js-confuser 1.7.2 → 2.0.0-alpha.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (263) hide show
  1. package/.github/ISSUE_TEMPLATE/bug_report.md +6 -4
  2. package/.github/workflows/node.js.yml +1 -1
  3. package/CHANGELOG.md +105 -0
  4. package/Migration.md +57 -0
  5. package/README.md +23 -913
  6. package/dist/constants.js +69 -13
  7. package/dist/index.js +108 -152
  8. package/dist/obfuscator.js +316 -118
  9. package/dist/options.js +1 -109
  10. package/dist/order.js +30 -30
  11. package/dist/presets.js +47 -45
  12. package/dist/probability.js +25 -32
  13. package/dist/templates/bufferToStringTemplate.js +9 -0
  14. package/dist/templates/deadCodeTemplates.js +9 -0
  15. package/dist/templates/getGlobalTemplate.js +19 -0
  16. package/dist/templates/integrityTemplate.js +30 -0
  17. package/dist/templates/setFunctionLengthTemplate.js +9 -0
  18. package/dist/templates/stringCompressionTemplate.js +10 -0
  19. package/dist/templates/tamperProtectionTemplates.js +21 -0
  20. package/dist/templates/template.js +213 -93
  21. package/dist/transforms/astScrambler.js +100 -0
  22. package/dist/transforms/calculator.js +70 -127
  23. package/dist/transforms/controlFlowFlattening.js +1182 -0
  24. package/dist/transforms/deadCode.js +62 -577
  25. package/dist/transforms/dispatcher.js +300 -309
  26. package/dist/transforms/extraction/duplicateLiteralsRemoval.js +88 -189
  27. package/dist/transforms/extraction/objectExtraction.js +131 -215
  28. package/dist/transforms/finalizer.js +56 -59
  29. package/dist/transforms/flatten.js +275 -276
  30. package/dist/transforms/functionOutlining.js +230 -0
  31. package/dist/transforms/identifier/globalConcealing.js +217 -103
  32. package/dist/transforms/identifier/movedDeclarations.js +167 -91
  33. package/dist/transforms/identifier/renameVariables.js +240 -187
  34. package/dist/transforms/lock/integrity.js +61 -184
  35. package/dist/transforms/lock/lock.js +263 -303
  36. package/dist/transforms/minify.js +431 -436
  37. package/dist/transforms/opaquePredicates.js +65 -118
  38. package/dist/transforms/pack.js +160 -0
  39. package/dist/transforms/plugin.js +179 -0
  40. package/dist/transforms/preparation.js +263 -163
  41. package/dist/transforms/renameLabels.js +132 -56
  42. package/dist/transforms/rgf.js +142 -240
  43. package/dist/transforms/shuffle.js +52 -145
  44. package/dist/transforms/string/encoding.js +45 -173
  45. package/dist/transforms/string/stringCompression.js +81 -126
  46. package/dist/transforms/string/stringConcealing.js +189 -224
  47. package/dist/transforms/string/stringEncoding.js +32 -40
  48. package/dist/transforms/string/stringSplitting.js +54 -55
  49. package/dist/transforms/variableMasking.js +232 -0
  50. package/dist/utils/ControlObject.js +125 -0
  51. package/dist/utils/IntGen.js +46 -0
  52. package/dist/utils/NameGen.js +106 -0
  53. package/dist/utils/ast-utils.js +560 -0
  54. package/dist/utils/function-utils.js +56 -0
  55. package/dist/utils/gen-utils.js +48 -0
  56. package/dist/utils/node.js +77 -0
  57. package/dist/utils/object-utils.js +21 -0
  58. package/dist/utils/random-utils.js +91 -0
  59. package/dist/utils/static-utils.js +64 -0
  60. package/dist/validateOptions.js +122 -0
  61. package/index.d.ts +1 -17
  62. package/package.json +27 -22
  63. package/src/constants.ts +139 -77
  64. package/src/index.ts +70 -163
  65. package/src/obfuscationResult.ts +43 -0
  66. package/src/obfuscator.ts +328 -135
  67. package/src/options.ts +154 -623
  68. package/src/order.ts +14 -14
  69. package/src/presets.ts +39 -34
  70. package/src/probability.ts +21 -36
  71. package/src/templates/{bufferToString.ts → bufferToStringTemplate.ts} +5 -54
  72. package/src/templates/deadCodeTemplates.ts +1185 -0
  73. package/src/templates/getGlobalTemplate.ts +72 -0
  74. package/src/templates/integrityTemplate.ts +69 -0
  75. package/src/templates/setFunctionLengthTemplate.ts +11 -0
  76. package/src/templates/stringCompressionTemplate.ts +42 -0
  77. package/src/templates/tamperProtectionTemplates.ts +116 -0
  78. package/src/templates/template.ts +183 -92
  79. package/src/transforms/astScrambler.ts +99 -0
  80. package/src/transforms/calculator.ts +96 -224
  81. package/src/transforms/controlFlowFlattening.ts +1594 -0
  82. package/src/transforms/deadCode.ts +85 -628
  83. package/src/transforms/dispatcher.ts +431 -636
  84. package/src/transforms/extraction/duplicateLiteralsRemoval.ts +147 -299
  85. package/src/transforms/extraction/objectExtraction.ts +160 -333
  86. package/src/transforms/finalizer.ts +63 -64
  87. package/src/transforms/flatten.ts +439 -557
  88. package/src/transforms/functionOutlining.ts +225 -0
  89. package/src/transforms/identifier/globalConcealing.ts +261 -189
  90. package/src/transforms/identifier/movedDeclarations.ts +228 -142
  91. package/src/transforms/identifier/renameVariables.ts +252 -258
  92. package/src/transforms/lock/integrity.ts +84 -260
  93. package/src/transforms/lock/lock.ts +342 -491
  94. package/src/transforms/minify.ts +523 -663
  95. package/src/transforms/opaquePredicates.ts +90 -229
  96. package/src/transforms/pack.ts +195 -0
  97. package/src/transforms/plugin.ts +185 -0
  98. package/src/transforms/preparation.ts +337 -215
  99. package/src/transforms/renameLabels.ts +176 -77
  100. package/src/transforms/rgf.ts +293 -386
  101. package/src/transforms/shuffle.ts +80 -254
  102. package/src/transforms/string/encoding.ts +26 -129
  103. package/src/transforms/string/stringCompression.ts +118 -236
  104. package/src/transforms/string/stringConcealing.ts +255 -339
  105. package/src/transforms/string/stringEncoding.ts +28 -47
  106. package/src/transforms/string/stringSplitting.ts +61 -75
  107. package/src/transforms/variableMasking.ts +257 -0
  108. package/src/utils/ControlObject.ts +141 -0
  109. package/src/utils/IntGen.ts +33 -0
  110. package/src/utils/NameGen.ts +106 -0
  111. package/src/utils/ast-utils.ts +667 -0
  112. package/src/utils/function-utils.ts +50 -0
  113. package/src/utils/gen-utils.ts +48 -0
  114. package/src/utils/node.ts +78 -0
  115. package/src/utils/object-utils.ts +21 -0
  116. package/src/utils/random-utils.ts +79 -0
  117. package/src/utils/static-utils.ts +66 -0
  118. package/src/validateOptions.ts +256 -0
  119. package/tsconfig.json +13 -8
  120. package/babel.config.js +0 -12
  121. package/dev.js +0 -8
  122. package/dist/compiler.js +0 -34
  123. package/dist/parser.js +0 -59
  124. package/dist/precedence.js +0 -66
  125. package/dist/templates/bufferToString.js +0 -108
  126. package/dist/templates/crash.js +0 -59
  127. package/dist/templates/es5.js +0 -137
  128. package/dist/templates/functionLength.js +0 -34
  129. package/dist/templates/globals.js +0 -9
  130. package/dist/transforms/antiTooling.js +0 -88
  131. package/dist/transforms/controlFlowFlattening/controlFlowFlattening.js +0 -1281
  132. package/dist/transforms/controlFlowFlattening/expressionObfuscation.js +0 -131
  133. package/dist/transforms/es5/antiClass.js +0 -164
