
+
|
|
160
|
+
test();
|
|
161
|
+
|
|
162
|
+
// Output
|
|
163
|
+
var _O2mOcF = function (kB4uXM, w_07HXS) {
|
|
164
|
+
var ZLTJcx = {};
|
|
165
|
+
var sXQOaUx = kB4uXM["length"];
|
|
166
|
+
for (var JYYxEk = 0; JYYxEk < sXQOaUx; JYYxEk++) {
|
|
167
|
+
if (kB4uXM[JYYxEk] in ZLTJcx) {
|
|
168
|
+
return [ZLTJcx[kB4uXM[JYYxEk]], JYYxEk];
|
|
169
|
+
}
|
|
170
|
+
ZLTJcx[w_07HXS - kB4uXM[JYYxEk]] = JYYxEk;
|
|
171
|
+
}
|
|
172
|
+
return [-1, -1];
|
|
173
|
+
};
|
|
174
|
+
var qFaI6S = function () {
|
|
175
|
+
var fZpeOw = [2, 7, 11, 15];
|
|
176
|
+
var UJ62R2c = 9;
|
|
177
|
+
var dG6R0cV = [0, 1];
|
|
178
|
+
var WgYXwn = _O2mOcF(fZpeOw, UJ62R2c);
|
|
179
|
+
void (ok(WgYXwn[0] === dG6R0cV[0]), ok(WgYXwn[1] === dG6R0cV[1]));
|
|
180
|
+
};
|
|
181
|
+
qFaI6S();
|
|
182
|
+
```
|
|
141
183
|
|
|
142
184
|
### `renameGlobals`
|
|
143
185
|
|
|
144
186
|
Renames top-level variables, turn this off for web-related scripts. Enabled by default. (`true/false`)
|
|
145
187
|
|
|
188
|
+
```js
|
|
189
|
+
// Output (Same input from above)
|
|
190
|
+
var twoSum = function (Oc4nmjB, Fk3nptX) {
|
|
191
|
+
var on_KnCm = {};
|
|
192
|
+
var lqAauc = Oc4nmjB["length"];
|
|
193
|
+
for (var mALijp8 = 0; mALijp8 < lqAauc; mALijp8++) {
|
|
194
|
+
if (Oc4nmjB[mALijp8] in on_KnCm) {
|
|
195
|
+
return [on_KnCm[Oc4nmjB[mALijp8]], mALijp8];
|
|
196
|
+
}
|
|
197
|
+
on_KnCm[Fk3nptX - Oc4nmjB[mALijp8]] = mALijp8;
|
|
198
|
+
}
|
|
199
|
+
return [-1, -1];
|
|
200
|
+
};
|
|
201
|
+
var test = function () {
|
|
202
|
+
var y5ySeZ = [2, 7, 11, 15];
|
|
203
|
+
var gHYMOm = 9;
|
|
204
|
+
var aAdj3v = [0, 1];
|
|
205
|
+
var GnLVHX = twoSum(y5ySeZ, gHYMOm);
|
|
206
|
+
!(ok(GnLVHX[0] === aAdj3v[0]), ok(GnLVHX[1] === aAdj3v[1]));
|
|
207
|
+
};
|
|
208
|
+
test();
|
|
209
|
+
```
|
|
210
|
+
|
|
146
211
|
### `identifierGenerator`
|
|
147
212
|
|
|
148
213
|
Determines how variables are renamed.
|
|
@@ -179,45 +244,15 @@ JsConfuser.obfuscate(code, {
|
|
|
179
244
|
|
|
180
245
|
JSConfuser tries to reuse names when possible, creating very potent code.
|
|
181
246
|
|
|
182
|
-
### `nameRecycling`
|
|
183
|
-
|
|
184
|
-
⚠️ Experimental feature, may break your code!
|
|
185
|
-
|
|
186
|
-
Attempts to reuse released names.
