js-confuser 1.7.3 → 2.0.0-alpha.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (269) hide show
  1. package/.github/ISSUE_TEMPLATE/bug_report.md +6 -4
  2. package/CHANGELOG.md +70 -0
  3. package/Migration.md +57 -0
  4. package/README.md +23 -929
  5. package/dist/constants.js +65 -14
  6. package/dist/index.js +108 -160
  7. package/dist/obfuscator.js +316 -118
  8. package/dist/options.js +1 -119
  9. package/dist/order.js +30 -30
  10. package/dist/presets.js +47 -45
  11. package/dist/probability.js +25 -32
  12. package/dist/templates/bufferToStringTemplate.js +9 -0
  13. package/dist/templates/deadCodeTemplates.js +9 -0
  14. package/dist/templates/getGlobalTemplate.js +19 -0
  15. package/dist/templates/integrityTemplate.js +30 -0
  16. package/dist/templates/setFunctionLengthTemplate.js +9 -0
  17. package/dist/templates/stringCompressionTemplate.js +10 -0
  18. package/dist/templates/tamperProtectionTemplates.js +21 -0
  19. package/dist/templates/template.js +199 -184
  20. package/dist/transforms/astScrambler.js +100 -0
  21. package/dist/transforms/calculator.js +70 -127
  22. package/dist/transforms/controlFlowFlattening.js +1182 -0
  23. package/dist/transforms/deadCode.js +62 -587
  24. package/dist/transforms/dispatcher.js +300 -313
  25. package/dist/transforms/extraction/duplicateLiteralsRemoval.js +88 -189
  26. package/dist/transforms/extraction/objectExtraction.js +131 -215
  27. package/dist/transforms/finalizer.js +56 -59
  28. package/dist/transforms/flatten.js +275 -276
  29. package/dist/transforms/functionOutlining.js +230 -0
  30. package/dist/transforms/identifier/globalConcealing.js +214 -135
  31. package/dist/transforms/identifier/movedDeclarations.js +167 -91
  32. package/dist/transforms/identifier/renameVariables.js +239 -193
  33. package/dist/transforms/lock/integrity.js +61 -184
  34. package/dist/transforms/lock/lock.js +261 -387
  35. package/dist/transforms/minify.js +431 -436
  36. package/dist/transforms/opaquePredicates.js +65 -118
  37. package/dist/transforms/pack.js +160 -0
  38. package/dist/transforms/plugin.js +179 -0
  39. package/dist/transforms/preparation.js +261 -173
  40. package/dist/transforms/renameLabels.js +132 -56
  41. package/dist/transforms/rgf.js +140 -267
  42. package/dist/transforms/shuffle.js +52 -145
  43. package/dist/transforms/string/encoding.js +44 -175
  44. package/dist/transforms/string/stringCompression.js +79 -155
  45. package/dist/transforms/string/stringConcealing.js +189 -225
  46. package/dist/transforms/string/stringEncoding.js +32 -40
  47. package/dist/transforms/string/stringSplitting.js +54 -55
  48. package/dist/transforms/variableMasking.js +232 -0
  49. package/dist/utils/ControlObject.js +125 -0
  50. package/dist/utils/IntGen.js +46 -0
  51. package/dist/utils/NameGen.js +106 -0
  52. package/dist/utils/ast-utils.js +560 -0
  53. package/dist/utils/function-utils.js +56 -0
  54. package/dist/utils/gen-utils.js +48 -0
  55. package/dist/utils/node.js +77 -0
  56. package/dist/utils/object-utils.js +21 -0
  57. package/dist/utils/random-utils.js +91 -0
  58. package/dist/utils/static-utils.js +64 -0
  59. package/dist/validateOptions.js +122 -0
  60. package/index.d.ts +1 -17
  61. package/package.json +27 -22
  62. package/src/constants.ts +139 -82
  63. package/src/index.ts +70 -165
  64. package/src/obfuscationResult.ts +43 -0
  65. package/src/obfuscator.ts +328 -135
  66. package/src/options.ts +149 -658
  67. package/src/order.ts +14 -14
  68. package/src/presets.ts +39 -34
  69. package/src/probability.ts +21 -36
  70. package/src/templates/bufferToStringTemplate.ts +57 -0
  71. package/src/templates/deadCodeTemplates.ts +1185 -0
  72. package/src/templates/getGlobalTemplate.ts +72 -0
  73. package/src/templates/integrityTemplate.ts +69 -0
  74. package/src/templates/setFunctionLengthTemplate.ts +11 -0
  75. package/src/templates/stringCompressionTemplate.ts +42 -0
  76. package/src/templates/tamperProtectionTemplates.ts +116 -0
  77. package/src/templates/template.ts +149 -157
  78. package/src/transforms/astScrambler.ts +99 -0
  79. package/src/transforms/calculator.ts +96 -226
  80. package/src/transforms/controlFlowFlattening.ts +1594 -0
  81. package/src/transforms/deadCode.ts +85 -676
  82. package/src/transforms/dispatcher.ts +431 -640
  83. package/src/transforms/extraction/duplicateLiteralsRemoval.ts +147 -295
  84. package/src/transforms/extraction/objectExtraction.ts +160 -333
  85. package/src/transforms/finalizer.ts +63 -64
  86. package/src/transforms/flatten.ts +439 -557
  87. package/src/transforms/functionOutlining.ts +225 -0
  88. package/src/transforms/identifier/globalConcealing.ts +255 -266
  89. package/src/transforms/identifier/movedDeclarations.ts +228 -142
  90. package/src/transforms/identifier/renameVariables.ts +250 -271
  91. package/src/transforms/lock/integrity.ts +85 -263
  92. package/src/transforms/lock/lock.ts +338 -579
  93. package/src/transforms/minify.ts +523 -663
  94. package/src/transforms/opaquePredicates.ts +90 -229
  95. package/src/transforms/pack.ts +195 -0
  96. package/src/transforms/plugin.ts +185 -0
  97. package/src/transforms/preparation.ts +337 -231
  98. package/src/transforms/renameLabels.ts +176 -77
  99. package/src/transforms/rgf.ts +293 -424
  100. package/src/transforms/shuffle.ts +80 -254
  101. package/src/transforms/string/encoding.ts +20 -126
  102. package/src/transforms/string/stringCompression.ts +117 -307
  103. package/src/transforms/string/stringConcealing.ts +254 -342
  104. package/src/transforms/string/stringEncoding.ts +28 -47
  105. package/src/transforms/string/stringSplitting.ts +61 -75