  134. package/dist/transforms/es5/antiDestructuring.js +0 -193
  135. package/dist/transforms/es5/antiES6Object.js +0 -185
  136. package/dist/transforms/es5/antiSpreadOperator.js +0 -35
  137. package/dist/transforms/es5/antiTemplate.js +0 -66
  138. package/dist/transforms/es5/es5.js +0 -123
  139. package/dist/transforms/extraction/classExtraction.js +0 -83
  140. package/dist/transforms/identifier/globalAnalysis.js +0 -70
  141. package/dist/transforms/identifier/variableAnalysis.js +0 -104
  142. package/dist/transforms/lock/antiDebug.js +0 -76
  143. package/dist/transforms/stack.js +0 -343
  144. package/dist/transforms/transform.js +0 -350
  145. package/dist/traverse.js +0 -110
  146. package/dist/util/compare.js +0 -145
  147. package/dist/util/gen.js +0 -564
  148. package/dist/util/guard.js +0 -9
  149. package/dist/util/identifiers.js +0 -355
  150. package/dist/util/insert.js +0 -362
  151. package/dist/util/math.js +0 -19
  152. package/dist/util/object.js +0 -40
  153. package/dist/util/random.js +0 -130
  154. package/dist/util/scope.js +0 -20
  155. package/docs/ControlFlowFlattening.md +0 -595
  156. package/docs/Countermeasures.md +0 -63
  157. package/docs/ES5.md +0 -197
  158. package/docs/Integrity.md +0 -75
  159. package/docs/RGF.md +0 -419
  160. package/samples/example.js +0 -15
  161. package/samples/high.js +0 -1
  162. package/samples/input.js +0 -3
  163. package/samples/javascriptobfuscator.com.js +0 -8
  164. package/samples/jscrambler_advanced.js +0 -1894
  165. package/samples/jscrambler_light.js +0 -1134
  166. package/samples/low.js +0 -1
  167. package/samples/medium.js +0 -1
  168. package/samples/obfuscator.io.js +0 -1686
  169. package/samples/preemptive.com.js +0 -16
  170. package/src/compiler.ts +0 -35
  171. package/src/parser.ts +0 -49
  172. package/src/precedence.ts +0 -61
  173. package/src/templates/crash.ts +0 -55
  174. package/src/templates/es5.ts +0 -131
  175. package/src/templates/functionLength.ts +0 -32
  176. package/src/templates/globals.ts +0 -3
  177. package/src/transforms/antiTooling.ts +0 -102
  178. package/src/transforms/controlFlowFlattening/controlFlowFlattening.ts +0 -2146
  179. package/src/transforms/controlFlowFlattening/expressionObfuscation.ts +0 -179
  180. package/src/transforms/es5/antiClass.ts +0 -272
  181. package/src/transforms/es5/antiDestructuring.ts +0 -294
  182. package/src/transforms/es5/antiES6Object.ts +0 -267
  183. package/src/transforms/es5/antiSpreadOperator.ts +0 -56
  184. package/src/transforms/es5/antiTemplate.ts +0 -98
  185. package/src/transforms/es5/es5.ts +0 -149
  186. package/src/transforms/extraction/classExtraction.ts +0 -168
  187. package/src/transforms/identifier/globalAnalysis.ts +0 -85
  188. package/src/transforms/identifier/variableAnalysis.ts +0 -118
  189. package/src/transforms/lock/antiDebug.ts +0 -112
  190. package/src/transforms/stack.ts +0 -551
  191. package/src/transforms/transform.ts +0 -453
  192. package/src/traverse.ts +0 -120
  193. package/src/types.ts +0 -131
  194. package/src/util/compare.ts +0 -181
  195. package/src/util/gen.ts +0 -651
  196. package/src/util/guard.ts +0 -7
  197. package/src/util/identifiers.ts +0 -494
  198. package/src/util/insert.ts +0 -419
  199. package/src/util/math.ts +0 -15
  200. package/src/util/object.ts +0 -39
  201. package/src/util/random.ts +0 -141
  202. package/src/util/scope.ts +0 -21
  203. package/test/code/Cash.src.js +0 -1011
  204. package/test/code/Cash.test.ts +0 -49
  205. package/test/code/Dynamic.src.js +0 -118
  206. package/test/code/Dynamic.test.ts +0 -49
  207. package/test/code/ES6.src.js +0 -235
  208. package/test/code/ES6.test.ts +0 -42
  209. package/test/code/NewFeatures.test.ts +0 -19
  210. package/test/code/StrictMode.src.js +0 -65
  211. package/test/code/StrictMode.test.js +0 -37
  212. package/test/compare.test.ts +0 -104
  213. package/test/index.test.ts +0 -249
  214. package/test/options.test.ts +0 -132
  215. package/test/presets.test.ts +0 -22
  216. package/test/probability.test.ts +0 -44
  217. package/test/templates/template.test.ts +0 -14
  218. package/test/transforms/antiTooling.test.ts +0 -52
  219. package/test/transforms/calculator.test.ts +0 -78
  220. package/test/transforms/controlFlowFlattening/controlFlowFlattening.test.ts +0 -1274
  221. package/test/transforms/controlFlowFlattening/expressionObfuscation.test.ts +0 -192
  222. package/test/transforms/deadCode.test.ts +0 -85
  223. package/test/transforms/dispatcher.test.ts +0 -457
  224. package/test/transforms/es5/antiClass.test.ts +0 -427
  225. package/test/transforms/es5/antiDestructuring.test.ts +0 -157
  226. package/test/transforms/es5/antiES6Object.test.ts +0 -245
  227. package/test/transforms/es5/antiTemplate.test.ts +0 -116
  228. package/test/transforms/es5/es5.test.ts +0 -110
  229. package/test/transforms/extraction/classExtraction.test.ts +0 -86
  230. package/test/transforms/extraction/duplicateLiteralsRemoval.test.ts +0 -200
  231. package/test/transforms/extraction/objectExtraction.test.ts +0 -491
  232. package/test/transforms/flatten.test.ts +0 -721
  233. package/test/transforms/hexadecimalNumbers.test.ts +0 -62
  234. package/test/transforms/identifier/globalConcealing.test.ts +0 -72
  235. package/test/transforms/identifier/movedDeclarations.test.ts +0 -275
  236. package/test/transforms/identifier/renameVariables.test.ts +0 -621
  237. package/test/transforms/lock/antiDebug.test.ts +0 -66
  238. package/test/transforms/lock/browserLock.test.ts +0 -129
  239. package/test/transforms/lock/countermeasures.test.ts +0 -100
  240. package/test/transforms/lock/integrity.test.ts +0 -161
  241. package/test/transforms/lock/lock.test.ts +0 -204
  242. package/test/transforms/lock/osLock.test.ts +0 -312
  243. package/test/transforms/lock/selfDefending.test.ts +0 -68
  244. package/test/transforms/minify.test.ts +0 -575
  245. package/test/transforms/opaquePredicates.test.ts +0 -43
  246. package/test/transforms/preparation.test.ts +0 -157
  247. package/test/transforms/renameLabels.test.ts +0 -95
  248. package/test/transforms/rgf.test.ts +0 -378
  249. package/test/transforms/shuffle.test.ts +0 -135
  250. package/test/transforms/stack.test.ts +0 -573
  251. package/test/transforms/string/stringCompression.test.ts +0 -120
  252. package/test/transforms/string/stringConcealing.test.ts +0 -299
  253. package/test/transforms/string/stringEncoding.test.ts +0 -95
  254. package/test/transforms/string/stringSplitting.test.ts +0 -135
  255. package/test/transforms/transform.test.ts +0 -66
  256. package/test/traverse.test.ts +0 -139
  257. package/test/util/compare.test.ts +0 -34
  258. package/test/util/gen.test.ts +0 -121
  259. package/test/util/identifiers.test.ts +0 -253
  260. package/test/util/insert.test.ts +0 -142
  261. package/test/util/math.test.ts +0 -5
  262. package/test/util/random.test.ts +0 -71
  263. /package/dist/{types.js → obfuscationResult.js} +0 -0
package/docs/ES5.md DELETED
@@ -1,197 +0,0 @@
1
- ## `ES5`
2
-
3
- The ES5 option converts most ES6+ features into ES5 compatible code.