|
|
187
|
-
|
|
188
|
-
- Potency Medium
|
|
189
|
-
- Resilience High
|
|
190
|
-
- Cost Low
|
|
191
|
-
|
|
192
|
-
```js
|
|
193
|
-
// Input
|
|
194
|
-
function percentage(x) {
|
|
195
|
-
var multiplied = x * 100;
|
|
196
|
-
var floored = Math.floor(multiplied);
|
|
197
|
-
var output = floored + "%"
|
|
198
|
-
return output;
|
|
199
|
-
}
|
|
200
|
-
|
|
201
|
-
// Output
|
|
202
|
-
function percentage(x) {
|
|
203
|
-
var multiplied = x * 100;
|
|
204
|
-
var floored = Math.floor(multiplied);
|
|
205
|
-
multiplied = floored + "%";
|
|
206
|
-
return multiplied;
|
|
207
|
-
}
|
|
208
|
-
```
|
|
209
|
-
|
|
210
247
|
### `controlFlowFlattening`
|
|
211
248
|
|
|
212
|
-
|
|
249
|
+
**⚠️ Significantly impacts performance, use sparingly!**
|
|
213
250
|
|
|
214
|
-
|
|
251
|
+
Control-flow Flattening hinders program comprehension by creating convoluted switch statements. (`true/false/0-1`)
|
|
215
252
|
|
|
216
253
|
Use a number to control the percentage from 0 to 1.
|
|
217
254
|
|
|
218
|
-
|
|
219
|
-
- Resilience High
|
|
220
|
-
- Cost High
|
|
255
|
+
[Learn more here.](https://github.com/MichaelXF/js-confuser/blob/master/docs/ControlFlowFlattening.md)
|
|
221
256
|
|
|
222
257
|
```js
|
|
223
258
|
// Input
|
|
@@ -348,125 +383,186 @@ while (mJMdMhJ + A1Nyvv + xDwpOk6 != 83) {
|
|
|
348
383
|
|
|
349
384
|
Global Concealing hides global variables being accessed. (`true/false`)
|
|
350
385
|
|
|
351
|
-
|
|
352
|
-
|
|
353
|
-
|
|
386
|
+
```js
|
|
387
|
+
// Input
|
|
388
|
+
console.log("Hello World");
|
|
389
|
+
|
|
390
|
+
// Output
|
|
391
|
+
yAt1T_y(-93)["log"]("Hello World");
|
|
392
|
+
```
|
|
354
393
|
|
|
355
394
|
### `stringCompression`
|
|
356
395
|
String Compression uses LZW's compression algorithm to compress strings. (`true/false/0-1`)
|
|
357
396
|
|
|
358
397
|
`"console"` -> `inflate('replaĕ!ğğuģģ<~@')`
|
|
359
|
-
- Potency High
|
|
360
|
-
- Resilience Medium
|
|
361
|
-
- Cost Medium
|
|
362
398
|
|
|
363
399
|
### `stringConcealing`
|
|
364
400
|
|
|
365
|
-
|
|
401
|
+
String Concealing involves encoding strings to conceal plain-text values. (`true/false/0-1`)
|
|
366
402
|
|
|
367
403
|
Use a number to control the percentage of strings.
|
|
368
404
|
|
|
369
405
|
`"console"` -> `decrypt('<~@rH7+Dert~>')`
|
|
370
406
|
|
|
371
|
-
- Potency High
|
|
372
|
-
- Resilience Medium
|
|
373
|
-
- Cost Medium
|
|
374
|
-
|
|
375
407
|
### `stringEncoding`
|
|
376
408
|
|
|
377
|
-
|
|
409
|
+
String Encoding transforms a string into an encoded representation. (`true/false/0-1`)
|
|
378
410
|
|
|
379
411
|
Use a number to control the percentage of strings.
|
|
380
412
|
|
|
381
413
|
`"console"` -> `'\x63\x6f\x6e\x73\x6f\x6c\x65'`
|
|
382
414
|
|
|
383
|
-
- Potency Low
|
|
384
|
-
- Resilience Low
|
|
385
|
-
- Cost Low
|
|
386
|
-
|
|
387
415
|
### `stringSplitting`
|
|
388
416
|
|
|
389
|
-
|
|
417
|
+
String Splitting splits your strings into multiple expressions. (`true/false/0-1`)
|
|
390
418
|
|
|
391
419
|
Use a number to control the percentage of strings.
