js-confuser 2.0.0-alpha.5 → 2.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (113) hide show
  1. package/.github/ISSUE_TEMPLATE/bug_report.md +43 -43
  2. package/.github/ISSUE_TEMPLATE/feature_request.md +20 -20
  3. package/.github/workflows/node.js.yml +28 -28
  4. package/.prettierrc +4 -4
  5. package/CHANGELOG.md +1015 -989
  6. package/CODE_OF_CONDUCT.md +131 -131
  7. package/CONTRIBUTING.md +52 -52
  8. package/LICENSE +21 -21
  9. package/Migration.md +72 -71
  10. package/README.md +86 -78
  11. package/dist/constants.js +43 -43
  12. package/dist/index.js +14 -23
  13. package/dist/obfuscator.js +31 -25
  14. package/dist/order.js +4 -4
  15. package/dist/presets.js +31 -31
  16. package/dist/templates/integrityTemplate.js +4 -4
  17. package/dist/templates/template.js +1 -2
  18. package/dist/transforms/astScrambler.js +1 -2
  19. package/dist/transforms/calculator.js +1 -2
  20. package/dist/transforms/controlFlowFlattening.js +93 -63
  21. package/dist/transforms/deadCode.js +1 -2
  22. package/dist/transforms/dispatcher.js +4 -5
  23. package/dist/transforms/extraction/duplicateLiteralsRemoval.js +1 -2
  24. package/dist/transforms/extraction/objectExtraction.js +1 -2
  25. package/dist/transforms/finalizer.js +1 -2
  26. package/dist/transforms/flatten.js +1 -2
  27. package/dist/transforms/identifier/globalConcealing.js +15 -2
  28. package/dist/transforms/identifier/movedDeclarations.js +8 -7
  29. package/dist/transforms/identifier/renameVariables.js +7 -7
  30. package/dist/transforms/lock/integrity.js +11 -10
  31. package/dist/transforms/lock/lock.js +2 -3
  32. package/dist/transforms/minify.js +11 -29
  33. package/dist/transforms/opaquePredicates.js +1 -2
  34. package/dist/transforms/pack.js +5 -2
  35. package/dist/transforms/plugin.js +18 -19
  36. package/dist/transforms/preparation.js +16 -16
  37. package/dist/transforms/renameLabels.js +1 -2
  38. package/dist/transforms/rgf.js +8 -9
  39. package/dist/transforms/shuffle.js +1 -2
  40. package/dist/transforms/string/encoding.js +1 -2
  41. package/dist/transforms/string/stringCompression.js +3 -4
  42. package/dist/transforms/string/stringConcealing.js +8 -3
  43. package/dist/transforms/string/stringEncoding.js +1 -2
  44. package/dist/transforms/variableMasking.js +1 -2
  45. package/dist/utils/NameGen.js +2 -2
  46. package/dist/utils/PredicateGen.js +1 -2
  47. package/dist/utils/ast-utils.js +87 -88
  48. package/dist/utils/function-utils.js +8 -8
  49. package/dist/utils/node.js +5 -6
  50. package/dist/utils/object-utils.js +4 -4
  51. package/dist/utils/random-utils.js +20 -20
  52. package/dist/utils/static-utils.js +1 -2
  53. package/dist/validateOptions.js +4 -7
  54. package/index.d.ts +17 -17
  55. package/package.json +61 -59
  56. package/src/constants.ts +168 -168
  57. package/src/index.ts +118 -118
  58. package/src/obfuscationResult.ts +49 -49
  59. package/src/obfuscator.ts +501 -497
  60. package/src/options.ts +407 -407
  61. package/src/order.ts +54 -54
  62. package/src/presets.ts +125 -125
  63. package/src/templates/bufferToStringTemplate.ts +57 -57
  64. package/src/templates/deadCodeTemplates.ts +1185 -1185
  65. package/src/templates/getGlobalTemplate.ts +76 -76
  66. package/src/templates/integrityTemplate.ts +64 -64
  67. package/src/templates/setFunctionLengthTemplate.ts +11 -11
  68. package/src/templates/stringCompressionTemplate.ts +20 -20
  69. package/src/templates/tamperProtectionTemplates.ts +120 -120
  70. package/src/templates/template.ts +224 -224
  71. package/src/transforms/astScrambler.ts +99 -99
  72. package/src/transforms/calculator.ts +99 -99
  73. package/src/transforms/controlFlowFlattening.ts +1716 -1664
  74. package/src/transforms/deadCode.ts +82 -82
  75. package/src/transforms/dispatcher.ts +450 -450
  76. package/src/transforms/extraction/duplicateLiteralsRemoval.ts +156 -158
  77. package/src/transforms/extraction/objectExtraction.ts +186 -186
  78. package/src/transforms/finalizer.ts +74 -74
  79. package/src/transforms/flatten.ts +421 -420
  80. package/src/transforms/identifier/globalConcealing.ts +315 -295
  81. package/src/transforms/identifier/movedDeclarations.ts +252 -251
  82. package/src/transforms/identifier/renameVariables.ts +328 -321
  83. package/src/transforms/lock/integrity.ts +117 -114
  84. package/src/transforms/lock/lock.ts +418 -425
  85. package/src/transforms/minify.ts +615 -629
  86. package/src/transforms/opaquePredicates.ts +100 -100