4
-
5
- Option name: `es5`
6
-
7
- Option values: `true/false`
8
-
9
- Note: Does not cover all cases such as Promises or Generator functions. Use [Babel](https://babel.dev/).
10
-
11
- The ES5 option is intended to undo any ES6 feature the obfuscator adds to your code. If you input ES5 code, and enable the `es5` option, you can be guaranteed to have ES5 compatible output.
12
-
13
- ## Example
14
-
15
- ```js
16
- // Input
17
- function print(...messages){
18
- console.log(...messages); // The spread operator (...)
19
- // was introduced in ES6!
20
- }
21
-
22
- print("Hello", "World"); // "Hello World"
23
-
24
- // Output
25
- var __p_2580918143;
26
- function print() {
27
- var __p_7607361496;
28
- var messages, __p_2591841272 = (__p_7607361496 = Array.prototype.slice.call(arguments), messages = __p_7607361496.slice(0));
29
- (__p_2580918143 = console).log.apply(__p_2580918143, [].concat(Array.prototype.slice.call(messages)));
30
- }
31
- print('Hello', 'World'); // "Hello World"
32
- ```
33
-
34
- ## Polyfill Array Methods
35
-
36
- When the ES5 option is enabled, array method polyfills will be injected to the top of your script.
37
-
38
- ```js
39
- if (!Array.prototype.forEach) {
40
- Array.prototype.forEach = function forEach(callback, thisArg) {
41
- if (typeof callback !== 'function') {
42
- throw new TypeError(callback + ' is not a function');
43
- }
44
- var array = this;
45
- thisArg = thisArg || this;
46
- for (var i = 0, l = array.length; i !== l; ++i) {
47
- callback.call(thisArg, array[i], i, array);
48
- }
49
- };
50
- }
51
- ```
52
-
53
- ## Destructuring
54
-
55
- The ES5 option supports transpiling the destructuring patterns.
56
-
57
- ```js
58
- // Input
59
- var {userName, email} = { userName: "John", email: "email@exampe.com" };
60
-
61
- // Output
62
- var __p_7467473759;
63
- var userName, email, __p_4755992742 = (__p_7467473759 = {
64
- userName: 'John',
65
- email: 'email@exampe.com'
66
- }, userName = __p_7467473759.userName, email = __p_7467473759.email);
67
- ```
68
-
69
- ## Spread Operator
70
-
71
- The ES5 option supports transpiling the spread operator.
72
-
73
- ```js
74
- // Input
75
- array.push(...objects);
76
-
77
- // Output
78
- var __p_6344935930;
79
- (__p_6344935930 = array).push.apply(__p_6344935930, [].concat(Array.prototype.slice.call(objects)));
80
- ```
81
-
82
- ## Template String
83
-
84
- The ES5 option supports transpiling template strings.
85
-
86
- ```js
87
- // Input
88
- var myString = `Hello ${userName}`;
89
-
90
- // Output
91
- var myString = 'Hello ' + (userName + '');
92
- ```
93
-
94
- ## Object getters/setters
95
-
96
- The ES5 option supports transpiling getter and setter methods.
97
-
98
- ```js
99
- // Input
100
- var _name;
101
- var myObject = {
102
- get name(){
103
- return _name;
104
- },
105
- set name(newName){
106
- _name = newName;
107
- }
108
- };
109
-
110
- // Output
111
- function __p_6886881506(base, computedProps, getters, setters) {
112
- for (var i = 0; i < computedProps.length; i++) {
113
- base[computedProps[i][0]] = computedProps[i][1];
114
- }
115
- var keys = Object.create(null);
116
- Object.keys(getters).forEach(function (key) {
117
- return keys[key] = 1;
118
- });
119
- Object.keys(setters).forEach(function (key) {
120
- return keys[key] = 1;
121
- });
122
- Object.keys(keys).forEach(function (key) {
123
- Object.defineProperty(base, key, {
124
- set: setters[key],
125
- get: getters[key],
126
- configurable: true
127
- });
128
- });
129
- return base;
130
- }
131
- var _name;
132
- var myObject = __p_6886881506({}, [], {
133
- 'name': function () {
134
- return _name;
135
- }
136
- }, {
137
- 'name': function (newName) {
138
- _name = newName;
139
- }
140
- });
141
- ```
142
-
143
- ## Arrow Functions
144
-
145
- The ES5 option converts arrow functions into regular functions.
146
-
147
- ```js
148
- // Input
149
- var print = message => console.log(message);
150
-
151
- // Output
152
- var print = function (message) {
153
- return console.log(message);
154
- };
155
- ```
156
-
157
- ## Const/Let
158
-
159
- The ES5 option converts `const` and `let` to a regular `var` keyword.
160
-
161
- ```js
162
- // Input
163
- let myVar1 = true;
164
- const myVar2 = "String";
165
-
166
- // Output
167
- var myVar1 = true;
168
- var myVar2 = 'String';
169
- ```
170
-
171
- ## Classes
172
-
173
- The ES5 option partially supports transpiling classes.
174
-
175
- ## Reserved Identifiers
176
-
177
- The ES5 option will change any illegal uses of reserved identifiers.