  106. package/src/transforms/variableMasking.ts +257 -0
  107. package/src/utils/ControlObject.ts +141 -0
  108. package/src/utils/IntGen.ts +33 -0
  109. package/src/utils/NameGen.ts +106 -0
  110. package/src/utils/ast-utils.ts +667 -0
  111. package/src/utils/function-utils.ts +50 -0
  112. package/src/utils/gen-utils.ts +48 -0
  113. package/src/utils/node.ts +78 -0
  114. package/src/utils/object-utils.ts +21 -0
  115. package/src/utils/random-utils.ts +79 -0
  116. package/src/utils/static-utils.ts +66 -0
  117. package/src/validateOptions.ts +256 -0
  118. package/tsconfig.json +13 -8
  119. package/babel.config.js +0 -12
  120. package/dev.js +0 -8
  121. package/dist/compiler.js +0 -34
  122. package/dist/parser.js +0 -59
  123. package/dist/precedence.js +0 -66
  124. package/dist/templates/bufferToString.js +0 -129
  125. package/dist/templates/core.js +0 -35
  126. package/dist/templates/crash.js +0 -28
  127. package/dist/templates/es5.js +0 -137
  128. package/dist/templates/functionLength.js +0 -34
  129. package/dist/templates/globals.js +0 -9
  130. package/dist/transforms/antiTooling.js +0 -88
  131. package/dist/transforms/controlFlowFlattening/controlFlowFlattening.js +0 -1287
  132. package/dist/transforms/controlFlowFlattening/expressionObfuscation.js +0 -131
  133. package/dist/transforms/es5/antiClass.js +0 -164
  134. package/dist/transforms/es5/antiDestructuring.js +0 -193
  135. package/dist/transforms/es5/antiES6Object.js +0 -185
  136. package/dist/transforms/es5/antiSpreadOperator.js +0 -35
  137. package/dist/transforms/es5/antiTemplate.js +0 -66
  138. package/dist/transforms/es5/es5.js +0 -123
  139. package/dist/transforms/extraction/classExtraction.js +0 -83
  140. package/dist/transforms/identifier/globalAnalysis.js +0 -83
  141. package/dist/transforms/identifier/variableAnalysis.js +0 -104
  142. package/dist/transforms/lock/antiDebug.js +0 -76
  143. package/dist/transforms/stack.js +0 -349
  144. package/dist/transforms/transform.js +0 -372
  145. package/dist/traverse.js +0 -110
  146. package/dist/util/compare.js +0 -145
  147. package/dist/util/gen.js +0 -564
  148. package/dist/util/guard.js +0 -14
  149. package/dist/util/identifiers.js +0 -355
  150. package/dist/util/insert.js +0 -362
  151. package/dist/util/math.js +0 -19
  152. package/dist/util/object.js +0 -40
  153. package/dist/util/random.js +0 -156
  154. package/dist/util/scope.js +0 -20
  155. package/docs/ControlFlowFlattening.md +0 -595
  156. package/docs/Countermeasures.md +0 -70
  157. package/docs/ES5.md +0 -197
  158. package/docs/Integrity.md +0 -82
  159. package/docs/RGF.md +0 -424
  160. package/docs/RenameVariables.md +0 -116
  161. package/docs/TamperProtection.md +0 -100
  162. package/docs/Template.md +0 -117
  163. package/samples/example.js +0 -15
  164. package/samples/high.js +0 -1
  165. package/samples/input.js +0 -3
  166. package/samples/javascriptobfuscator.com.js +0 -8
  167. package/samples/jscrambler_advanced.js +0 -1894
  168. package/samples/jscrambler_light.js +0 -1134
  169. package/samples/low.js +0 -1
  170. package/samples/medium.js +0 -1
  171. package/samples/obfuscator.io.js +0 -1686
  172. package/samples/preemptive.com.js +0 -16
  173. package/src/compiler.ts +0 -35
  174. package/src/parser.ts +0 -49
  175. package/src/precedence.ts +0 -61
  176. package/src/templates/bufferToString.ts +0 -136
  177. package/src/templates/core.ts +0 -29
  178. package/src/templates/crash.ts +0 -23
  179. package/src/templates/es5.ts +0 -131
  180. package/src/templates/functionLength.ts +0 -32
  181. package/src/templates/globals.ts +0 -3
  182. package/src/transforms/antiTooling.ts +0 -102
  183. package/src/transforms/controlFlowFlattening/controlFlowFlattening.ts +0 -2153
  184. package/src/transforms/controlFlowFlattening/expressionObfuscation.ts +0 -179
  185. package/src/transforms/es5/antiClass.ts +0 -276
  186. package/src/transforms/es5/antiDestructuring.ts +0 -294
  187. package/src/transforms/es5/antiES6Object.ts +0 -267
  188. package/src/transforms/es5/antiSpreadOperator.ts +0 -56
  189. package/src/transforms/es5/antiTemplate.ts +0 -98
  190. package/src/transforms/es5/es5.ts +0 -149
  191. package/src/transforms/extraction/classExtraction.ts +0 -168
  192. package/src/transforms/identifier/globalAnalysis.ts +0 -102
  193. package/src/transforms/identifier/variableAnalysis.ts +0 -118
  194. package/src/transforms/lock/antiDebug.ts +0 -112
  195. package/src/transforms/stack.ts +0 -557
  196. package/src/transforms/transform.ts +0 -441
  197. package/src/traverse.ts +0 -120
  198. package/src/types.ts +0 -133
  199. package/src/util/compare.ts +0 -181
  200. package/src/util/gen.ts +0 -651
  201. package/src/util/guard.ts +0 -17
  202. package/src/util/identifiers.ts +0 -494
  203. package/src/util/insert.ts +0 -419
  204. package/src/util/math.ts +0 -15
  205. package/src/util/object.ts +0 -39
  206. package/src/util/random.ts +0 -221
  207. package/src/util/scope.ts +0 -21
  208. package/test/code/Cash.src.js +0 -1011
  209. package/test/code/Cash.test.ts +0 -132
  210. package/test/code/Dynamic.src.js +0 -118
  211. package/test/code/Dynamic.test.ts +0 -49
  212. package/test/code/ES6.src.js +0 -235
  213. package/test/code/ES6.test.ts +0 -42
  214. package/test/code/NewFeatures.test.ts +0 -19
  215. package/test/code/StrictMode.src.js +0 -65
  216. package/test/code/StrictMode.test.js +0 -37
  217. package/test/compare.test.ts +0 -104
  218. package/test/index.test.ts +0 -249
  219. package/test/options.test.ts +0 -150
  220. package/test/presets.test.ts +0 -22
  221. package/test/probability.test.ts +0 -44
  222. package/test/templates/template.test.ts +0 -224