  87. package/src/transforms/pack.ts +239 -231
  88. package/src/transforms/plugin.ts +173 -173
  89. package/src/transforms/preparation.ts +349 -347
  90. package/src/transforms/renameLabels.ts +175 -175
  91. package/src/transforms/rgf.ts +322 -322
  92. package/src/transforms/shuffle.ts +82 -82
  93. package/src/transforms/string/encoding.ts +144 -144
  94. package/src/transforms/string/stringCompression.ts +128 -128
  95. package/src/transforms/string/stringConcealing.ts +312 -298
  96. package/src/transforms/string/stringEncoding.ts +80 -80
  97. package/src/transforms/string/stringSplitting.ts +77 -77
  98. package/src/transforms/variableMasking.ts +257 -257
  99. package/src/utils/IntGen.ts +33 -33
  100. package/src/utils/NameGen.ts +116 -116
  101. package/src/utils/PredicateGen.ts +61 -61
  102. package/src/utils/ast-utils.ts +663 -663
  103. package/src/utils/function-utils.ts +50 -50
  104. package/src/utils/gen-utils.ts +48 -48
  105. package/src/utils/node.ts +78 -78
  106. package/src/utils/object-utils.ts +21 -21
  107. package/src/utils/random-utils.ts +93 -93
  108. package/src/utils/static-utils.ts +66 -66
  109. package/src/validateOptions.ts +256 -259
  110. package/tsconfig.json +13 -14
  111. package/dist/probability.js +0 -1
  112. package/dist/transforms/functionOutlining.js +0 -230
  113. package/dist/utils/ControlObject.js +0 -125
package/CHANGELOG.md CHANGED
@@ -1,990 +1,1016 @@
1
- # `2.0.0-alpha.0`
2
- 2.0 Rewrite Alpha 🎉
3
-
4
- **⚠️ Warning: This an alpha release. This version is not stable and the likelihood of encountering bugs is significantly higher.**
5
-
6
- ### Complete rewrite of JS-Confuser using Babel! 🎉
7
-
8
- **⚠️ Breaking changes**
9
-
10
- > Check out the [Migration guide](./Migration.md) on how to properly update from 1.X to 2.0. The obfuscation upgrades in 2.0 are worth the small refactoring.
11
-
12
- - Revamped API Interface
13
-
14
- - - JSConfuser.obfuscate() resolves to an object
15
-
16
- | Property | Type | Description |
17
- | --- | --- | --- |
18
- | `code` | `string` | The obfuscated code. |
19
-
20
- - Renamed `Stack` to `Variable Masking`
21
-
22
- - Added configurable limits to options:
23
-
24
- ```js
25
- const options = {
26
- target: "node",
27
-
28
- rgf: {
29
- value: 0.5, // = 50% of eligible functions
30
- limit: 10 // Maximum of 10 changes for performance reasons
31
- },
32
-
33
- // Original format is still valid (No limit applied)
34
- rgf: 0.5
35
- }
36
- ```
37
-
38
- ### 2.0 Changes
39
-
40
- - Added [Custom String Encoding](https://new--confuser.netlify.app/docs/options/customStringEncodings) and [Custom Lock Code](https://new--confuser.netlify.app/docs/options/customLocks) options
41
-
42
- - Added `Rename Labels` [Learn more here](https://new--confuser.netlify.app/docs/options/renamelabels#rename-labels)
43
-
44
- - Added `Pack` [Learn more here](https://new--confuser.netlify.app/docs/options/pack#pack)
45
-
46
- - RGF no longers uses `new Function` instead uses `eval`
47
-
48
- - Improved code transforms!
49
-
50
- - Improved `Control Flow Flattening`
51
-
52
- - - Obfuscates the [Call Graph](https://en.wikipedia.org/wiki/Call_graph)
53
-
54
- - - Now supports lexical bindings (`let`, `const`, `class`)
55
-
56
- - - `with () { }` statement obfuscation
57
-
58
- - Improved `Minify`
59
-
60
- - - Removes unused variables and functions
61
-
62
- - Improved `Moved Declaration` ability to move variables as unused function parameters
63
-
64
- - Improved `String` transforms
65
-
66
- - - [Template literals](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals) are now obfuscated (First converted into equivalent String Literal)
67
-
68
- - - [Regular expressions](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_expressions) are now obfuscated (First converted into equivalent RegExp() constructor calls)
69
-
70
- - - `String Compression` now uses LZ-string compression ([lz-string](https://www.npmjs.com/package/lz-string))
71
-
72
- - New Comment Syntax
73
-
74
- - - `/* @js-confuser-var */ "name"` for improved variable mappings for eval() calls
75
-
76
- ```js
77
- // Input
78
- var name = "Internet User";
79
- eval( "console.log(" + /* @js-confuser-var */ "name" + ")" );
80
-
81
- // Output
82
- var zC3PLKu = "Internet User";
83
- eval("console.log(" + "zC3PLKu" + ")");
84
- ```
85
-
86
- The function `__JS_CONFUSER_VAR__` is identical in outcome and still be used, however, the comment syntax is preferred as the comment syntax's preserves the original script's behavior.