178
-
179
- ```js
180
- // Input
181
- var myObject = {true: 1};
182
- myObject.for = true;
183
-
184
- // Output
185
- var myObject = {"true": 1};
186
- myObject["for"] = true;
187
- ```
188
-
189
- ## Features not supported
190
-
191
- - Promises
192
- - Async / Await
193
- - Generator functions
194
- - Nullish coalescing
195
- - Optional chaining
196
-
197
- Use [Babel](https://babel.dev/) to transpile these features. JS-Confuser will only support features the obfuscator may potentially add to your code.
package/docs/Integrity.md DELETED
@@ -1,75 +0,0 @@
1
- ## `Integrity`
2
-
3
- JSConfuser can detect changes to the source and prevent execution.
4
-
5
- If the code is determined modified, the tampered code will not run.
6
-
7
- ## Usage
8
-
9
- ```js
10
- var JsConfuser = require("js-confuser");
11
-
12
- JsConfuser.obfuscate("console.log(1)", {
13
- target: "browser",
14
- lock: {
15
- integrity: true,
16
- },
17
- }).then((obfuscated) => {
18
- console.log(obfuscated);
19
- });
20
- ```
21
-
22
- ## CLI Usage
23
-
24
- ```shell
25
- <coming soon>
26
- ```
27
-
28
- ## Example
29
-
30
- Consider the following code:
31
-
32
- ```js
33
- console.log(1)
34
- ```
35
-
36
- The output:
37
-
38
- ```
39
- > 1
40
- ```
41
-
42
- The obfuscated code (from Usage):
43
-
44
- ```js
45
- (function(){var jXwFUz=Math.imul||function(jXwFUz,m9pBnlk){m9pBnlk|=0;var n1mfO$O=(jXwFUz&4194303)*m9pBnlk;if(jXwFUz&4290772992)n1mfO$O+=(jXwFUz&4290772992)*m9pBnlk|0;return n1mfO$O|0};function m9pBnlk(n1mfO$O,humOEA){var DGCgjl=3735928559^humOEA;var S$63Fy1=1103547991^humOEA;for(var Lop2FFS=0,GC2VbAQ;Lop2FFS<n1mfO$O.length;Lop2FFS++){GC2VbAQ=n1mfO$O.charCodeAt(Lop2FFS);DGCgjl=jXwFUz(DGCgjl^GC2VbAQ,2654435761);S$63Fy1=jXwFUz(S$63Fy1^GC2VbAQ,1597334677)}DGCgjl=jXwFUz(DGCgjl^DGCgjl>>>16,2246822507)^jXwFUz(S$63Fy1^S$63Fy1>>>13,3266489909);S$63Fy1=jXwFUz(S$63Fy1^S$63Fy1>>>16,2246822507)^jXwFUz(DGCgjl^DGCgjl>>>13,3266489909);return 4294967296*(2097151&S$63Fy1)+(DGCgjl>>>0)}function n1mfO$O(jXwFUz){return jXwFUz.toString().replace(/ |\n|;|,|\{|\}|\(|\)/g,'')}function y3EzuX9(){console['log'](1)}var yzLesc=m9pBnlk(n1mfO$O(y3EzuX9),957);if(yzLesc==0x7a77799eaf937){return y3EzuX9.apply(this,arguments)}}())
46
- ```
47
-
48
- The output:
49
- ```
50
- > 1
51
- ```
52
-
53
- Since only Integrity is enabled, it's pretty easy to find the original code: `console['log'](1)`.
54
-
55
- Let's try to change the `console['log'](1)` to `console['log'](2)`:
56
-
57
- ```js
58
- (function(){var jXwFUz=Math.imul||function(jXwFUz,m9pBnlk){m9pBnlk|=0;var n1mfO$O=(jXwFUz&4194303)*m9pBnlk;if(jXwFUz&4290772992)n1mfO$O+=(jXwFUz&4290772992)*m9pBnlk|0;return n1mfO$O|0};function m9pBnlk(n1mfO$O,humOEA){var DGCgjl=3735928559^humOEA;var S$63Fy1=1103547991^humOEA;for(var Lop2FFS=0,GC2VbAQ;Lop2FFS<n1mfO$O.length;Lop2FFS++){GC2VbAQ=n1mfO$O.charCodeAt(Lop2FFS);DGCgjl=jXwFUz(DGCgjl^GC2VbAQ,2654435761);S$63Fy1=jXwFUz(S$63Fy1^GC2VbAQ,1597334677)}DGCgjl=jXwFUz(DGCgjl^DGCgjl>>>16,2246822507)^jXwFUz(S$63Fy1^S$63Fy1>>>13,3266489909);S$63Fy1=jXwFUz(S$63Fy1^S$63Fy1>>>16,2246822507)^jXwFUz(DGCgjl^DGCgjl>>>13,3266489909);return 4294967296*(2097151&S$63Fy1)+(DGCgjl>>>0)}function n1mfO$O(jXwFUz){return jXwFUz.toString().replace(/ |\n|;|,|\{|\}|\(|\)/g,'')}function y3EzuX9(){console['log'](2)}var yzLesc=m9pBnlk(n1mfO$O(y3EzuX9),957);if(yzLesc==0x7a77799eaf937){return y3EzuX9.apply(this,arguments)}}())
59
- ```
60
-
61
- The program no longer outputs anything. Integrity detected the change and stopped execution.
62
-
63
- ## How is this possible?
64
-
65
- JavaScript has a sneaky method to view the source code any function. Calling `.toString()` on any function reveals the raw source code.
66
- Integrity hashes the code during obfuscation phase and embeds an IF-statement within the code. We used an additional regex to remove spaces, newlines, braces,
67
- and commas to ensure the hash isn't too sensitive.
68
-
69
- ## Potential Issues
70
-
71
- If you decide to use Integrity, consider the following:
72
-
73
- 1. Any build-tools must not modify the locked code. The code can't be changed after JsConfuser runs.
74
- 2. `.toString()` functionality may not be enabled in your environment (bytenode)
75
-
package/docs/RGF.md DELETED
@@ -1,419 +0,0 @@
1
- ## `RGF`
2
-
3
- RGF (Runtime-Generated-Functions) uses the [`new Function(code...)`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/Function) syntax to construct executable code from strings. (`true/false/0-1`)
4
-
5
- - **This can break your code.**
6
- - **Due to the security concerns of arbitrary code execution, you must enable this yourself.**
7
- - The arbitrary code is also obfuscated.
8
-
9
- Option name: `rgf`
10
-
11
- Option values: `true/false/0-1`
12
-
13
- Note: RGF will only apply to functions that do not rely on any outside-scoped variables. Enable `flatten` along with `rgf` to apply to these functions.
14
-
15
- Note: Does not apply to arrow, async, or generator functions.
16
-
17
- Use a number to control the percentage of functions changed.
18
-
19
- ```js
20
- // Input
21
- function printToConsole(message){
22
- console.log(message);
23
- }
24
-
25
- printToConsole("Hello World"); // "Hello World"
26
-
27
- // Output
28
- var Ricvq8s = [new Function('function HIGRHaD(ANVivo_){console[\'log\'](ANVivo_)}return HIGRHaD[\'apply\'](this,arguments)')];
29
- function uhj6obs() {
30
- return Ricvq8s[0]['apply'](this, arguments);
31
- }
32
- uhj6obs('Hello World'); // "Hello World"
33
- ```
34
-
35
- ## With `Flatten`
36
-
37
- Enable `flatten` with `rgf` to apply to functions that rely on outside-scoped variables.