  223. package/test/transforms/antiTooling.test.ts +0 -52
  224. package/test/transforms/calculator.test.ts +0 -78
  225. package/test/transforms/controlFlowFlattening/controlFlowFlattening.test.ts +0 -1274
  226. package/test/transforms/controlFlowFlattening/expressionObfuscation.test.ts +0 -192
  227. package/test/transforms/deadCode.test.ts +0 -85
  228. package/test/transforms/dispatcher.test.ts +0 -457
  229. package/test/transforms/es5/antiClass.test.ts +0 -427
  230. package/test/transforms/es5/antiDestructuring.test.ts +0 -157
  231. package/test/transforms/es5/antiES6Object.test.ts +0 -245
  232. package/test/transforms/es5/antiTemplate.test.ts +0 -116
  233. package/test/transforms/es5/es5.test.ts +0 -110
  234. package/test/transforms/extraction/classExtraction.test.ts +0 -86
  235. package/test/transforms/extraction/duplicateLiteralsRemoval.test.ts +0 -200
  236. package/test/transforms/extraction/objectExtraction.test.ts +0 -491
  237. package/test/transforms/flatten.test.ts +0 -721
  238. package/test/transforms/hexadecimalNumbers.test.ts +0 -62
  239. package/test/transforms/identifier/globalConcealing.test.ts +0 -142
  240. package/test/transforms/identifier/movedDeclarations.test.ts +0 -275
  241. package/test/transforms/identifier/renameVariables.test.ts +0 -695
  242. package/test/transforms/lock/antiDebug.test.ts +0 -66
  243. package/test/transforms/lock/browserLock.test.ts +0 -129
  244. package/test/transforms/lock/countermeasures.test.ts +0 -100
  245. package/test/transforms/lock/integrity.test.ts +0 -161
  246. package/test/transforms/lock/lock.test.ts +0 -204
  247. package/test/transforms/lock/osLock.test.ts +0 -312
  248. package/test/transforms/lock/selfDefending.test.ts +0 -68
  249. package/test/transforms/lock/tamperProtection.test.ts +0 -336
  250. package/test/transforms/minify.test.ts +0 -575
  251. package/test/transforms/opaquePredicates.test.ts +0 -43
  252. package/test/transforms/preparation.test.ts +0 -157
  253. package/test/transforms/renameLabels.test.ts +0 -95
  254. package/test/transforms/rgf.test.ts +0 -378
  255. package/test/transforms/shuffle.test.ts +0 -135
  256. package/test/transforms/stack.test.ts +0 -573
  257. package/test/transforms/string/stringCompression.test.ts +0 -120
  258. package/test/transforms/string/stringConcealing.test.ts +0 -299
  259. package/test/transforms/string/stringEncoding.test.ts +0 -95
  260. package/test/transforms/string/stringSplitting.test.ts +0 -135
  261. package/test/transforms/transform.test.ts +0 -66
  262. package/test/traverse.test.ts +0 -139
  263. package/test/util/compare.test.ts +0 -34
  264. package/test/util/gen.test.ts +0 -121
  265. package/test/util/identifiers.test.ts +0 -253
  266. package/test/util/insert.test.ts +0 -142
  267. package/test/util/math.test.ts +0 -5
  268. package/test/util/random.test.ts +0 -71
  269. /package/dist/{types.js → obfuscationResult.js} +0 -0
package/docs/RGF.md DELETED
@@ -1,424 +0,0 @@
1
- ## `RGF`
2
-
3
- RGF (Runtime-Generated-Functions) uses the [`new Function(code...)`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/Function) syntax to construct executable code from strings. (`true/false/0-1`)
4
-
5
- - **This can break your code.**
6
- - **Due to the security concerns of arbitrary code execution, you must enable this yourself.**
7
- - The arbitrary code is also obfuscated.
8
-
9
- Option name: `rgf`
10
-
11
- Option values: `true/false/0-1`
12
-
13
- Note: RGF will only apply to functions that do not rely on any outside-scoped variables. Enable `flatten` along with `rgf` to apply to these functions.
14
-
15
- Note: Does not apply to arrow, async, or generator functions.
16
-
17
- Use a number to control the percentage of functions changed.
18
-
19
- ```js
20
- // Input
21
- function printToConsole(message){
22
- console.log(message);
23
- }
24
-
25
- printToConsole("Hello World"); // "Hello World"
26
-
27
- // Output
28
- var Ricvq8s = [new Function('function HIGRHaD(ANVivo_){console[\'log\'](ANVivo_)}return HIGRHaD[\'apply\'](this,arguments)')];
29
- function uhj6obs() {
30
- return Ricvq8s[0]['apply'](this, arguments);
31
- }
32
- uhj6obs('Hello World'); // "Hello World"
33
- ```
34
-
35
- ## With `Flatten`
36
-
37
- Enable `flatten` with `rgf` to apply to functions that rely on outside-scoped variables.
38
-
39
- Flatten is able to isolate functions from their scope so then RGF can then apply on them.
40
-
41
- ```js
42
- {
43
- target: "node",
44
- rgf: true,
45
- flatten: true
46
- }
47
- ```
48
-
49
- ```js
50
- // Input
51
- var outsideVariable = 0;
52
- function incrementOutsideVariable(){
53
- outsideVariable++;
54
- }
55
-
56
- incrementOutsideVariable(); // outsideVariable = 1
57
- incrementOutsideVariable(); // outsideVariable = 2
58
- incrementOutsideVariable(); // outsideVariable = 3
59
-
60
- console.log(outsideVariable); // 3
61
-
62
- // Output
63
- var J3NLZFR = [
64
- new Function(
65
- "function Q7Rh6l([],reFzsi){reFzsi['XaBIEIZ']++}return Q7Rh6l['apply'](this,arguments)"
66
- ),
67
- ];
68
- function pCG9mH() {
69
- return J3NLZFR[0]["apply"](this, arguments);
70
- }
71
- var outsideVariable = 0;
72
- function incrementOutsideVariable(...muLxIC) {
73
- var udg38ch = {
74
- set ["XaBIEIZ"](H5p1op) {
75
- outsideVariable = H5p1op;
76
- },
77
- get ["XaBIEIZ"]() {
78
- return outsideVariable;
79
- },
80
- };
81
- return pCG9mH(muLxIC, udg38ch);
82
- }
83
- !(incrementOutsideVariable(),
84
- incrementOutsideVariable(),
85
- incrementOutsideVariable(),
86
- console["log"](outsideVariable)); // 3
87
- ```
88
-
89
- ## With `String Concealing`
90
-
91
- Enable `stringConcealing` to encrypt the `new Function(code)` code string.