87
-
88
- ### JS-Confuser.com Revamp
89
-
90
- A new UI for [JS-Confuser.com](https://js-confuser.com), featuring an advanced playground and documentation pages.
91
-
92
- The previous version will remain available: [old--confuser.netlify.com](https://old--confuser.netlify.app/)
93
-
94
- **Removed features**
95
-
96
- - Removed `ES5` option - Use Babel Instead
97
-
98
- - Removed `Browser Lock` and `OS Lock` - Use [Custom Locks](https://new--confuser.netlify.app/docs/options/customlocks#custom-locks) instead
99
-
100
- - Removed `Shuffle`'s Hash option
101
-
102
- - Removed `Indent` option
103
-
104
-
105
- # `1.7.3`
106
- Tamper Protection
107
-
108
- ### `Tamper Protection`
109
-
110
- Tamper Protection safeguards the runtime behavior from being altered by JavaScript pitfalls.
111
-
112
- [Learn more here.](/docs/TamperProtection.md)
113
-
114
- ---
115
-
116
- - Rename Variables improvements:
117
-
118
- - A new exposed function, `__JS_CONFUSER_VAR__`, can be used to access renamed variables. [Learn more here](/docs/RenameVariables.md).
119
-
120
-
121
- ```js
122
- // Input
123
- var name = "John Doe";
124
- eval("console.log(" + __JS_CONFUSER_VAR__(name) + ")");
125
-
126
- // Output
127
- var CA1HU0 = 'John Doe';
128
- eval('console.log(' + 'CA1HU0' + ')');
129
- ```
130
-
131
- - Improved the `Zero Width` identifier generator (Thanks @doctor8296!)
132
-
133
- - Pad the `String Concealing` array with more fake strings
134
-
135
- - Improve `String Compression`
136
-
137
- - New Web UI sneak peak: https://new--confuser.netlify.app/
138
-
139
-
140
- # `1.7.2`
141
- Updates
142
-
143
- - `Anti Tooling` & `Expression Obfuscation` improvements
144
- - - No longer expanded by [webcrack](https://github.com/j4k0xb/webcrack), [synchrony](https://github.com/relative/synchrony) & [REstringer](https://github.com/PerimeterX/restringer)
145
-
146
- - `String Concealing` improvements
147
- - - Randomizes the charset for each obfuscation
148
- - - Place multiple decryption functions throughout the code
149
- - - These changes aim to defeat [JSConfuser-String-Decryptor](https://github.com/0v41n/JSConfuser-String-Decryptor) and any other RegEx-based decoders
150
-
151
- - `Moved Declarations` improvements
152
- - - Now moves some variables as unused parameters on certain functions
153
-
154
- - `RGF` improvements
155
- - - More likely to transform functions containing functions
156
-
157
- - Fixed [#96](https://github.com/MichaelXF/js-confuser/issues/96)
158
- - - Removed hardcoded limits on `String Concealing`, `String Compression`, and `Duplicate Literals Removal`
159
-
160
- - Fixed [#106](https://github.com/MichaelXF/js-confuser/issues/106)
161
- - - Final fix with const variables for `Object Extraction`
162
-
163
- - Fixed [#131](https://github.com/MichaelXF/js-confuser/issues/131)
164
- - - __dirname is no longer changed by `Global Concealing`
165
-
166
- **New Option**
167
-
168
- ### `preserveFunctionLength`
169
- - Modified functions will retain the correct `function.length` property. (`true/false`)
170
- Enabled by default.
171
-
172
- Minor improvements
173
- - Preserve `function.length`
174
- - Preserve Strict Mode behaviors
175
- - Preserve indirect vs. direct [`eval`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval) use
176
-
177
-
178
- # `1.7.1`
179
- Updates
180
-
181
- - Fixed [#107](https://github.com/MichaelXF/js-confuser/issues/107)
182
- - - RGF and Integrity clash issue fixed
183
-
184
- - Fixed [#106](https://github.com/MichaelXF/js-confuser/issues/106)
185
- - - Object Extraction to properly handle `const` objects
186
-
187
- - Fixed [#105](https://github.com/MichaelXF/js-confuser/issues/105)
188
- - - Duplicate Literals Removal updated to not cause this error
189
-
190
- - Fixed [#103](https://github.com/MichaelXF/js-confuser/issues/103)
191
- - - Dispatcher will no longer apply to these types of functions to prevent this error
192
-
193
- - Added documentation page for [ES5](https://github.com/MichaelXF/js-confuser/blob/master/docs/ES5.md)
194
-
195
- - Rollup Plugin created: https://github.com/ayecue/rollup-js-confuser (Thanks @ayecue !)