|
|
392
420
|
|
|
393
421
|
`"console"` -> `String.fromCharCode(99) + 'ons' + 'ole'`
|
|
394
422
|
|
|
395
|
-
- Potency Medium
|
|
396
|
-
- Resilience Medium
|
|
397
|
-
- Cost Medium
|
|
398
|
-
|
|
399
423
|
### `duplicateLiteralsRemoval`
|
|
400
424
|
|
|
401
|
-
|
|
402
|
-
|
|
403
|
-
- Potency Medium
|
|
404
|
-
- Resilience Low
|
|
405
|
-
- Cost High
|
|
425
|
+
Duplicate Literals Removal replaces duplicate literals with a single variable name. (`true/false`)
|
|
406
426
|
|
|
407
427
|
### `dispatcher`
|
|
408
428
|
|
|
409
429
|
Creates a middleman function to process function calls. (`true/false/0-1`)
|
|
410
430
|
|
|
411
|
-
|
|
412
|
-
|
|
413
|
-
|
|
431
|
+
```js
|
|
432
|
+
// Input
|
|
433
|
+
function print(x){
|
|
434
|
+
console.log(x);
|
|
435
|
+
}
|
|
436
|
+
|
|
437
|
+
print("Hello World"); // "Hello World"
|
|
438
|
+
|
|
439
|
+
// Output
|
|
440
|
+
var RfN5Yz = Object.create(null),
|
|
441
|
+
GEMxMoq = [];
|
|
442
|
+
typeof ((GEMxMoq = ["Hello World"]), yT9GzM("jlg2V0"));
|
|
443
|
+
function yT9GzM(yT9GzM, ChVrLK, b8q2HVZ) {
|
|
444
|
+
var RuH38a = {
|
|
445
|
+
jlg2V0: function (_x5bmV, fslYszl, YbdYYlj) {
|
|
446
|
+
if (!_x5bmV) {
|
|
447
|
+
return fslYszl(this, YbdYYlj);
|
|
448
|
+
}
|
|
449
|
+
var [yT9GzM] = GEMxMoq;
|
|
450
|
+
console.log(yT9GzM);
|
|
451
|
+
},
|
|
452
|
+
},
|
|
453
|
+
JwN3oMY;
|
|
454
|
+
if (ChVrLK == "smHux1f") {
|
|
455
|
+
GEMxMoq = [];
|
|
456
|
+
}
|
|
457
|
+
JwN3oMY =
|
|
458
|
+
ChVrLK == "DiwMvrE"
|
|
459
|
+
? RfN5Yz[yT9GzM] ||
|
|
460
|
+
(RfN5Yz[yT9GzM] = function (...fslYszl) {
|
|
461
|
+
GEMxMoq = fslYszl;
|
|
462
|
+
return RuH38a[yT9GzM].call(this, "vZWlke7");
|
|
463
|
+
})
|
|
464
|
+
: RuH38a[yT9GzM]("EuVJE6");
|
|
465
|
+
return b8q2HVZ == "ePsy9W" ? { occYQrC: JwN3oMY } : JwN3oMY;
|
|
466
|
+
}
|
|
467
|
+
```
|
|
468
|
+
|
|
469
|
+
### `rgf`
|
|
470
|
+
|
|
471
|
+
RGF (Runtime-Generated-Functions) uses the [`new Function(code...)`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/Function) syntax to construct executable code from strings. (`true/false/0-1`)
|
|
414
472
|
|
|
415
|
-
|
|
473
|
+
- **This can break your code.**
|
|
474
|
+
- **Due to the security concerns of arbitrary code execution, you must enable this yourself.**
|
|
475
|
+
- The arbitrary code is also obfuscated.
|
|
416
476
|
|
|
417
|
-
|
|
477
|
+
Note: RGF will only apply to functions that do not rely on any outside-scoped variables. Enable `flatten` along with `rgf` to apply to these functions.