92
-
93
- ```js
94
- // Input
95
- function add(x, y){
96
- return x + y;
97
- }
98
-
99
- console.log(add(5, 10)); // 15
100
-
101
- // Output
102
- var MAKh7o = [],
103
- BCG3CXC = 0,
104
- W33d4e = (function () {
105
- var To7ztdg = [
106
- "n%v2do>o/Ro<B",
107
- "ad/z~7_MP#]yCZ(ZlG2Hr@3B3UuHQbXj~7$GZ7w@h#g<J9G",
108
- ']+=c$.zNPP+/G9BY1G$x3_M+]8EU"[XpkwUdV^QC!Pk.XbK',
109
- "Hd8=l@<:%59/L]J",
110
- "u)jdloP1|6k.*Z}iV5UHt#[z<IW31wwn{nnEkj5vyJ",
111
- "@4P0goQYcRNlUD",
112
- '"!>fj>~p!It3M^hX',
113
- ".t)F;!&u)J?+gEFe4zAz;3A",
114
- ":!><}7qC*2i.2xI",
115
- "&2rd(iQYsRJ2ID",
116
- 'H)?/f2lvs4KinCkR]Db.znuuY%"uk,Uorf`yo2:M97n',
117
- 'KEFK73EeT2m/77Hg,i&Fu#qePMp{Lv(mUzf0v+Jj6U<xhQQn%XM,d^jN%yh*ZFAe>]w;Uvz`Y3G.Z*ClC:?<HwU6g&?E(u+NFEgbL^YI]GJ3nv$Y:"29ZXRipw(wD7=!xS!lPaRi{Z{^EqU2#@lZ3dJuX2@y4@AV{PWlCMszhDm#]eh5G)*[|ja2D:rZ%#L0BJ(u+N"i`Km]2MyTQUO[8Lx7<fY<L|%Te.{+;T@z/z!=86D8fO+*FYg%(:Ef5?L7Y{LntO|LE:?,V[GUY?sQWq>iPeI!Y{DJU3$@Qcf<Kz`m/#F(g!jmFTG&ywX,Zj0T1c>[vP0/oxJk>oCPL?G*aWmUk,(y0CG62t6[)gaz^I3]Z[$yVRra,S7!Hc!i6CAP4m&BRn_URI{c]GlN07361pmfja!i6CAPo{CN/US8U==[${lT,r|]7j}UD=U*7*K0T^4b$q"z^I3]Z[$yp!kbWi|?p>P:_Y2$E`~.8jcB9c!=!Yy#c%x@Moi5e39=TXi#c.~MLOD]Wf=[RvK0U6myWoa=zg>[;NmTd/<P1o:JzI{*bv.!T^a9_o_zU=W}[;FWGvCFph(UE=U*7*|N47Tm_o@|[;c,`pE$nwaxTOU?p>W}FjMR6t{]8d5)VKU,0{8!@+q[wh[i/2s)+{ZR50ixOg#4]I^[5ds!Wz|a?N~<[go@J`+9M6>x=Tgzzgh`(`+9p!kbWijr71d,!YI9)dN.`onDF3w)Eqj9Z<,alLX}ecF.ieL%`r|]Km=GzI>3m6<!!/,]XXPSufp@A:nKGvCFpht2V3O:/p/3LsyxQn[DE=M*qerR4msj]o0aU=$bz*[&2/ZQ;mI=[go@J`+9!+ZQ!q@|[;V<#NLR#V;a8jg5y;:t*NN!v3Jx+rgzzgh`FjMR6tOyCknDF3w)PZ1$2/a9{j9o(IP:T[K0T^pQUo44!H{*+G+K70WFph>DF3w)9v6IE?zj0p$z>vM{bTs7a6q[whQ5zg7=O$^G[+O9$XrM^Ia>H[r%Apry0ht2V3O:/pH981.^rmWX01nv{Y<!ApL+YiXBCdmvb*7Lj{Y8?UdP(gt@mC}!f%ixHl3oG,b>"M#1b6_.YiXB)H%n!6#1l!#bof)%vE5pUIKU&::ZmlaXYeg9<{a!A.,]CmtoIJq/A:nK$#TO<a>cy;F<"@QS]4"50Vs<t<r@6iMR6t(7?nZJ):Er{!`6r*Kl_ci?:=):%p$Mr^zj8pt,[;RkS:f8$V0PuoSrlf*1&M(2%8=lAl5Xk3@!rpEJ8_`N7R_Z;K6_A@%#?rT+nlR}A>[h@eG$909MBke!>fF(tTrIM{$YASl<+H%n!6#1d{Z*nlR}A>[h%R814_O+9rOr"z&im$|6r*Kl_cyfba~aGSC(o!e9jLDSzw?:g{"%.(]68R[+M,U!7viTu*o8NOndi;{^LB&z:::uQVQz^Kb9<{a!A.,]4jAj_y]m<!iQP<tNOVy!n>b>"M#13m)7?nZJ):jeI:(GD.*9KmePgZC.Z`+92/ZQ;mI=qwp@1;>4WzpENnxo)=u%.!yPn?fbiR5]xw?:g{"%.(o@sOn?dEh|Yo1$Xw_jOg`O}JevRp30CpS*ASU?.bbj(ve8$V0PuoSrlf*1&M(2%83,DT@ZaFNmKq1$Xw_jOg`O}JevRp30CpS*ASoPE=f,eIFHX?"*ml)|kyBkh`:!tRqZpTF]AbC}+:>4dRmZNgot<=p/A:IH"g?mmS9<*H%n!6#1cpryVO~%(=<kd#wPn?fbiR5]kyM{bTs7a6+BdqAo>f{&xzW0B,qxbp6o>v><JHmNo7,]dlxaU=u%Yo[zC{uFrOwRe3_*R11T4t>Cfkqr)aecU684N3zOcrDSyDm`2e1T0t{]8d5)VKU,0{8!@+&5wVu7$Jc,@0m$RzW*lNX}^d9_FZ:!7&98Uol<zg>[;NmT@$U^lLX}^d9_FZ:!7&98Uo*Zw;n+JT1T20"5ROZPtK]&UevS)/&NQoGE9K$!@Mi2DQGNBs?i7g,WGkJH:@S9PnLB@;9uekB#@+&5wVu7$Jc,@0m$RzW*lNX}ecF.ieL%T^a9_o_z$J]&fN4UB2|aOgcR0=|<A:J0yOQ7akNaw;![dTpUb64^=NwX{Z][j;@2@5*9KmeP>3f,!eLU4tOyCknDF3w)PZ1$2/CFgfoGS.C1E:FWK;3m_ogr$J^v0:d7!#xE{dEdUK1]^*mUrOCFubl<zg>[;NmT%dPa[oY8M=#[[5IUAUBc9jg8G3/WLHU$aK0^Mg)tQh_*:6J0~5IE=oqaNKf)[p7%60>x2ol<sf!=!Yy#c%Qj,f[t+xmc>Y_54EtQcrarU=[[eG#Iei4bzVWDf/AwZjwMFNCl;aVo}GR5!S<7lf<Dmf/DP<2+~jQSW6nmLm1o.J,?jTs%2<WF%qguexAkZdx2G?*NgMqOgD{c:!*Hh&ckQVG`yFQ$:@*Qv^&9rsGU%.e>bTrUu+Rwxn"fUd2b)!G0&/rO8XH@p>wb.!p!c%HylL~%/gt;_:HUx/$^)lUoBg6=+Yi#yxl.1oZBsHI!LBv&Z{Y8?UXPVK`/{Y,$zL#C:UXPVK&y}S74>P#C:UXPVKi]lvPSdR07]Pt<t<r@k);R7t{]$S#wyg_h#`(2jVHaXV~%/gt;9#)9=:&OSomfM,|*T[aU7tQQ:aE5`0MrKIdS5/M,~kqM^I[3XvGUx/$^)l.<[;mlhHK%Q6=NBkpt)FNyl5R8M{{6aR[I/2@[H[7%x^M.SO>la;x4z#2K`599sm8UGH|0fBuLYK/YheoPE=f,TZgV80l.SO>la;x4z#40=(@vGZ%/20So2)t#)/RQkZ{]/gR!YCn6/_6CuhRG,/Nf~`CJTKGluVv74J!.Z*VN~>lNcR=_`Eqs|RW3l/zjWjQ=(gJ?4{AS*dQDFSC:#0[>pThS[5]xxnMXiwll/z+0!&KFSUR`}byn~t*9ID[k_PR)LaD__0G$:4`[FSmU5z=m.!4%gixE<al]raE}j1AS+:/Efk6i5z:f%z8&%L6lScE&GE2]xvJH[5]xxnMXnh~<dpMO[P8vkZt2e/`08i;1<:G6Xoi5e39=eGw8b.sD(Zv7gGKkC6j8C{*8<mg5,<8=1R)$|#ix/f1/#<|<Z;tVm@^O^pAjl,6ui:g8c!#PBSfrrdIro6LOU<9xiZ4ti=/<(`g83/XvNbl<Z2lcHN]2+g7OcrdP(gt@mCc&i*sQ@aSrQe/k5X16Ub^CObwl$eOrrBh&;x4bRO=Xbgv)|5;0jb`@[nOauhV<8e$yC2CNgdW%}JEd2$&5:(#^km:+<d;^A+l9cm$PBSfrrddc}orI~=EQwP=Xbgv)|5@Vlb^CObwl$ev@&Y7Ue%9MgdW%}Jvs#v2$Bv]ZPgt%VE"ma$f&i*sQ@a3]6.k9iYAJ0Sva(k.lGfB{z*@V{a^CObwljF)yTB($2#va(k.lGfB{z*.!E.f^@bHak,k9iYAJ0Sva(k.lGfB{R;5OM?O]Rb;n$x!6EYGQ`4O9Xi"/%e{c)C',