196
-
197
- # `1.7.0`
198
- Updates
199
-
200
- - Fixed [#89](https://github.com/MichaelXF/js-confuser/issues/89)
201
- - - Flatten to not break functions with invalid identifier names
202
-
203
- - Fixed [#88](https://github.com/MichaelXF/js-confuser/issues/88)
204
- - - Stack to not break functions with syncing arguments
205
-
206
- - Fixed [#91](https://github.com/MichaelXF/js-confuser/issues/91)
207
- - - Minify to preserve function.length property
208
-
209
- - Fixed [#95](https://github.com/MichaelXF/js-confuser/issues/95)
210
- - - Rename Variables optimized to obfuscate much faster
211
-
212
- - Added documentation pages for [RGF](https://github.com/MichaelXF/js-confuser/blob/master/docs/RGF.md) and [Control Flow Flattening](https://github.com/MichaelXF/js-confuser/blob/master/docs/ControlFlowFlattening.md)
213
-
214
- - Removed `eval` option in favor of `rgf` option.
215
-
216
- - - Removed the `"all"` option from `rgf`.
217
-
218
- - Removed `nameRecycling` option
219
-
220
- # `1.6.0`
221
- Website Redesign + Updates
222
-
223
- The website is now redesigned and live at [js-confuser.com](https://wwww.js-confuser.com)!
224
-
225
- - Check out the source code for the website here: https://github.com/MichaelXF/js-confuser-website
226
-
227
- #### New feature
228
-
229
- ### `selfDefending`
230
-
231
- Prevents the use of code beautifiers or formatters against your code.
232
-
233
- [Identical to Obfuscator.io's Self Defending](https://github.com/javascript-obfuscator/javascript-obfuscator#selfdefending)
234
-
235
- #### Improvements
236
-
237
- - Fixed [#56](https://github.com/MichaelXF/js-confuser/issues/56)
238
- - - Calculator improved to apply to more operators
239
-
240
- - ES5 to handle destructuring member expressions
241
-
242
- - Improved Control Flow Flattening techniques
243
-
244
- - - Outlining expressions
245
-
246
- - - Control object to store numbers and strings
247
-
248
- - Updated the String concealing encoding algorithm
249
-
250
- - Optimizations / Small fixes
251
-
252
- # `1.5.9`
253
- Big update
254
-
255
- This updates comes with many bug fixes:
256
-
257
- - Fixed [#72](https://github.com/MichaelXF/js-confuser/issues/72)
258
- - - ES5 to handle Class Fields
259
-
260
- Note: The `ES5` option is not meant to replace Babel. It is only intended to undo ES6 features the obfuscator may have added to your code.
261
-
262
- - Fixed [#74](https://github.com/MichaelXF/js-confuser/issues/74)
263
- - - Anti Tooling to not break Symbols
264
-
265
- - Fixed [#75](https://github.com/MichaelXF/js-confuser/issues/75)
266
- - - Minify to properly handle Object constructors
267
-
268
- - Fixed [#76](https://github.com/MichaelXF/js-confuser/issues/76)
269
- - - Minify to not cause syntax errors when objects used `^`, `` ` ``, `[`, `]` as property keys
270
-
271
- - Fixed [#77](https://github.com/MichaelXF/js-confuser/issues/77)
272
- - - Dispatcher to not break code that uses generic names like `toString` and `hasOwnProperty`
273
-
274
- - Fixed [#78](https://github.com/MichaelXF/js-confuser/issues/78)
275
- - - Object Extraction to not error on objects with spread elements
276
-
277
- - Fixed [#79](https://github.com/MichaelXF/js-confuser/issues/79)
278
- - - JsConfuser now supports `BigInt` literals
279
-
280
- - Fixed [#80](https://github.com/MichaelXF/js-confuser/issues/80)
281
- - - Rename Variables to not break code that had `var` and `let` variables in the same scope
282
-
283
- - Fixed [#81](https://github.com/MichaelXF/js-confuser/issues/81)
284
- - - Control Flow Flattening to not break `typeof` expressions
285
-
286
- - Fixed [#82](https://github.com/MichaelXF/js-confuser/issues/82)
287
- - - String Concealing to not break class constructors
288
-
289
- # `1.5.8`
290
- Several fixes
291
-
292
- - Fixed [#46](https://github.com/MichaelXF/js-confuser/issues/46)
293
- - - Updated the validation on `lock` options
294
-
295
- - Fixed [#68](https://github.com/MichaelXF/js-confuser/issues/68)
296
- - - Name Recycling fixed to not break certain function declarations
297
-
298
- - Fixed [#69](https://github.com/MichaelXF/js-confuser/issues/69), [#70](https://github.com/MichaelXF/js-confuser/issues/70) and [#71](https://github.com/MichaelXF/js-confuser/issues/71)
299
- - - Import statements to be properly handled
300
-
301
- - Slight improvements to String Concealing
302
-
303
- # `1.5.7`
304
- Countermeasures function fixes
305
-
306
- This update focuses on fixing Countermeasures bugs
307
-
308
- The `countermeasures` is custom callback function to invoke when a lock is triggered.