38
-
39
- Flatten is able to isolate functions from their scope so then RGF can then apply on them.
40
-
41
- ```js
42
- {
43
- target: "node",
44
- rgf: true,
45
- flatten: true
46
- }
47
- ```
48
-
49
- ```js
50
- // Input
51
- var outsideVariable = 0;
52
- function incrementOutsideVariable(){
53
- outsideVariable++;
54
- }
55
-
56
- incrementOutsideVariable(); // outsideVariable = 1
57
- incrementOutsideVariable(); // outsideVariable = 2
58
- incrementOutsideVariable(); // outsideVariable = 3
59
-
60
- console.log(outsideVariable); // 3
61
-
62
- // Output
63
- var J3NLZFR = [
64
- new Function(
65
- "function Q7Rh6l([],reFzsi){reFzsi['XaBIEIZ']++}return Q7Rh6l['apply'](this,arguments)"
66
- ),
67
- ];
68
- function pCG9mH() {
69
- return J3NLZFR[0]["apply"](this, arguments);
70
- }
71
- var outsideVariable = 0;
72
- function incrementOutsideVariable(...muLxIC) {
73
- var udg38ch = {
74
- set ["XaBIEIZ"](H5p1op) {
75
- outsideVariable = H5p1op;
76
- },
77
- get ["XaBIEIZ"]() {
78
- return outsideVariable;
79
- },
80
- };
81
- return pCG9mH(muLxIC, udg38ch);
82
- }
83
- !(incrementOutsideVariable(),
84
- incrementOutsideVariable(),
85
- incrementOutsideVariable(),
86
- console["log"](outsideVariable)); // 3
87
- ```
88
-
89
- ## With `String Concealing`
90
-
91
- Enable `stringConcealing` to encrypt the `new Function(code)` code string.
92
-
93
- ```js
94
- // Input
95
- function add(x, y){
96
- return x + y;
97
- }
98
-
99
- console.log(add(5, 10)); // 15
100
-
101
- // Output
102
- var MAKh7o = [],
103
- BCG3CXC = 0,
104
- W33d4e = (function () {
105
- var To7ztdg = [
106
- "n%v2do>o/Ro<B",
107
- "ad/z~7_MP#]yCZ(ZlG2Hr@3B3UuHQbXj~7$GZ7w@h#g<J9G",
108
- ']+=c$.zNPP+/G9BY1G$x3_M+]8EU"[XpkwUdV^QC!Pk.XbK',
109
- "Hd8=l@<:%59/L]J",
110
- "u)jdloP1|6k.*Z}iV5UHt#[z<IW31wwn{nnEkj5vyJ",
111
- "@4P0goQYcRNlUD",
112
- '"!>fj>~p!It3M^hX',
113
- ".t)F;!&u)J?+gEFe4zAz;3A",
114
- ":!><}7qC*2i.2xI",
115
- "&2rd(iQYsRJ2ID",
116
- 'H)?/f2lvs4KinCkR]Db.znuuY%"uk,Uorf`yo2:M97n',
117
- 'KEFK73EeT2m/77Hg,i&Fu#qePMp{Lv(mUzf0v+Jj6U<xhQQn%XM,d^jN%yh*ZFAe>]w;Uvz`Y3G.Z*ClC:?<HwU6g&?E(u+NFEgbL^YI]GJ3nv$Y:"29ZXRipw(wD7=!xS!lPaRi{Z{^EqU2#@lZ3dJuX2@y4@AV{PWlCMszhDm#]eh5G)*[|ja2D:rZ%#L0BJ(u+N"i`Km]2MyTQUO[8Lx7<fY<L|%Te.{+;T@z/z!=86D8fO+*FYg%(:Ef5?L7Y{LntO|LE:?,V[GUY?sQWq>iPeI!Y{DJU3$@Qcf<Kz`m/#F(g!jmFTG&ywX,Zj0T1c>[vP0/oxJk>oCPL?G*aWmUk,(y0CG62t6[)gaz^I3]Z[$yVRra,S7!Hc!i6CAP4m&BRn_URI{c]GlN07361pmfja!i6CAPo{CN/US8U==[${lT,r|]7j}UD=U*7*K0T^4b$q"z^I3]Z[$yp!kbWi|?p>P:_Y2$E`~.8jcB9c!=!Yy#c%x@Moi5e39=TXi#c.~MLOD]Wf=[RvK0U6myWoa=zg>[;NmTd/<P1o:JzI{*bv.!T^a9_o_zU=W}[;FWGvCFph(UE=U*7*|N47Tm_o@|[;c,`pE$nwaxTOU?p>W}FjMR6t{]8d5)VKU,0{8!@+q[wh[i/2s)+{ZR50ixOg#4]I^[5ds!Wz|a?N~<[go@J`+9M6>x=Tgzzgh`(`+9p!kbWijr71d,!YI9)dN.`onDF3w)Eqj9Z<,alLX}ecF.ieL%`r|]Km=GzI>3m6<!!/,]XXPSufp@A:nKGvCFpht2V3O:/p/3LsyxQn[DE=M*qerR4msj]o0aU=$bz*[&2/ZQ;mI=[go@J`+9!+ZQ!q@|[;V<#NLR#V;a8jg5y;:t*NN!v3Jx+rgzzgh`FjMR6tOyCknDF3w)PZ1$2/a9{j9o(IP:T[K0T^pQUo44!H{*+G+K70WFph>DF3w)9v6IE?zj0p$z>vM{bTs7a6q[whQ5zg7=O$^G[+O9$XrM^Ia>H[r%Apry0ht2V3O:/pH981.^rmWX01nv{Y<!ApL+YiXBCdmvb*7Lj{Y8?UdP(gt@mC}!f%ixHl3oG,b>"M#1b6_.YiXB)H%n!6#1l!#bof)%vE5pUIKU&::ZmlaXYeg9<{a!A.,]CmtoIJq/A:nK$#TO<a>cy;F<"@QS]4"50Vs<t<r@6iMR6t(7?nZJ):Er{!`6r*Kl_ci?:=):%p$Mr^zj8pt,[;RkS:f8$V0PuoSrlf*1&M(2%8=lAl5Xk3@!rpEJ8_`N7R_Z;K6_A@%#?rT+nlR}A>[h@eG$909MBke!>fF(tTrIM{$YASl<+H%n!6#1d{Z*nlR}A>[h%R814_O+9rOr"z&im$|6r*Kl_cyfba~aGSC(o!e9jLDSzw?:g{"%.(]68R[+M,U!7viTu*o8NOndi;{^LB&z:::uQVQz^Kb9<{a!A.,]4jAj_y]m<!iQP<tNOVy!n>b>"M#13m)7?nZJ):jeI:(GD.*9KmePgZC.Z`+92/ZQ;mI=qwp@1;>4WzpENnxo)=u%.!yPn?fbiR5]xw?:g{"%.(o@sOn?dEh|Yo1$Xw_jOg`O}JevRp30CpS*ASU?.bbj(ve8$V0PuoSrlf*1&M(2%83,DT@ZaFNmKq1$Xw_jOg`O}JevRp30CpS*ASoPE=f,eIFHX?"*ml)|kyBkh`:!tRqZpTF]AbC}+:>4dRmZNgot<=p/A:IH"g?mmS9<*H%n!6#1cpryVO~%(=<kd#wPn?fbiR5]kyM{bTs7a6+BdqAo>f{&xzW0B,qxbp6o>v><JHmNo7,]dlxaU=u%Yo[zC{uFrOwRe3_*R11T4t>Cfkqr)aecU684N3zOcrDSyDm`2e1T0t{]8d5)VKU,0{8!@+&5wVu7$Jc,@0m$RzW*lNX}^d9_FZ:!7&98Uol<zg>[;NmT@$U^lLX}^d9_FZ:!7&98Uo*Zw;n+JT1T20"5ROZPtK]&UevS)/&NQoGE9K$!@Mi2DQGNBs?i7g,WGkJH:@S9PnLB@;9uekB#@+&5wVu7$Jc,@0m$RzW*lNX}ecF.ieL%T^a9_o_z$J]&fN4UB2|aOgcR0=|<A:J0yOQ7akNaw;![dTpUb64^=NwX{Z][j;@2@5*9KmeP>3f,!eLU4tOyCknDF3w)PZ1$2/CFgfoGS.C1E:FWK;3m_ogr$J^v0:d7!#xE{dEdUK1]^*mUrOCFubl<zg>[;NmT%dPa[oY8M=#[[5IUAUBc9jg8G3/WLHU$aK0^Mg)tQh_*:6J0~5IE=oqaNKf)[p7%60>x2ol<sf!