118
- "Hu@Jk`A",
119
- "jrIJ",
120
- ];
121
- return BCG3CXC ? To7ztdg["pop"]() : BCG3CXC++, To7ztdg;
122
- })();
123
- function __getGlobal() {
124
- try {
125
- return global || window || new Function("return this")();
126
- } catch (e) {
127
- try {
128
- return this;
129
- } catch (e) {
130
- return {};
131
- }
132
- }
133
- }
134
- var __globalObject = __getGlobal() || {};
135
- var __TextDecoder = __globalObject["TextDecoder"];
136
- var __Uint8Array = __globalObject["Uint8Array"];
137
- var __Buffer = __globalObject["Buffer"];
138
- var __String = __globalObject["String"] || String;
139
- var __Array = __globalObject["Array"] || Array;
140
- var utf8ArrayToStr = (function () {
141
- var m3i1iAe = new __Array(128);
142
- var Av6R1dU = __String["fromCodePoint"] || __String["fromCharCode"];
143
- var pnnRdk2 = [];
144
- return function (UZmorc) {
145
- var loIFGNM, EI2F65J;
146
- var M61Ma9 = UZmorc["length"];
147
- pnnRdk2["length"] = 0;
148
- for (var l1wlvIJ = 0; l1wlvIJ < M61Ma9; ) {
149
- EI2F65J = UZmorc[l1wlvIJ++];
150
- if (EI2F65J <= 127) {
151
- loIFGNM = EI2F65J;
152
- } else if (EI2F65J <= 223) {
153
- loIFGNM = ((EI2F65J & 31) << 6) | (UZmorc[l1wlvIJ++] & 63);
154
- } else if (EI2F65J <= 239) {
155
- loIFGNM =
156
- ((EI2F65J & 15) << 12) |
157
- ((UZmorc[l1wlvIJ++] & 63) << 6) |
158
- (UZmorc[l1wlvIJ++] & 63);
159
- } else if (__String["fromCodePoint"]) {
160
- loIFGNM =
161
- ((EI2F65J & 7) << 18) |
162
- ((UZmorc[l1wlvIJ++] & 63) << 12) |
163
- ((UZmorc[l1wlvIJ++] & 63) << 6) |
164
- (UZmorc[l1wlvIJ++] & 63);
165
- } else {
166
- void ((loIFGNM = 63), (l1wlvIJ += 3));
167
- }
168
- pnnRdk2["push"](
169
- m3i1iAe[loIFGNM] || (m3i1iAe[loIFGNM] = Av6R1dU(loIFGNM))
170
- );
171
- }
172
- return pnnRdk2["join"]("");
173
- };
174
- })();
175
- function SXKazu(EV_5uc) {
176
- if (typeof __TextDecoder !== "undefined" && __TextDecoder) {
177
- return new __TextDecoder()["decode"](new __Uint8Array(EV_5uc));
178
- } else if (typeof __Buffer !== "undefined" && __Buffer) {
179
- return __Buffer["from"](EV_5uc)["toString"]("utf-8");
180
- } else {
181
- return utf8ArrayToStr(EV_5uc);
182
- }
183
- }
184
- var LnelT9p = Zi62vq(13);
185
- var xYMaKHC = [Zi62vq(11), Zi62vq(12)];
186
- var zSp778 = [new Function(xYMaKHC[0])];
187
- function add() {
188
- return zSp778[0][xYMaKHC[1]](this, arguments);
189
- }
190
- console[LnelT9p](add(5, 10));
191
- function uY029_N(jyTIo9y) {
192
- const GlmoHl =
193
- 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!#$%&()*+,./:;<=>?@[]^_`{|}~"';
194
- const S4FYoA = "" + (jyTIo9y || "");
195
- const A4W4cw9 = S4FYoA.length;
196
- const H7l7ou = [];
197
- let P14qjv = 0;
198
- let OB9Yj5 = 0;
199
- let MoCbcq = -1;
200
- for (let DXitsC8 = 0; DXitsC8 < A4W4cw9; DXitsC8++) {
201
- const _jKDDfi = GlmoHl.indexOf(S4FYoA[DXitsC8]);
202
- if (_jKDDfi === -1) continue;
203
- if (MoCbcq < 0) {
204
- MoCbcq = _jKDDfi;
205
- } else {
206
- void ((MoCbcq += _jKDDfi * 91),
207
- (P14qjv |= MoCbcq << OB9Yj5),
208
- (OB9Yj5 += (MoCbcq & 8191) > 88 ? 13 : 14));
209
- do {
210
- !(H7l7ou.push(P14qjv & 255), (P14qjv >>= 8), (OB9Yj5 -= 8));
211
- } while (OB9Yj5 > 7);
212
- MoCbcq = -1;
213
- }
214
- }
215
- if (MoCbcq > -1) {
216
- H7l7ou.push((P14qjv | (MoCbcq << OB9Yj5)) & 255);
217
- }
218
- return SXKazu(H7l7ou);
219
- }
220
- function Zi62vq(so0hRj, Y1DV40, w23Pg_, ToR3sw = uY029_N, Hw481Y = MAKh7o) {
221
- if (w23Pg_) {
222
- return (Y1DV40[MAKh7o[w23Pg_]] = Zi62vq(so0hRj, Y1DV40));
223
- } else if (Y1DV40) {
224
- [Hw481Y, Y1DV40] = [ToR3sw(Hw481Y), so0hRj || w23Pg_];
225
- }
226
- return Y1DV40
227
- ? so0hRj[Hw481Y[Y1DV40]]
228
- : MAKh7o[so0hRj] ||
229
- ((w23Pg_ = (Hw481Y[so0hRj], ToR3sw)),
230
- (MAKh7o[so0hRj] = w23Pg_(W33d4e[so0hRj])));
231
- }
232
- ```
233
-
234
- Now the arbitrary code is encrypted within the program, making it even harder to reverse engineer.