|
|
418
478
|
|
|
419
|
-
|
|
479
|
+
Note: Does not apply to arrow, async, or generator functions.
|
|
420
480
|
|
|
421
|
-
|
|
481
|
+
Use a number to control the percentage of functions changed.
|
|
422
482
|
|
|
423
|
-
|
|
424
|
-
- **`true`** - Wraps function's code into an `eval` statement.
|
|
483
|
+
[Learn more here.](https://github.com/MichaelXF/js-confuser/blob/master/docs/RGF.md)
|
|
425
484
|
|
|
426
485
|
```js
|
|
427
|
-
//
|
|
428
|
-
|
|
429
|
-
|
|
430
|
-
|
|
431
|
-
|
|
432
|
-
|
|
433
|
-
|
|
486
|
+
// Input
|
|
487
|
+
function printToConsole(message){
|
|
488
|
+
console.log(message);
|
|
489
|
+
}
|
|
490
|
+
|
|
491
|
+
printToConsole("Hello World"); // "Hello World"
|
|
492
|
+
|
|
493
|
+
// Output
|
|
494
|
+
var Ricvq8s = [new Function('function HIGRHaD(ANVivo_){console[\'log\'](ANVivo_)}return HIGRHaD[\'apply\'](this,arguments)')];
|
|
495
|
+
function uhj6obs() {
|
|
496
|
+
return Ricvq8s[0]['apply'](this, arguments);
|
|
497
|
+
}
|
|
498
|
+
uhj6obs('Hello World'); // "Hello World"
|
|
434
499
|
```
|
|
435
500
|
|
|
436
|
-
### `rgf`
|
|
437
501
|
|
|
438
|
-
|
|
502
|
+
### `flatten`
|
|
439
503
|
|
|
440
|
-
|
|
441
|
-
- **Due to the security concerns of arbitrary code execution, you must enable this yourself.**
|
|
442
|
-
- The arbitrary code is also obfuscated.
|
|
504
|
+
Brings independent declarations to the highest scope. (`true/false/0-1`)
|
|
443
505
|
|
|
444
|
-
|
|
445
|
-
|
|
446
|
-
|
|
447
|
-
| `true` | Applies to the top level only |
|
|
448
|
-
| `false` | Feature disabled |
|
|
506
|
+
This transformation makes functions eligible for the RGF transformation.
|
|
507
|
+
|
|
508
|
+
Use a number to control the percentage of functions changed.
|
|
449
509
|
|
|
450
510
|
```js
|
|
451
511
|
// Input
|
|
452
|
-
function
|
|
453
|
-
|
|
454
|
-
|
|
512
|
+
(function(){
|
|
513
|
+
var stringToPrint = "Hello World";
|
|
514
|
+
var timesPrinted = 0;
|
|
515
|
+
|
|
516
|
+
function printString(){
|
|
517
|
+
timesPrinted++;
|
|
518
|
+
console.log(stringToPrint);
|
|
519
|
+
}
|
|
455
520
|
|
|
456
|
-
|
|
521
|
+
printString(); // "Hello World"
|
|
522
|
+
})();
|
|
457
523
|
|
|
458
524
|
// Output
|
|
459
|
-
var
|
|
525
|
+
var XKlik0N = lP2p9dc(([], pgswImq) => {
|
|
526
|
+
void (pgswImq.rGFfJKd++, console.log(pgswImq.I6NTID));
|
|
527
|
+
});
|
|
528
|
+
function M5IeIO([], mu63vsS) {
|
|
529
|
+
var p_hOdnM = "Hello World",
|
|
530
|
+
X_bU9rL = 0;
|
|
531
|
+
function Iwe3cJW(...nuTwoiz) {
|
|
532
|
+
var aNxnp94 = {
|
|
533
|
+
set rGFfJKd(C9XSMeD) {