309
-
310
- - Fixed [#66](https://github.com/MichaelXF/js-confuser/issues/66)
311
- - - RGF to properly handle the countermeasures function
312
-
313
- - Added additional code to prevent an infinite loop from occurring
314
-
315
- - Slight improvements to RGF
316
-
317
- # `1.5.6`
318
- Website changed and RGF fixes
319
-
320
- The website is back at a different domain now: [https://master--hungry-shannon-c1ce6b.netlify.app/](https://master--hungry-shannon-c1ce6b.netlify.app/)
321
-
322
- This update focuses on fixing RGF bugs
323
-
324
- - Fixed [#64](https://github.com/MichaelXF/js-confuser/issues/64)
325
- - - RGF to properly handle Arrow functions and function expressions
326
-
327
- - RGF will no longer change getter/setter methods
328
-
329
- - RGF will no longer change class methods
330
-
331
- - RGF now works when using `mangled` variable names
332
-
333
- - Minify will remove unreachable code following a Throw statement
334
-
335
- # `1.5.5`
336
- Updates
337
-
338
- - Fixed [#53](https://github.com/MichaelXF/js-confuser/issues/53)
339
- - - Shuffle to not use common variable names like `x`
340
-
341
- - Fixed [#60](https://github.com/MichaelXF/js-confuser/issues/60)
342
- - - Rename Variables to properly handle function parameters
343
-
344
- - Fixed [#62](https://github.com/MichaelXF/js-confuser/issues/62)
345
- - - Rename Variables to properly handle catch-clause parameters
346
-
347
- # `1.5.4`
348
- Small fix
349
-
350
- - Fixed [#45](https://github.com/MichaelXF/js-confuser/issues/45)
351
- - - Opaque predicates fixed to not this cause error
352
-
353
-
354
- # `1.5.3`
355
- Shuffle fix
356
-
357
- - Fixed [#48](https://github.com/MichaelXF/js-confuser/issues/48)
358
- - - Shuffle was re-assigning `const` variables, fixed in this version.
359
-
360
- # `1.5.2`
361
- Mini fixes
362
-
363
- - Fixed [#41](https://github.com/MichaelXF/js-confuser/issues/41)
364
- - - Obfuscator mishandled switch statements with a `default` case
365
-
366
- - Fixed [#43](https://github.com/MichaelXF/js-confuser/issues/43)
367
- - - Obfuscator mishandled variable destructuring in for-loops
368
-
369
- # `1.5.1`
370
- Object Extraction Fix
371
-
372
- - Fixed [#37](https://github.com/MichaelXF/js-confuser/issues/37)
373
- - - Object Extraction was applying to objects with get/set methods, fixed in this version.
374
-
375
- - Slight improvement to `Flatten`
376
-
377
- # `1.5.0`
378
- Hexadecimal Numbers
379
-
380
- - The hexadecimal representation can now be used. [#29](https://github.com/MichaelXF/js-confuser/issues/29)
381
- - New option `hexadecimalNumbers` to control this behavior.
382
-
383
- ### `hexadecimalNumbers`
384
-
385
- Uses the hexadecimal representation (`50` -> `0x32`) for numbers. (`true/false`) -->
386
-
387
- - Slight improvement to `Control Flow Flattening`
388
- - Slight improvement to `Calculator`
389
-
390
- # `1.4.3`
391
- Minify Fix
392
-
393
- - Fixed [#34](https://github.com/MichaelXF/js-confuser/issues/34)
394
- - - Minify was removing `return` statements too aggressively, fixed in this version.
395
-
396
- - Slight improvement to Control Flow Flattening
397
-
398
- # `1.4.2`
399
- Eval Fix
400
-
401
- - Fixed [#31](https://github.com/MichaelXF/js-confuser/issues/31)
402
- - - Eval and Integrity didn't work together, fixed in this version.
403
-
404
- # `1.4.1`
405
- AntiDebug Fix
406
-
407
- - Fixed [#28](https://github.com/MichaelXF/js-confuser/issues/28)
408
- - - AntiDebug was causing syntax errors in some scenarios, fixed in this version.