=!Yy#c%Qj,f[t+xmc>Y_54EtQcrarU=[[eG#Iei4bzVWDf/AwZjwMFNCl;aVo}GR5!S<7lf<Dmf/DP<2+~jQSW6nmLm1o.J,?jTs%2<WF%qguexAkZdx2G?*NgMqOgD{c:!*Hh&ckQVG`yFQ$:@*Qv^&9rsGU%.e>bTrUu+Rwxn"fUd2b)!G0&/rO8XH@p>wb.!p!c%HylL~%/gt;_:HUx/$^)lUoBg6=+Yi#yxl.1oZBsHI!LBv&Z{Y8?UXPVK`/{Y,$zL#C:UXPVK&y}S74>P#C:UXPVKi]lvPSdR07]Pt<t<r@k);R7t{]$S#wyg_h#`(2jVHaXV~%/gt;9#)9=:&OSomfM,|*T[aU7tQQ:aE5`0MrKIdS5/M,~kqM^I[3XvGUx/$^)l.<[;mlhHK%Q6=NBkpt)FNyl5R8M{{6aR[I/2@[H[7%x^M.SO>la;x4z#2K`599sm8UGH|0fBuLYK/YheoPE=f,TZgV80l.SO>la;x4z#40=(@vGZ%/20So2)t#)/RQkZ{]/gR!YCn6/_6CuhRG,/Nf~`CJTKGluVv74J!.Z*VN~>lNcR=_`Eqs|RW3l/zjWjQ=(gJ?4{AS*dQDFSC:#0[>pThS[5]xxnMXiwll/z+0!&KFSUR`}byn~t*9ID[k_PR)LaD__0G$:4`[FSmU5z=m.!4%gixE<al]raE}j1AS+:/Efk6i5z:f%z8&%L6lScE&GE2]xvJH[5]xxnMXnh~<dpMO[P8vkZt2e/`08i;1<:G6Xoi5e39=eGw8b.sD(Zv7gGKkC6j8C{*8<mg5,<8=1R)$|#ix/f1/#<|<Z;tVm@^O^pAjl,6ui:g8c!#PBSfrrdIro6LOU<9xiZ4ti=/<(`g83/XvNbl<Z2lcHN]2+g7OcrdP(gt@mCc&i*sQ@aSrQe/k5X16Ub^CObwl$eOrrBh&;x4bRO=Xbgv)|5;0jb`@[nOauhV<8e$yC2CNgdW%}JEd2$&5:(#^km:+<d;^A+l9cm$PBSfrrddc}orI~=EQwP=Xbgv)|5@Vlb^CObwl$ev@&Y7Ue%9MgdW%}Jvs#v2$Bv]ZPgt%VE"ma$f&i*sQ@a3]6.k9iYAJ0Sva(k.lGfB{z*@V{a^CObwljF)yTB($2#va(k.lGfB{z*.!E.f^@bHak,k9iYAJ0Sva(k.lGfB{R;5OM?O]Rb;n$x!6EYGQ`4O9Xi"/%e{c)C',
118
- "Hu@Jk`A",
119
- "jrIJ",
120
- ];
121
- return BCG3CXC ? To7ztdg["pop"]() : BCG3CXC++, To7ztdg;
122
- })();
123
- function __getGlobal() {
124
- try {
125
- return global || window || new Function("return this")();
126
- } catch (e) {
127
- try {
128
- return this;
129
- } catch (e) {
130
- return {};
131
- }
132
- }
133
- }
134
- var __globalObject = __getGlobal() || {};
135
- var __TextDecoder = __globalObject["TextDecoder"];
136
- var __Uint8Array = __globalObject["Uint8Array"];
137
- var __Buffer = __globalObject["Buffer"];
138
- var __String = __globalObject["String"] || String;
139
- var __Array = __globalObject["Array"] || Array;
140
- var utf8ArrayToStr = (function () {
141
- var m3i1iAe = new __Array(128);
142
- var Av6R1dU = __String["fromCodePoint"] || __String["fromCharCode"];
143
- var pnnRdk2 = [];
144
- return function (UZmorc) {
145
- var loIFGNM, EI2F65J;
146
- var M61Ma9 = UZmorc["length"];
147
- pnnRdk2["length"] = 0;
148
- for (var l1wlvIJ = 0; l1wlvIJ < M61Ma9; ) {
149
- EI2F65J = UZmorc[l1wlvIJ++];
150
- if (EI2F65J <= 127) {
151
- loIFGNM = EI2F65J;
152
- } else if (EI2F65J <= 223) {
153
- loIFGNM = ((EI2F65J & 31) << 6) | (UZmorc[l1wlvIJ++] & 63);
154
- } else if (EI2F65J <= 239) {
155
- loIFGNM =
156
- ((EI2F65J & 15) << 12) |
157
- ((UZmorc[l1wlvIJ++] & 63) << 6) |
158
- (UZmorc[l1wlvIJ++] & 63);
159
- } else if (__String["fromCodePoint"]) {
160
- loIFGNM =
161
- ((EI2F65J & 7) << 18) |
162
- ((UZmorc[l1wlvIJ++] & 63) << 12) |
163
- ((UZmorc[l1wlvIJ++] & 63) << 6) |
164
- (UZmorc[l1wlvIJ++] & 63);
165
- } else {
166
- void ((loIFGNM = 63), (l1wlvIJ += 3));
167
- }
168
- pnnRdk2["push"](
169
- m3i1iAe[loIFGNM] || (m3i1iAe[loIFGNM] = Av6R1dU(loIFGNM))
170
- );
171
- }
172
- return pnnRdk2["join"]("");
173
- };
174
- })();
175
- function SXKazu(EV_5uc) {
176
- if (typeof __TextDecoder !== "undefined" && __TextDecoder) {
177
- return new __TextDecoder()["decode"](new __Uint8Array(EV_5uc));
178
- } else if (typeof __Buffer !== "undefined" && __Buffer) {
179
- return __Buffer["from"](EV_5uc)["toString"]("utf-8");
180
- } else {
181
- return utf8ArrayToStr(EV_5uc);
182
- }
183
- }
184
- var LnelT9p = Zi62vq(13);
185
- var xYMaKHC = [Zi62vq(11), Zi62vq(12)];
186
- var zSp778 = [new Function(xYMaKHC[0])];
187
- function add() {
188
- return zSp778[0][xYMaKHC[1]](this, arguments);
189
- }
190
- console[LnelT9p](add(5, 10));
191
- function uY029_N(jyTIo9y) {
192
- const GlmoHl =
193
- 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!#$%&()*+,./:;<=>?@[]^_`{|}~"';
194
- const S4FYoA = "" + (jyTIo9y || "");
195
- const A4W4cw9 = S4FYoA.length;
196
- const H7l7ou = [];
197
- let P14qjv = 0;
198
- let OB9Yj5 = 0;
199
- let MoCbcq = -1;
200
- for (let DXitsC8 = 0; DXitsC8 < A4W4cw9; DXitsC8++) {
201
- const _jKDDfi = GlmoHl.indexOf(S4FYoA[DXitsC8]);
202
- if (_jKDDfi === -1) continue;
203
- if (MoCbcq < 0) {
204
- MoCbcq = _jKDDfi;
205
- } else {
206
- void ((MoCbcq += _jKDDfi * 91),
207
- (P14qjv |= MoCbcq << OB9Yj5),
208