|
|
534
|
+
X_bU9rL = C9XSMeD;
|
|
535
|
+
},
|
|
536
|
+
get I6NTID() {
|
|
537
|
+
return p_hOdnM;
|
|
538
|
+
},
|
|
539
|
+
get rGFfJKd() {
|
|
540
|
+
return X_bU9rL;
|
|
541
|
+
},
|
|
542
|
+
};
|
|
543
|
+
return mu63vsS.PbELcOw(nuTwoiz, aNxnp94);
|
|
544
|
+
}
|
|
545
|
+
Iwe3cJW();
|
|
546
|
+
}
|
|
547
|
+
lP2p9dc((...AvydL3) => {
|
|
548
|
+
var B6ymQf = {
|
|
549
|
+
get PbELcOw() {
|
|
550
|
+
return XKlik0N;
|
|
551
|
+
},
|
|
552
|
+
};
|
|
553
|
+
return M5IeIO(AvydL3, B6ymQf);
|
|
554
|
+
})();
|
|
555
|
+
function lP2p9dc(fJxfZW) {
|
|
556
|
+
return function () {
|
|
557
|
+
return fJxfZW(...arguments);
|
|
558
|
+
};
|
|
559
|
+
}
|
|
460
560
|
```
|
|
461
561
|
|
|
462
562
|
### `objectExtraction`
|
|
463
563
|
|
|
464
564
|
Extracts object properties into separate variables. (`true/false`)
|
|
465
565
|
|
|
466
|
-
- Potency Medium
|
|
467
|
-
- Resilience Medium
|
|
468
|
-
- Cost Low
|
|
469
|
-
|
|
470
566
|
```js
|
|
471
567
|
// Input
|
|
472
568
|
var utils = {
|
|
@@ -485,32 +581,16 @@ if ( utils_isString("Hello") ) {
|
|
|
485
581
|
}
|
|
486
582
|
```
|
|
487
583
|
|
|
488
|
-
### `flatten`
|
|
489
|
-
|
|
490
|
-
Brings independent declarations to the highest scope. (`true/false`)
|
|
491
|
-
|
|
492
|
-
- Potency Medium
|
|
493
|
-
- Resilience Medium
|
|
494
|
-
- Cost High
|
|
495
|
-
|
|
496
584
|
### `deadCode`
|
|
497
585
|
|
|
498
586
|
Randomly injects dead code. (`true/false/0-1`)
|
|
499
587
|
|
|
500
588
|
Use a number to control the percentage from 0 to 1.
|
|
501
589
|
|
|
502
|
-
- Potency Medium
|
|
503
|
-
- Resilience Medium
|
|
504
|
-
- Cost Low
|
|
505
|
-
|
|
506
590
|
### `calculator`
|
|
507
591
|
|
|
508
592
|
Creates a calculator function to handle arithmetic and logical expressions. (`true/false/0-1`)
|
|
509
593
|
|
|
510
|
-
- Potency Medium
|
|
511
|
-
- Resilience Medium
|
|
512
|
-
- Cost Low
|
|
513
|
-
|
|
514
594
|
### `lock.antiDebug`
|
|
515
595
|
|
|
516
596
|
Adds `debugger` statements throughout the code. Additionally adds a background function for DevTools detection. (`true/false/0-1`)
|
|
@@ -525,36 +605,20 @@ When the program is first able to be used. (`number` or `Date`)
|
|
|
525
605
|
|
|
526
606
|
Number should be in milliseconds.
|
|
527
607
|
|
|
528
|
-
- Potency Low
|
|
529
|
-
- Resilience Medium
|
|
530
|
-
- Cost Medium
|
|
531
|
-
|
|
532
608
|
### `lock.endDate`
|
|
533
609
|
|
|
534
610
|
When the program is no longer able to be used. (`number` or `Date`)
|
|
535
611
|
|
|
536
612
|
Number should be in milliseconds.