409
-
410
- # `1.4.0`
411
- Confusing Control Flow
412
-
413
- - `Control Flow Flattening` overhaul, now flattens embedded control structures
414
-
415
- - - `If statements`
416
- - - `For statements`
417
- - - `While statements`
418
- - - `Switch statements`
419
- - - `Do While statements`
420
-
421
- - - Certain functions
422
-
423
- ```js
424
- // Input
425
- console.log(1);
426
- console.log(2);
427
- console.log(Number("3"));
428
-
429
- for (var i = 4; i < 6; i++) {
430
- console.log(i);
431
- }
432
-
433
- var i = 0;
434
- do {
435
- console.log(i + 6);
436
- } while (i++ < 4);
437
-
438
- // Output
439
- var a = -123, b = 414, c = -191;
440
- while (a + b + c != 104) {
441
- var d = (a + b + c) * -28 + 172;
442
- switch (d) {
443
- case -276:
444
- !(a *= 138 > b ? 2 : 158, a -= -5 < c ? -90 : -152, b *= b + 206, b -= a + -539, c += b + -372);
445
- break;
446
- case -2628:
447
- var e = (console['log'](-106 > c ? 1 : 182), console['log'](a + 125), console['log'](Number('3')), -87 < a ? -189 < a ? -133 : 93 : 107 < c ? 227 : 4);
448
- ~(a *= (-114 > c ? -164 : -107) < c ? -164 : 2, a -= 188 > b ? b + -211 : -369, b += -62 > c ? 168 > c ? -539 : 56 : 26, c += (c + 362 > a ? 73 : -157) < b ? 207 : 341);
449
- break;
450
- case -4420:
451
- +(a *= a + (a + 18), a -= 190 > a ? -344 : 71, b *= -206 < b ? c + -173 : -221, b -= b + 94, c += 89 > b ? -311 : 170);
452
- break;
453
- case -3972:
454
- if (e < c + -144) {
455
- !(a *= b + 127, a -= b + (b + 671), b += c + 82, c *= 61 < a ? -139 : 2, c -= b + -35);
456
- break;
457
- }
458
- typeof (a *= c + -148, a -= c + 271, b += c + 184, c += -89 < c ? -42 : -114);
459
- break;
460
- case -3244:
461
- +(a += a + 220, b += b + 317, c += b + -218);
462
- break;
463
- case -4308:
464
- !(a += 134 < b ? -233 : 89, b += -79 < b ? -69 : -241, c *= -107 > a ? -97 : 2, c -= (56 < a ? -27 : -184) > c ? -163 : 231);
465
- break;
466
- case -3664:
467
- ~(a += b + -362, b += -87 < b ? -666 : -172, c += c + 710);
468
- break;
469
- case -5344:
470
- +(a *= c + (-165 < a ? -266 : 182) > c ? 124 : 2, a -= -154 > b ? c + 92 : -388, b += c + -193, c *= c + (c + -30), c -= a + -11);
471
- break;
472
- case -2572:
473
- if (e++ < ((-125 < a ? -62 : 87) < c ? -112 : 4)) {
474
- ~(a += c + -268, b += 215 < b ? 136 : 18 < b ? -233 : 536, c += b + -535);
475
- break;
476
- }
477
- ~(a *= (123 > a ? -105 : 238) < b ? 216 : 2, a -= a + 57, b *= a + 59, b -= a + -369, c *= b + -236, c -= 200 > c ? -288 : -11);
478
- break;
479
- case -4784:
480
- +(console['log'](e), a *= c + -223, a -= 7 > c ? -227 > b ? -4 : 192 : -157, b *= a + (-186 > b ? 211 : 17), b -= -127 > c ? 76 : 280, c *= -63 > c ? a + 264 : 2, c -= (119 < c ? -206 : 85) < a ? 215 : 179);
481
- break;
482
- case -724:
483
- void (console['log'](e + (c + -246)), a *= -177 < c ? 2 : 207, a -= 152 > a ? 122 : -190, b *= c + -250, b -= b + 160, c += -141 < a ? a + 258 : 21);
484
- break;
485
- case -3804:
486
- var e = -143 > a ? 0 : 24;
487
- typeof (a += c + -9, b += c + 125, c += a + -261);
488
- break;
489
- case -1648:
490
- ~(e++, a += a + 3, b *= c + 68, b -= 89 < b ? -173 > b ? -147 : 267 : -228 > c ? -80 : -216 > b ? 93 : 68, c += 65 > a ? b + 156 : 216);
491
- break;
492
- }
493
- }
494
- ```
495
-
496
- - New encoding type `Hex Table`
497
-
498
- ```js
499
- "{0x7E494534,0x688,0x7E6D53,0x401,0x7E584D4B,0x688,0x7E775853,0x688,0x7E5333,0x81}"
500
-
501
- // => "Hello World"
502
- ```
503
-
504
- - Improvements to renaming labels
505
- - Fixed [#24](https://github.com/MichaelXF/js-confuser/issues/24)
506
- - Fixed [#25](https://github.com/MichaelXF/js-confuser/issues/25)
507
- - Fixed [#26](https://github.com/MichaelXF/js-confuser/issues/26)
508
-
509
- # `1.3.0`
510
- String Splitting Improvement
511
-
512
- - `String Splitting` now supports percentages and a custom callback. ([#22](https://github.com/MichaelXF/js-confuser/issues/22))
513
-
514
- ```js
515
- {
516
- // percentage
517
- stringSplitting: 0.75, // = 75%
518
-
519
- // exclude certain strings
520
- stringSplitting: (str)=>{
521
- if ( str == "dont-split-string" ) {
522
- return false;
523
- }
524
-
525
- return true;
526
- },
527
- }
528
- ```
529
-
530
- # `1.2.2`
531
- Global name fix
532
-
533
- - **Bug fix**: `Rename Variables` breaking access to global variables
534
-
535
- ```js
536
- // Say `a` is a global library
537
- // Input
538
- function myFunction(param1){
539
- a(param1);
540
- }
541
-
542
- // Output on 1.2.1
543
- function a(a){
544
- a(a);
545
- }
546
-
547
- // Output on 1.2.2
548
- function b(b){
549
- a(b);
550
- }
551
- ```
552
-
553
- - **Bug fix**: `Flatten` to not accidentally remove function parameters
554
- - **Bug fix**: `Dispatcher` on function calls within classes
555
- - **Bug fix**: `Minify` fixed syntax error
556
-
557
- ```js
558
- // Input
559
- var o = {Infinity: 0};
560
-
561
- // Output on 1.2.1
562
- var o = {1/0: 0};
563
-
564
- // Output on 1.2.2
565
- var o = {[1/0]: 0};
566
- ```
567
-
568
- - Added `base32` encoding to `String Concealing`
569
- - `Minify` improvements
570
- - - `true` -> `!0`
571
- - - `false` -> `!1`
572
- - Subtle changes to `String Compression`
573
- - Updated presets
574
-
575
- # `1.2.1`
576
- Bug fixes
577
-
578
- - **Bug fix**: `Control Flow Flattening` on classes no longer creates syntax errors
579
- - **Bug fix**: `String Concealing` will check for duplicate strings
580
- - **Bug fix**: `String Concealing` now handles class properties
581
- - **Bug fix**: `Stack` and `Control Flow Flattening` no longer modifies floats
582
-
583
- - **New API:**
584
-
585
- ## `obfuscateAST(AST, options)`
586
-
587
- Obfuscates an [ESTree](https://github.com/estree/estree) compliant AST. Returns a [`Promise`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise).