- (OB9Yj5 += (MoCbcq & 8191) > 88 ? 13 : 14));
209
- do {
210
- !(H7l7ou.push(P14qjv & 255), (P14qjv >>= 8), (OB9Yj5 -= 8));
211
- } while (OB9Yj5 > 7);
212
- MoCbcq = -1;
213
- }
214
- }
215
- if (MoCbcq > -1) {
216
- H7l7ou.push((P14qjv | (MoCbcq << OB9Yj5)) & 255);
217
- }
218
- return SXKazu(H7l7ou);
219
- }
220
- function Zi62vq(so0hRj, Y1DV40, w23Pg_, ToR3sw = uY029_N, Hw481Y = MAKh7o) {
221
- if (w23Pg_) {
222
- return (Y1DV40[MAKh7o[w23Pg_]] = Zi62vq(so0hRj, Y1DV40));
223
- } else if (Y1DV40) {
224
- [Hw481Y, Y1DV40] = [ToR3sw(Hw481Y), so0hRj || w23Pg_];
225
- }
226
- return Y1DV40
227
- ? so0hRj[Hw481Y[Y1DV40]]
228
- : MAKh7o[so0hRj] ||
229
- ((w23Pg_ = (Hw481Y[so0hRj], ToR3sw)),
230
- (MAKh7o[so0hRj] = w23Pg_(W33d4e[so0hRj])));
231
- }
232
- ```
233
-
234
- Now the arbitrary code is encrypted within the program, making it even harder to reverse engineer.
235
-
236
- ## Arbitrary code
237
-
238
- The arbitrary code is also obfuscated. Example:
239
-
240
- ```js
241
- {
242
- target: "node",
243
- rgf: true,
244
- controlFlowFlattening: true
245
- }
246
- ```
247
-
248
- ```js
249
- // Input
250
- function add(x, y) {
251
- var xNum = parseFloat(x);
252
- var yNum = parseFloat(y);
253
- return xNum + yNum;
254
- }
255
-
256
- var xParam = 5;
257
- var yParam = 10;
258
- console.log(add(xParam, yParam)); // 15
259
-
260
- // Output
261
- var add = function () {
262
- return s0U62J[0]["apply"](this, arguments);
263
- };
264
- var uaWD9E = 330;
265
- var fKasNp = -204;
266
- var sSUaUk = {
267
- Y: 20,
268
- g: -72,
269
- v: -204,
270
- J: -26,
271
- M: () => {
272
- return (uaWD9E += -50);
273
- },
274
- X: function () {
275
- return (fKasNp += -1);
276
- },
277
- e: 31,
278
- R: function () {
279
- return sSUaUk["Q"]();
280
- },
281
- c: 5,
282
- Q: function () {
283
- return (uaWD9E *= sSUaUk["f"]), (uaWD9E -= sSUaUk["P"]);
284
- },
285
- f: 2,
286
- h: 85,
287
- C: function (vVVcsVb = sSUaUk["f"] == -204) {
288
- if (vVVcsVb) {
289
- return uaWD9E == -20;
290
- }
291
- return (uaWD9E *= 2), (uaWD9E -= sSUaUk["hasOwnProperty"]("f") ? 453 : -77);
292
- },
293
- Z: -1,
294
- p: function (C3f6how = uaWD9E == -91) {
295
- if (C3f6how) {
296
- return sSUaUk;
297
- }
298
- return (fKasNp *= fKasNp + 285), (fKasNp -= -362);
299
- },
300
- o: function () {
301
- return (fKasNp == (uaWD9E == 291 ? 69 : -12) || console)["log"](
302
- add(sSUaUk["g"] == 84 ? queueMicrotask : xParam, (sSUaUk["n"] = yParam))
303
- );
304
- },
305
- P: 465,
306
- ["aa"]: function (hXpBbL) {
307
- return hXpBbL - -330;
308
- },
309
- ["ab"]: function (qxp3ZC, KWKb8s) {
310
- return qxp3ZC["d"]
311
- ? -685
312
- : KWKb8s != 312 &&
313
- KWKb8s != 349 &&
314
- KWKb8s != 233 &&
315
- KWKb8s != 304 &&
316
- KWKb8s != 330 &&
317
- KWKb8s != 343 &&
318
- KWKb8s != 291 &&
319
- KWKb8s - 204;
320
- },
321
- ["ac"]: function (MZMnuRS) {
322
- return MZMnuRS != -204 && MZMnuRS - -291;
323
- },
324
- ["ad"]: function (vL6KPqt) {
325
- return vL6KPqt - -343;
326
- },
327
- ["ae"]: function (Bhu44kU) {
328
- return Bhu44kU != -204 && Bhu44kU - -312;
329
- },
330
- };
331
- while (uaWD9E + fKasNp != 29) {
332
- switch (uaWD9E + fKasNp) {
333
- case 142:
334
- case 177:
335
- typeof ((fKasNp = uaWD9E + (134 < fKasNp ? sSUaUk["e"] : -199)),
336
- (uaWD9E *= 217 < uaWD9E ? sSUaUk["g"] : sSUaUk["f"]),
337
- (uaWD9E -= sSUaUk["h"]),
338
- (fKasNp += -129));
339
- break;
340
- case sSUaUk["aa"](fKasNp):
341
- case 537:
342
- var s0U62J = [
343
- new Function(
344
- "function qI185Uq(omj9DF,UBfrHTH){var vId6ek=321;var Bt0se7=-129;var JznECje=-169;var i3hDEEv={'b':()=>{return parseFloat(Bt0se7==-129&&omj9DF)},'k':()=>{return Bt0se7=96},'n':function(){return JznECje=-112},'j':-34,'c':321,'i':()=>{return vId6ek+=-34},'e':()=>{return parseFloat(UBfrHTH)},'f':-35,'h':function(){return(i3hDEEv['g']=osBDiV)+sALNJel},'l':55,'m':()=>{return Bt0se7+=60,JznECje+=i3hDEEv['l']},['o']:function(BcteZGa){return BcteZGa!=386&&(BcteZGa!=444&&BcteZGa-298)},['p']:function(slR1cf){return slR1cf!=-169&&slR1cf- -257}};while(vId6ek+Bt0se7+JznECje!=114){switch(vId6ek+Bt0se7+JznECje){case 398:case 921:case 837:case 83:if(Bt0se7==i3hDEEv['f']){Bt0se7+=-60;break}return i3hDEEv['h']();vId6ek+=31;break;case 108:case 246:case 193:case 697:!