|
|
537
613
|
|
|
538
|
-
- Potency Low
|
|
539
|
-
- Resilience Medium
|
|
540
|
-
- Cost Medium
|
|
541
|
-
|
|
542
614
|
### `lock.domainLock`
|
|
543
615
|
|
|
544
616
|
Array of regex strings that the `window.location.href` must follow. (`Regex[]` or `string[]`)
|
|
545
617
|
|
|
546
|
-
- Potency Low
|
|
547
|
-
- Resilience Medium
|
|
548
|
-
- Cost Medium
|
|
549
|
-
|
|
550
618
|
### `lock.osLock`
|
|
551
619
|
|
|
552
620
|
Array of operating-systems where the script is allowed to run. (`string[]`)
|
|
553
621
|
|
|
554
|
-
- Potency Low
|
|
555
|
-
- Resilience Medium
|
|
556
|
-
- Cost Medium
|
|
557
|
-
|
|
558
622
|
Allowed values: `"linux"`, `"windows"`, `"osx"`, `"android"`, `"ios"`
|
|
559
623
|
|
|
560
624
|
Example: `["linux", "windows"]`
|
|
@@ -563,48 +627,27 @@ Example: `["linux", "windows"]`
|
|
|
563
627
|
|
|
564
628
|
Array of browsers where the script is allowed to run. (`string[]`)
|
|
565
629
|
|
|
566
|
-
- Potency Low
|
|
567
|
-
- Resilience Medium
|
|
568
|
-
- Cost Medium
|
|
569
|
-
|
|
570
630
|
Allowed values: `"firefox"`, `"chrome"`, `"iexplorer"`, `"edge"`, `"safari"`, `"opera"`
|
|
571
631
|
|
|
572
632
|
Example: `["firefox", "chrome"]`
|
|
573
633
|
|
|
574
|
-
### `lock.nativeFunctions`
|
|
575
|
-
|
|
576
|
-
Set of global functions that are native. Such as `require`, `fetch`. If these variables are modified the program crashes.
|
|
577
|
-
Set to `true` to use the default set of native functions. (`string[]/true/false`)
|
|
578
|
-
|
|
579
|
-
- Potency Low
|
|
580
|
-
- Resilience Medium
|
|
581
|
-
- Cost Medium
|
|
582
|
-
|
|
583
634
|
### `lock.selfDefending`
|
|
584
635
|
|
|
585
636
|
Prevents the use of code beautifiers or formatters against your code.
|
|
586
637
|
|
|
587
638
|
[Identical to Obfuscator.io's Self Defending](https://github.com/javascript-obfuscator/javascript-obfuscator#selfdefending)
|
|
588
639
|
|
|
589
|
-
- Potency Low
|
|
590
|
-
- Resilience Low
|
|
591
|
-
- Cost Low
|
|
592
|
-
|
|
593
640
|
### `lock.integrity`
|
|
594
641
|
|
|
595
642
|
Integrity ensures the source code is unchanged. (`true/false/0-1`)
|
|
596
643
|
|
|
597
|
-
[Learn more here](https://github.com/MichaelXF/js-confuser/blob/master/Integrity.md).
|
|
598
|
-
|
|
599
|
-
- Potency Medium
|
|
600
|
-
- Resilience High
|
|
601
|
-
- Cost High
|
|
644
|
+
[Learn more here](https://github.com/MichaelXF/js-confuser/blob/master/docs/Integrity.md).
|
|
602
645
|
|
|
603
646
|
### `lock.countermeasures`
|
|
604
647
|
|
|
605
648
|
A custom callback function to invoke when a lock is triggered. (`string/false`)
|
|
606
649
|
|
|
607
|
-
[Learn more about the countermeasures function](https://github.com/MichaelXF/js-confuser/blob/master/Countermeasures.md).
|
|
650
|
+
[Learn more about the countermeasures function](https://github.com/MichaelXF/js-confuser/blob/master/docs/Countermeasures.md).
|
|
608
651
|
|
|
609
652
|
Otherwise, the obfuscator falls back to crashing the process.
|
|
610
653
|
|
|
@@ -612,26 +655,33 @@ Otherwise, the obfuscator falls back to crashing the process.