588
-
589
- **Note:** Mutates the object.
590
-
591
- | Parameter | Type | Description |
592
- | --- | --- | --- |
593
- | `AST` | `object` | The [ESTree](https://github.com/estree/estree) compliant AST. This object will be mutated. |
594
- | `options` | `object` | The obfuscator settings. |
595
-
596
- # `1.2.0`
597
- Bug fixes
598
-
599
- - **Bug fix**: `Eval` moves function declarations to the top of the lexical block
600
- - **Bug fix**: `Stack` no longers changes function declarations
601
- - Improvements to `Stack` rotations
602
-
603
- ```js
604
- // Input
605
- function add3(x,y,z){
606
- ok(typeof x === "number");
607
- ok(typeof y === "number");
608
- ok(typeof z === "number");
609
-
610
- return x + y + z;
611
- }
612
-
613
- console.log(add3(1,2,3))
614
-
615
- // Output on 1.1.9
616
- function _WFZLw(..._WFZLw) {
617
- void (_WFZLw.length = 3, ok(typeof _WFZLw[0] === 'number'), ok(typeof _WFZLw[1] === 'number'), ok(typeof _WFZLw[2] === 'number'));
618
- return _WFZLw[0] + _WFZLw[1] + _WFZLw[2];
619
- }
620
- console['log'](_WFZLw(1, 2, 3));
621
-
622
- // Output on 1.2.0
623
- var KZ6LyAL = (...KZ6LyAL) => {
624
- ~(KZ6LyAL.length = 3, ok(typeof KZ6LyAL[0] === 'number'), KZ6LyAL[186] = KZ6LyAL[0], ok(typeof KZ6LyAL[1] === 'number'), KZ6LyAL[227] = -22, ok(typeof KZ6LyAL[KZ6LyAL[KZ6LyAL[227] + 249] + 24] === 'number'));
625
- return KZ6LyAL[KZ6LyAL[227] - (KZ6LyAL[227] - 186)] + KZ6LyAL[KZ6LyAL[227] + 23] + KZ6LyAL[KZ6LyAL[KZ6LyAL[227] + 249] - (KZ6LyAL[227] - (KZ6LyAL[227] + 24))];
626
- };
627
- console.log(KZ6LyAL(1, 2, 3));
628
- ```
629
-
630
- # `1.1.9`
631
- Browser Lock and OS Lock
632
-
633
- - Added `Browser Lock` and `OS Lock`
634
-
635
- | Mode | Target | Method |
636
- | --- | --- | --- |
637
- | `Browser Lock` | `"browser"` | Checks `window.navigator.userAgent` |
638
- | `Browser Lock` | `"node"` | N/A |
639
- | `OS Lock` | `"browser"` | Checks `window.navigator.userAgent` |
640
- | `OS Lock` | `"node"` | Checks `require('os').platform()` |
641
-
642
- ---
643
-
644
- - #### `Browser Lock`
645
-
646
- - Array of browsers where the script is allowed to run. (`string[]`)
647
-
648
- - - Potency Low
649
- - - Resilience Medium
650
- - - Cost Medium
651
-
652
- - Allowed values: `"firefox"`, `"chrome"`, `"iexplorer"`, `"edge"`, `"safari"`, `"opera"`
653
-
654
- - Example: `["firefox", "chrome"]`
655
-
656
- ---
657
-
658
- - #### `OS Lock`
659
-
660
- - Array of operating-systems where the script is allowed to run. (`string[]`)
661
-
662
- - - Potency Low
663
- - - Resilience Medium
664
- - - Cost Medium
665
-
666
- - Allowed values: `"linux"`, `"windows"`, `"osx"`, `"android"`, `"ios"`
667
-
668
- - Example: `["linux", "windows"]`
669
-
670
- ---
671
-
672
- - **Bug fix**: `Moved Declarations` no longer applies to loops
673
- - - Previously broke Switch statements
674
-
675
- - `String Splitting` use larger chunk sizes to avoid creating too many strings
676
-
677
- Available now on NPM: https://www.npmjs.com/package/js-confuser
678
-
679
- # `1.1.8`
680
- Bug Fixes and Improvements
681
-
682
- - **Bug fix**: Stack no longer replaces identifiers that are in nested contexts
683
-
684
- - `es5` converts
685