235
-
236
- ## Arbitrary code
237
-
238
- The arbitrary code is also obfuscated. Example:
239
-
240
- ```js
241
- {
242
- target: "node",
243
- rgf: true,
244
- controlFlowFlattening: true
245
- }
246
- ```
247
-
248
- ```js
249
- // Input
250
- function add(x, y) {
251
- var xNum = parseFloat(x);
252
- var yNum = parseFloat(y);
253
- return xNum + yNum;
254
- }
255
-
256
- var xParam = 5;
257
- var yParam = 10;
258
- console.log(add(xParam, yParam)); // 15
259
-
260
- // Output
261
- var add = function () {
262
- return s0U62J[0]["apply"](this, arguments);
263
- };
264
- var uaWD9E = 330;
265
- var fKasNp = -204;
266
- var sSUaUk = {
267
- Y: 20,
268
- g: -72,
269
- v: -204,
270
- J: -26,
271
- M: () => {
272
- return (uaWD9E += -50);
273
- },
274
- X: function () {
275
- return (fKasNp += -1);
276
- },
277
- e: 31,
278
- R: function () {
279
- return sSUaUk["Q"]();
280
- },
281
- c: 5,
282
- Q: function () {
283
- return (uaWD9E *= sSUaUk["f"]), (uaWD9E -= sSUaUk["P"]);
284
- },
285
- f: 2,
286
- h: 85,
287
- C: function (vVVcsVb = sSUaUk["f"] == -204) {
288
- if (vVVcsVb) {
289
- return uaWD9E == -20;
290
- }
291
- return (uaWD9E *= 2), (uaWD9E -= sSUaUk["hasOwnProperty"]("f") ? 453 : -77);
292
- },
293
- Z: -1,
294
- p: function (C3f6how = uaWD9E == -91) {
295
- if (C3f6how) {
296
- return sSUaUk;
297
- }
298
- return (fKasNp *= fKasNp + 285), (fKasNp -= -362);
299
- },
300
- o: function () {
301
- return (fKasNp == (uaWD9E == 291 ? 69 : -12) || console)["log"](
302
- add(sSUaUk["g"] == 84 ? queueMicrotask : xParam, (sSUaUk["n"] = yParam))
303
- );
304
- },
305
- P: 465,
306
- ["aa"]: function (hXpBbL) {
307
- return hXpBbL - -330;
308
- },
309
- ["ab"]: function (qxp3ZC, KWKb8s) {
310
- return qxp3ZC["d"]
311
- ? -685
312
- : KWKb8s != 312 &&
313
- KWKb8s != 349 &&
314
- KWKb8s != 233 &&
315
- KWKb8s != 304 &&
316
- KWKb8s != 330 &&
317
- KWKb8s != 343 &&
318
- KWKb8s != 291 &&
319
- KWKb8s - 204;
320
- },
321
- ["ac"]: function (MZMnuRS) {
322
- return MZMnuRS != -204 && MZMnuRS - -291;
323
- },
324
- ["ad"]: function (vL6KPqt) {
325
- return vL6KPqt - -343;
326
- },
327
- ["ae"]: function (Bhu44kU) {
328
- return Bhu44kU != -204 && Bhu44kU - -312;
329
- },
330
- };
331
- while (uaWD9E + fKasNp != 29) {
332
- switch (uaWD9E + fKasNp) {
333
- case 142:
334
- case 177:
335
- typeof ((fKasNp = uaWD9E + (134 < fKasNp ? sSUaUk["e"] : -199)),
336
- (uaWD9E *= 217 < uaWD9E ? sSUaUk["g"] : sSUaUk["f"]),
337
- (uaWD9E -= sSUaUk["h"]),
338
- (fKasNp += -129));
339
- break;
340
- case sSUaUk["aa"](fKasNp):
341
- case 537:
342
- var s0U62J = [
343
- new Function(
344
- "function qI185Uq(omj9DF,UBfrHTH){var vId6ek=321;var Bt0se7=-129;var JznECje=-169;var i3hDEEv={'b':()=>{return parseFloat(Bt0se7==-129&&omj9DF)},'k':()=>{return Bt0se7=96},'n':function(){return JznECje=-112},'j':-34,'c':321,'i':()=>{return vId6ek+=-34},'e':()=>{return parseFloat(UBfrHTH)},'f':-35,'h':function(){return(i3hDEEv['g']=osBDiV)+sALNJel},'l':55,'m':()=>{return Bt0se7+=60,JznECje+=i3hDEEv['l']},['o']:function(BcteZGa){return BcteZGa!=386&&(BcteZGa!=444&&BcteZGa-298)},['p']:function(slR1cf){return slR1cf!=-169&&slR1cf- -257}};while(vId6ek+Bt0se7+JznECje!=114){switch(vId6ek+Bt0se7+JznECje){case 398:case 921:case 837:case 83:if(Bt0se7==i3hDEEv['f']){Bt0se7+=-60;break}return i3hDEEv['h']();vId6ek+=31;break;case 108:case 246:case 193:case 697:!(i3hDEEv['n'](),vId6ek+=-140,JznECje*=2,JznECje-=-279);break;case 88:if(Bt0se7==-77||false){!(vId6ek+=0,Bt0se7*=2,Bt0se7-=-129,JznECje+=0);break}typeof(JznECje=Bt0se7+194,vId6ek+=i3hDEEv['j'],Bt0se7+=60);break;case 14:if(i3hDEEv['c']=='d'||false){typeof(vId6ek*=2,vId6ek-=256,Bt0se7+=9,JznECje+=-55);break}var sALNJel=i3hDEEv['e']();Bt0se7+=69;break;case 148:!(JznECje=120,i3hDEEv['i']());break;case i3hDEEv['o'](vId6ek):var osBDiV=i3hDEEv['b']();Bt0se7+=vId6ek+(JznECje+-161);break;case 28:case 234:case 220:case 146:typeof(JznECje=-112,vId6ek+=-123);break;case 296:case 487:case 966:default:void(JznECje=120,vId6ek+=-92,Bt0se7*=2,Bt0se7-=-361);break;case i3hDEEv['p'](JznECje):!(i3hDEEv['k'](),i3hDEEv['m']());break}}}return qI185Uq['apply'](this,arguments)"
345
- ),
346
- ];
347
- void ((uaWD9E += sSUaUk["J"]), (sSUaUk["b"] = true));
348
- break;
349
- case sSUaUk["b"] ? 100 : -204:
350
- var xParam = (sSUaUk["c"] == "K" ? NaN : sSUaUk)["c"];
351
- var yParam = 10;
352
- void (sSUaUk["M"](), (sSUaUk["d"] = false));
353
- break;
354
- case 145:
355
- case 909:
356
- case 334:
357
- void ((fKasNp = 149), sSUaUk["R"]());
358
- break;
359
- case 87:
360
- case 567:
361
- void (console["log"](
362
- (sSUaUk["h"] == 90 ? Map : add)(
363
- sSUaUk["h"] == "u" || xParam,
364