|
|
|
612
655
|
|
|
613
656
|
Moves variable declarations to the top of the context. (`true/false`)
|
|
614
657
|
|
|
615
|
-
|
|
616
|
-
|
|
617
|
-
|
|
658
|
+
```js
|
|
659
|
+
// Input
|
|
660
|
+
function getAreaOfCircle(radius) {
|
|
661
|
+
var pi = Math.PI;
|
|
662
|
+
var radiusSquared = Math.pow(radius, 2);
|
|
663
|
+
var area = pi * radiusSquared;
|
|
618
664
|
|
|
619
|
-
|
|
665
|
+
return area;
|
|
666
|
+
}
|
|
620
667
|
|
|
621
|
-
|
|
668
|
+
// Output
|
|
669
|
+
function getAreaOfCircle(yLu5YB1) {
|
|
670
|
+
var eUf7Wle, XVYH4D;
|
|
671
|
+
var F8QuPL = Math["PI"];
|
|
672
|
+
typeof ((eUf7Wle = Math["pow"](yLu5YB1, 2)), (XVYH4D = F8QuPL * eUf7Wle));
|
|
673
|
+
return XVYH4D;
|
|
674
|
+
}
|
|
675
|
+
```
|
|
622
676
|
|
|
623
|
-
|
|
624
|
-
|
|
625
|
-
|
|
677
|
+
### `opaquePredicates`
|
|
678
|
+
|
|
679
|
+
An Opaque Predicate that is evaluated at runtime, this can confuse reverse engineers from understanding your code. (`true/false/0-1`)
|
|
626
680
|
|
|
627
681
|
### `shuffle`
|
|
628
682
|
|
|
629
683
|
Shuffles the initial order of arrays. The order is brought back to the original during runtime. (`"hash"/true/false/0-1`)
|
|
630
684
|
|
|
631
|
-
- Potency Medium
|
|
632
|
-
- Resilience Low
|
|
633
|
-
- Cost Low
|
|
634
|
-
|
|
635
685
|
| Mode | Description |
|
|
636
686
|
| --- | --- |
|
|
637
687
|
| `"hash"`| Array is shifted based on hash of the elements |
|
|
@@ -644,10 +694,6 @@ Local variables are consolidated into a rotating array. (`true/false/0-1`)
|
|
|
644
694
|
|
|
645
695
|
[Similar to Jscrambler's Variable Masking](https://docs.jscrambler.com/code-integrity/documentation/transformations/variable-masking)
|
|
646
696
|
|
|
647
|
-
- Potency Medium
|
|
648
|
-
- Resilience Medium
|
|
649
|
-
- Cost Low
|
|
650
|
-
|
|
651
697
|
```js
|
|
652
698
|
// Input
|
|
653
699
|
function add3(x, y, z){
|
|
@@ -691,7 +737,6 @@ function iVQoGQD(...iVQoGQD){
|
|
|
691
737
|
stringSplitting: 0.75,
|
|
692
738
|
|
|
693
739
|
// Use at own risk
|
|
694
|
-
eval: false,
|
|
695
740
|
rgf: false
|
|
696
741
|
}
|
|
697
742
|
```
|
|
@@ -765,7 +810,6 @@ You must enable locks yourself, and configure them to your needs.
|
|
|
765
810
|
startDate: new Date("Feb 1 2021"),
|
|
766
811
|
endDate: new Date("Mar 1 2021"),
|
|
767
812
|
antiDebug: true,
|
|
768
|
-
nativeFunctions: true,
|
|
769
813
|
|
|
770
814
|
// crashes browser
|
|
771
815
|
countermeasures: true,
|
|
@@ -783,7 +827,6 @@ These features are experimental or a security concern.
|
|
|
783
827
|
```js
|
|
784
828
|
{
|
|
785
829
|
target: "node",
|
|
786
|
-
eval: true, // (security concern)
|
|
787
830
|
rgf: true, // (security concern)
|
|
788
831
|
|
|
789
832
|
// set to false for web-related scripts
|
package/dist/constants.js
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
Object.defineProperty(exports, "__esModule", {
|
|
4
4
|
value: true
|
|
5
5
|
});
|
|
6
|
-
exports.reservedKeywords = exports.reservedIdentifiers = void 0;
|
|
6
|
+
exports.reservedKeywords = exports.reservedIdentifiers = exports.placeholderVariablePrefix = exports.noRenameVariablePrefix = void 0;
|
|
7
7
|
|
|
8
8
|
/**
|
|
9
9
|
* Keywords disallowed for variable names in ES5 and under.