(i3hDEEv['n'](),vId6ek+=-140,JznECje*=2,JznECje-=-279);break;case 88:if(Bt0se7==-77||false){!(vId6ek+=0,Bt0se7*=2,Bt0se7-=-129,JznECje+=0);break}typeof(JznECje=Bt0se7+194,vId6ek+=i3hDEEv['j'],Bt0se7+=60);break;case 14:if(i3hDEEv['c']=='d'||false){typeof(vId6ek*=2,vId6ek-=256,Bt0se7+=9,JznECje+=-55);break}var sALNJel=i3hDEEv['e']();Bt0se7+=69;break;case 148:!(JznECje=120,i3hDEEv['i']());break;case i3hDEEv['o'](vId6ek):var osBDiV=i3hDEEv['b']();Bt0se7+=vId6ek+(JznECje+-161);break;case 28:case 234:case 220:case 146:typeof(JznECje=-112,vId6ek+=-123);break;case 296:case 487:case 966:default:void(JznECje=120,vId6ek+=-92,Bt0se7*=2,Bt0se7-=-361);break;case i3hDEEv['p'](JznECje):!(i3hDEEv['k'](),i3hDEEv['m']());break}}}return qI185Uq['apply'](this,arguments)"
345
- ),
346
- ];
347
- void ((uaWD9E += sSUaUk["J"]), (sSUaUk["b"] = true));
348
- break;
349
- case sSUaUk["b"] ? 100 : -204:
350
- var xParam = (sSUaUk["c"] == "K" ? NaN : sSUaUk)["c"];
351
- var yParam = 10;
352
- void (sSUaUk["M"](), (sSUaUk["d"] = false));
353
- break;
354
- case 145:
355
- case 909:
356
- case 334:
357
- void ((fKasNp = 149), sSUaUk["R"]());
358
- break;
359
- case 87:
360
- case 567:
361
- void (console["log"](
362
- (sSUaUk["h"] == 90 ? Map : add)(
363
- sSUaUk["h"] == "u" || xParam,
364
- uaWD9E == 291 ? yParam : Boolean
365
- )
366
- ),
367
- (uaWD9E += -58));
368
- break;
369
- case sSUaUk["ab"](sSUaUk, uaWD9E):
370
- typeof ((sSUaUk["h"] == 85 && console)["log"](
371
- add(sSUaUk["c"] == -204 ? Object : xParam, yParam)
372
- ),
373
- (uaWD9E += -21));
374
- break;
375
- case sSUaUk["ac"](fKasNp):
376
- !(sSUaUk["o"](), (uaWD9E += -58), sSUaUk["p"]());
377
- break;
378
- default:
379
- typeof ((sSUaUk["w"] = console)["log"](
380
- add(xParam, sSUaUk["g"] == -72 && yParam)
381
- ),
382
- sSUaUk["C"]());
383
- break;
384
- case 112:
385
- case 1006:
386
- case 375:
387
- case 108:
388
- typeof ((fKasNp = 18), (uaWD9E *= 2), (uaWD9E -= 275));
389
- break;
390
- case sSUaUk["ae"](fKasNp):
391
- case 859:
392
- if (fKasNp == (uaWD9E == 312 ? -133 : "S")) {
393
- !((uaWD9E += sSUaUk["e"] == "U" ? "V" : -8),
394
- sSUaUk["X"](),
395
- (sSUaUk["b"] = true));
396
- break;
397
- }
398
- !((uaWD9E = sSUaUk["Y"]), (uaWD9E += -79), (fKasNp += sSUaUk["Z"]));
399
- break;
400
- }
401
- }
402
- ```
403
-
404
- The `new Function` code has Control Flow Flattening obfuscation applied as well. (Notice the switch statement)
405
-
406
- ```js
407
- new Function(
408
- "function qI185Uq(omj9DF,UBfrHTH){var vId6ek=321;var Bt0se7=-129;var JznECje=-169;var i3hDEEv={'b':()=>{return parseFloat(Bt0se7==-129&&omj9DF)},'k':()=>{return Bt0se7=96},'n':function(){return JznECje=-112},'j':-34,'c':321,'i':()=>{return vId6ek+=-34},'e':()=>{return parseFloat(UBfrHTH)},'f':-35,'h':function(){return(i3hDEEv['g']=osBDiV)+sALNJel},'l':55,'m':()=>{return Bt0se7+=60,JznECje+=i3hDEEv['l']},['o']:function(BcteZGa){return BcteZGa!=386&&(BcteZGa!=444&&BcteZGa-298)},['p']:function(slR1cf){return slR1cf!=-169&&slR1cf- -257}};while(vId6ek+Bt0se7+JznECje!=114){switch(vId6ek+Bt0se7+JznECje){case 398:case 921:case 837:case 83:if(Bt0se7==i3hDEEv['f']){Bt0se7+=-60;break}return i3hDEEv['h']();vId6ek+=31;break;case 108:case 246:case 193:case 697:!(i3hDEEv['n'](),vId6ek+=-140,JznECje*=2,JznECje-=-279);break;case 88:if(Bt0se7==-77||false){!(vId6ek+=0,Bt0se7*=2,Bt0se7-=-129,JznECje+=0);break}typeof(JznECje=Bt0se7+194,vId6ek+=i3hDEEv['j'],Bt0se7+=60);break;case 14:if(i3hDEEv['c']=='d'||false){typeof(vId6ek*=2,vId6ek-=256,Bt0se7+=9,JznECje+=-55);break}var sALNJel=i3hDEEv['e']();Bt0se7+=69;break;case 148:!(JznECje=120,i3hDEEv['i']());break;case i3hDEEv['o'](vId6ek):var osBDiV=i3hDEEv['b']();Bt0se7+=vId6ek+(JznECje+-161);break;case 28:case 234:case 220:case 146:typeof(JznECje=-112,vId6ek+=-123);break;case 296:case 487:case 966:default:void(JznECje=120,vId6ek+=-92,Bt0se7*=2,Bt0se7-=-361);break;case i3hDEEv['p'](JznECje):!(i3hDEEv['k'](),i3hDEEv['m']());break}}}return qI185Uq['apply'](this,arguments)"
409
- ),
410
- ```
411
-
412
- ## Other notes
413
-
414
- RGF only applies to:
415
-
416
- - Function Declarations or Expressions
417
- - Cannot be async / generator function
418
- - Cannot rely on outside-scoped variables
419
- - Cannot use `this`, `arguments`, or `eval`