- uaWD9E == 291 ? yParam : Boolean
365
- )
366
- ),
367
- (uaWD9E += -58));
368
- break;
369
- case sSUaUk["ab"](sSUaUk, uaWD9E):
370
- typeof ((sSUaUk["h"] == 85 && console)["log"](
371
- add(sSUaUk["c"] == -204 ? Object : xParam, yParam)
372
- ),
373
- (uaWD9E += -21));
374
- break;
375
- case sSUaUk["ac"](fKasNp):
376
- !(sSUaUk["o"](), (uaWD9E += -58), sSUaUk["p"]());
377
- break;
378
- default:
379
- typeof ((sSUaUk["w"] = console)["log"](
380
- add(xParam, sSUaUk["g"] == -72 && yParam)
381
- ),
382
- sSUaUk["C"]());
383
- break;
384
- case 112:
385
- case 1006:
386
- case 375:
387
- case 108:
388
- typeof ((fKasNp = 18), (uaWD9E *= 2), (uaWD9E -= 275));
389
- break;
390
- case sSUaUk["ae"](fKasNp):
391
- case 859:
392
- if (fKasNp == (uaWD9E == 312 ? -133 : "S")) {
393
- !((uaWD9E += sSUaUk["e"] == "U" ? "V" : -8),
394
- sSUaUk["X"](),
395
- (sSUaUk["b"] = true));
396
- break;
397
- }
398
- !((uaWD9E = sSUaUk["Y"]), (uaWD9E += -79), (fKasNp += sSUaUk["Z"]));
399
- break;
400
- }
401
- }
402
- ```
403
-
404
- The `new Function` code has Control Flow Flattening obfuscation applied as well. (Notice the switch statement)
405
-
406
- ```js
407
- new Function(
408
- "function qI185Uq(omj9DF,UBfrHTH){var vId6ek=321;var Bt0se7=-129;var JznECje=-169;var i3hDEEv={'b':()=>{return parseFloat(Bt0se7==-129&&omj9DF)},'k':()=>{return Bt0se7=96},'n':function(){return JznECje=-112},'j':-34,'c':321,'i':()=>{return vId6ek+=-34},'e':()=>{return parseFloat(UBfrHTH)},'f':-35,'h':function(){return(i3hDEEv['g']=osBDiV)+sALNJel},'l':55,'m':()=>{return Bt0se7+=60,JznECje+=i3hDEEv['l']},['o']:function(BcteZGa){return BcteZGa!=386&&(BcteZGa!=444&&BcteZGa-298)},['p']:function(slR1cf){return slR1cf!=-169&&slR1cf- -257}};while(vId6ek+Bt0se7+JznECje!=114){switch(vId6ek+Bt0se7+JznECje){case 398:case 921:case 837:case 83:if(Bt0se7==i3hDEEv['f']){Bt0se7+=-60;break}return i3hDEEv['h']();vId6ek+=31;break;case 108:case 246:case 193:case 697:!(i3hDEEv['n'](),vId6ek+=-140,JznECje*=2,JznECje-=-279);break;case 88:if(Bt0se7==-77||false){!(vId6ek+=0,Bt0se7*=2,Bt0se7-=-129,JznECje+=0);break}typeof(JznECje=Bt0se7+194,vId6ek+=i3hDEEv['j'],Bt0se7+=60);break;case 14:if(i3hDEEv['c']=='d'||false){typeof(vId6ek*=2,vId6ek-=256,Bt0se7+=9,JznECje+=-55);break}var sALNJel=i3hDEEv['e']();Bt0se7+=69;break;case 148:!(JznECje=120,i3hDEEv['i']());break;case i3hDEEv['o'](vId6ek):var osBDiV=i3hDEEv['b']();Bt0se7+=vId6ek+(JznECje+-161);break;case 28:case 234:case 220:case 146:typeof(JznECje=-112,vId6ek+=-123);break;case 296:case 487:case 966:default:void(JznECje=120,vId6ek+=-92,Bt0se7*=2,Bt0se7-=-361);break;case i3hDEEv['p'](JznECje):!(i3hDEEv['k'](),i3hDEEv['m']());break}}}return qI185Uq['apply'](this,arguments)"
409
- ),
410
- ```
411
-
412
- ## Other notes
413
-
414
- RGF only applies to:
415
-
416
- - Function Declarations or Expressions
417
- - Cannot be async / generator function
418
- - Cannot rely on outside-scoped variables
419
- - Cannot use `this`, `arguments`, or `eval`
420
-
421
- ### See also
422
-
423
- - [Control Flow Flattening](./ControlFlowFlattening.md)
424
- - [Tamper Protection](./TamperProtection.md)
@@ -1,116 +0,0 @@
1
- ## `Rename Variables`
2
-
3
- Determines if variables should be renamed. (`true/false`)
4
-
5
- Option name: `controlFlowFlattening`
6
-
7
- Option values: `true/false`
8
-
9
- ```js
10
- // Input
11
- var twoSum = function (nums, target) {
12
- var hash = {};
13
- var len = nums.length;
14
- for (var i = 0; i < len; i++) {
15
- if (nums[i] in hash) return [hash[nums[i]], i];
16
- hash[target - nums[i]] = i;
17
- }
18
- return [-1, -1];
19
- };
20
-
21
- var test = function () {
22
- var inputNums = [2, 7, 11, 15];
23
- var inputTarget = 9;
24
- var expectedResult = [0, 1];
25
-
26
- var actualResult = twoSum(inputNums, inputTarget);
27
- ok(actualResult[0] === expectedResult[0]);
28
- ok(actualResult[1] === expectedResult[1]);
29
- };
30
-
31
- test();
32
-
33
- // Output
34
- var _O2mOcF = function (kB4uXM, w_07HXS) {
35
- var ZLTJcx = {};
36
- var sXQOaUx = kB4uXM["length"];
37
- for (var JYYxEk = 0; JYYxEk < sXQOaUx; JYYxEk++) {
38
- if (kB4uXM[JYYxEk] in ZLTJcx) {
39
- return [ZLTJcx[kB4uXM[JYYxEk]], JYYxEk];
40
- }
41
- ZLTJcx[w_07HXS - kB4uXM[JYYxEk]] = JYYxEk;
42
- }
43
- return [-1, -1];
44
- };
45
- var qFaI6S = function () {
46
- var fZpeOw = [2, 7, 11, 15];
47
- var UJ62R2c = 9;
48
- var dG6R0cV = [0, 1];
49
- var WgYXwn = _O2mOcF(fZpeOw, UJ62R2c);
50
- void (ok(WgYXwn[0] === dG6R0cV[0]), ok(WgYXwn[1] === dG6R0cV[1]));
51
- };
52
- qFaI6S();
53
- ```
54
-
55
- ### Custom Implementation
56
-
57
- A custom function can provided as the `renameVariables` option, determining if a variable should be renamed.