|
|
@@ -15,4 +15,8 @@ const reservedKeywords = new Set(["abstract", "arguments", "await", "boolean", "
|
|
|
15
15
|
|
|
16
16
|
exports.reservedKeywords = reservedKeywords;
|
|
17
17
|
const reservedIdentifiers = new Set(["undefined", "null", "NaN", "Infinity", "eval", "arguments"]);
|
|
18
|
-
exports.reservedIdentifiers = reservedIdentifiers;
|
|
18
|
+
exports.reservedIdentifiers = reservedIdentifiers;
|
|
19
|
+
const noRenameVariablePrefix = "__NO_JS_CONFUSER_RENAME__";
|
|
20
|
+
exports.noRenameVariablePrefix = noRenameVariablePrefix;
|
|
21
|
+
const placeholderVariablePrefix = "__p_";
|
|
22
|
+
exports.placeholderVariablePrefix = placeholderVariablePrefix;
|
package/dist/obfuscator.js
CHANGED
|
@@ -29,8 +29,6 @@ var _calculator = _interopRequireDefault(require("./transforms/calculator"));
|
|
|
29
29
|
|
|
30
30
|
var _controlFlowFlattening = _interopRequireDefault(require("./transforms/controlFlowFlattening/controlFlowFlattening"));
|
|
31
31
|
|
|
32
|
-
var _eval = _interopRequireDefault(require("./transforms/eval"));
|
|
33
|
-
|
|
34
32
|
var _globalConcealing = _interopRequireDefault(require("./transforms/identifier/globalConcealing"));
|
|
35
33
|
|
|
36
34
|
var _stringSplitting = _interopRequireDefault(require("./transforms/string/stringSplitting"));
|
|
@@ -59,8 +57,6 @@ var _flatten = _interopRequireDefault(require("./transforms/flatten"));
|
|
|
59
57
|
|
|
60
58
|
var _stack = _interopRequireDefault(require("./transforms/stack"));
|
|
61
59
|
|
|
62
|
-
var _nameRecycling = _interopRequireDefault(require("./transforms/identifier/nameRecycling"));
|
|
63
|
-
|
|
64
60
|
var _antiTooling = _interopRequireDefault(require("./transforms/antiTooling"));
|
|
65
61
|
|
|
66
62
|
var _finalizer = _interopRequireDefault(require("./transforms/finalizer"));
|
|
@@ -121,7 +117,6 @@ class Obfuscator extends _events.EventEmitter {
|
|
|
121
117
|
test(options.deadCode, _deadCode.default);
|
|
122
118
|
test(options.calculator, _calculator.default);
|
|
123
119
|
test(options.controlFlowFlattening, _controlFlowFlattening.default);
|
|
124
|
-
test(options.eval, _eval.default);
|
|
125
120
|
test(options.globalConcealing, _globalConcealing.default);
|
|
126
121
|
test(options.opaquePredicates, _opaquePredicates.default);
|
|
127
122
|
test(options.stringSplitting, _stringSplitting.default);
|
|
@@ -130,7 +125,6 @@ class Obfuscator extends _events.EventEmitter {
|
|
|
130
125
|
test(options.stack, _stack.default);
|
|
131
126
|
test(options.duplicateLiteralsRemoval, _duplicateLiteralsRemoval.default);
|
|
132
127
|
test(options.shuffle, _shuffle.default);
|
|
133
|
-
test(options.nameRecycling, _nameRecycling.default);
|
|
134
128
|
test(options.movedDeclarations, _movedDeclarations.default);
|
|
135
129
|
test(options.minify, _minify.default);
|
|
136
130
|
test(options.renameVariables, _renameVariables.default);
|