58
-
59
- | Parameter | Type | Description |
60
- | --- | --- | --- |
61
- | `name` | `string` | The variable proposed to be renamed |
62
- | `isGlobal` | `boolean` | Is the variable defined at the global level? |
63
-
64
- ```js
65
- {
66
- target: "node",
67
-
68
- // Avoid renaming a certain variable
69
- renameVariables: name=>name != "jQuery",
70
- }
71
- ```
72
-
73
- ### Access the renamed variable
74
-
75
- The `__JS_CONFUSER_VAR__` function provides a method to access variable mappings. This is especially useful for `eval()` scenarios where you want preserve the mapping.
76
-
77
-
78
- ```js
79
- // Input
80
- var message = "Hello world!";
81
- eval(`console.log(${ __JS_CONFUSER_VAR__(message) })`);
82
-
83
- console.log("message was renamed to", __JS_CONFUSER_VAR__(message));
84
-
85
- // Output
86
- var nSgZyJf = "Hello world!";
87
- eval(`console.log(${"nSgZyJf"})`) // "Hello world!"
88
- console["log"]("message was renamed to", "nSgZyJf") // message was renamed to nSgZyJf
89
- ```
90
-
91
- Even if `Rename Variables` is disabled, the `__JS_CONFUSER_VAR__` will still be removed. (The original name will be returned as a string)
92
-
93
- ### Never rename a variable
94
-
95
- The `__NO_JS_CONFUSER_RENAME__` prefix disables renaming a certain variable. This can be useful for debugging the obfuscator.
96
-
97
- ```js
98
- // Input
99
- var __NO_JS_CONFUSER_RENAME__message1 = "My first message"
100
- var message2 = "My other message"
101
-
102
- console.log(__NO_JS_CONFUSER_RENAME__message1)
103
- console.log(message2)
104
-
105
- // Output
106
- var __NO_JS_CONFUSER_RENAME__message1 = "My first message";
107
- var jRLf713 = "My other message";
108
-
109
- console.log(__NO_JS_CONFUSER_RENAME__message1),
110
- console.log(jRLf713)
111
- ```
112
-
113
-
114
-
115
-
116
-
@@ -1,100 +0,0 @@
1
- ## `Tamper Protection`
2
-
3
- Tamper Protection safeguards the runtime behavior from being altered by JavaScript pitfalls.
4
-
5
- **⚠️ Tamper Protection requires eval and ran in a non-strict mode environment!**
6
-
7
- - **This can break your code.**
8
- - **Due to the security concerns of arbitrary code execution, you must enable this yourself.**
9
-
10
- Option name: `lock.tamperProtection`
11
-
12
- Option values: `true/false/Function`
13
-
14
- ### 1. Improves `Global Concealing`
15
-
16
- Tamper Protection with `Global Concealing` can detect at runtime if certain global functions have been monkey-patched. The following code exemplifies this:
17
-
18
- #### (a) Native function check
19
-
20
- ```js
21
- var _fetch = fetch;
22
- fetch = (...args)=>{
23
- console.log("Fetch request intercepted!", ...args)
24
- return _fetch(...args)
25
- }
26
- ```
27
-
28
- This monkey-patch can be detected by inspecting the `fetch.toString()` value:
29
-
30
- ```js
31
- // Untampered
32
- fetch.toString() // "function fetch() { [native code] }"
33
-
34
-
35
- // Tampered
36
- fetch.toString() // "(...args)=>{\n console.log("Fetch request intercepted!", ...args)\n return _fetch(...args)\n}"
37
- ```
38
-
39
- Certain global functions are checked before each invocation to ensure that (1) the arguments cannot be intercepted and (2) their behavior cannot be altered.
40
-
41
- #### (b) Stealthy global
42
-
43
- A direct `eval` invocation can access the local scope, only if it has not been redefined.
44
-
45
- ```js
46
- let root = {};
47
- eval("root=this"); // Window {window: ...}
48
- ```
49
-
50
- This method securely obtains the real global object for both the browser and NodeJS. Properties on the global object can still be changed however.
51
-
52
- ### 2. Improves `RGF`
53
-
54
- RGF (Runtime-Generated-Functions) behavior's can be altered by overriding the default `Function` constructor.
55
- This allows a reverse engineer to inspect the concealed code and alter the behavior of the application.
56
-
57
- When `lock.tamperProtection` is enabled, `RGF` will no longer use the `Function` constructor.
58
- Instead, `eval` will be used with a strict integrity check.
59
-
60
- ```js
61
- let check = false;
62
- eval("check = true")
63
- if (!check) {
64
- throw new Error("Eval was redefined")
65
- }
66
-
67
- const myFunction = eval("function abc(){}; abc");
68
- ```
69
-
70
- Eval loses it's local scope access when redefined by a monkey-patched function. This example ensures the concealed code cannot be inspected or behavior be changed.
71
-
72
- [Learn more about RGF](RGF.md).
73
-
74
- ### Custom Implementation
75
-
76
- You can provide a custom implementation for `lock.tamperProtection` to control which functions get the native function check.
77
-
78
- ```js
79
- {
80
- target: "node",
81
- lock: {
82
- tamperProtection: (fnName) => fnName === "console.log"
83
- }
84
- }
85
- ```
86
-
87
- ### Disallows Strict Mode
88
-
89
- Tamper Protection requires the script to run in non-strict mode. Detection of the script in Strict Mode will be considered tampering. You can control the tampering response using the `lock.countermeasures` option, as detailed in the next section.
90
-
91
- ### Tamper Detection
92
-
93
- If tampering is detected, the `lock.countermeasures` function will be invoked. If you don't provide a `lock.countermeasures` function, the default behavior is to crash the program.
94
-
95
- [Learn more about the countermeasures function](Countermeasures.md).
96
-
97
- ### See also
98
-
99
- - [Countermeasures](Countermeasures.md)
100
- - [RGF](RGF.md)