- - - `fn(...args)` -> `fn.apply(this, args)`
686
- - - `fn(...arguments)` -> `fn.apply(this, [].concat(Array.prototype.slice.call(arguments)))`
687
-
688
- - Changes to `identifierGenerator`
689
- - - `mangled` Now uses both lowercase and uppercase alphabets
690
-
691
- - Added `antiTooling` to stop [JSNice.org](https://JSNice.org) from expanding sequence expressions
692
-
693
- ```js
694
- // Input
695
- (console.log(1), console.log(2), console.log(3))
696
-
697
- // Output
698
- +(console.log(1), console.log(2), console.log(3))
699
-
700
- // JSNice on Input
701
- console.log(1)
702
- console.log(2)
703
- console.log(3)
704
-
705
- // JSNice on Output
706
- +(console.log(1), console.log(2), console.log(3))
707
- ```
708
-
709
- - Improved `controlFlowFlattening`
710
- - - No longer changes blocks with `const` variables
711
- - - Now obscures order of expressions
712
- ```js
713
- // Input
714
- console.log(1)
715
- console.log(2)
716
- console.log(3)
717
- console.log(4)
718
- var five = 5;
719
- console.log(five);
720
-
721
- // Output
722
- var oI8J9w6 = (console['log'](1), console['log'](2), console['log'](3), console['log'](4), 5);
723
- console['log'](oI8J9w6);
724
- ```
725
-
726
- - - Now entangles number literals with the state variables ex:
727
-
728
- ```js
729
- // Input
730
- console.log(1);
731
- console.log(2);
732
- console.log(3);
733
- console.log(4);
734
- console.log(5);
735
- console.log(6);
736
- console.log(7);
737
- console.log(8);
738
- console.log(9);
739
- console.log(10);
740
-
741
- // Output
742
- var xYPTGP = -164, NYvTJV = -40, eB6EbU = 55, cD8ztD = -73, AnCfc3A = 237, n6wikC = 52;
743
- while (xYPTGP + NYvTJV + eB6EbU + cD8ztD + AnCfc3A + n6wikC != 33) {
744
- var ruVzem = (xYPTGP + NYvTJV + eB6EbU + cD8ztD + AnCfc3A + n6wikC) * -184 - 38;
745
- switch (ruVzem) {
746
- case -3350:
747
- console.log(4), (NYvTJV *= -66 > AnCfc3A ? n6wikC + (134 > xYPTGP ? -190 : 194) : 2, NYvTJV -= 77 < xYPTGP ? 28 : 66), xYPTGP += AnCfc3A - 201, (AnCfc3A *= n6wikC + 109, AnCfc3A -= 16 < NYvTJV ? 661 : -169);
748
- break;
749
- case -26902:
750
- console.log(31 > AnCfc3A ? 39 : -2 > AnCfc3A ? -137 : 3), (NYvTJV *= -174 > n6wikC ? AnCfc3A - 292 : 2, NYvTJV -= n6wikC - 91), (eB6EbU *= 155 > cD8ztD ? 2 : 42, eB6EbU -= 155 > AnCfc3A ? 1 : -227), (cD8ztD *= 183 < eB6EbU ? 222 : 2, cD8ztD -= 214 < AnCfc3A ? 270 : 70);
751
- break;
752
- case -12366:
753
- console.log(196 < eB6EbU ? -5 : 1), eB6EbU += -47 > cD8ztD ? -225 : 57, (xYPTGP *= AnCfc3A - 235, xYPTGP -= -126 < eB6EbU ? 46 : -434);
754
- break;
755
- case -20646:
756
- console.log(2), (n6wikC *= cD8ztD + 75, n6wikC -= ((107 > xYPTGP ? -244 : -80) > cD8ztD ? 65 : 149) > cD8ztD ? -138 > eB6EbU ? cD8ztD + 284 : 159 : 73 < AnCfc3A ? -14 : 83), AnCfc3A += xYPTGP - 95 < n6wikC ? 199 : 147, xYPTGP += 227 < xYPTGP ? -238 : 46;
757
- break;
758
- case -10526:
759
- console.log(10), xYPTGP += n6wikC + 524, n6wikC += cD8ztD + 263, (AnCfc3A *= 67 > xYPTGP ? n6wikC + (xYPTGP - 433 > n6wikC ? -21 : -111) : 2, AnCfc3A -= AnCfc3A + 247);
760
- break;
761
- case -2614:
762
- console.log(5), (n6wikC *= xYPTGP - 333, n6wikC -= (-41 > cD8ztD ? -38 > AnCfc3A ? 96 : -97 : 49) < NYvTJV ? 131 : 112), (cD8ztD *= eB6EbU + 115, cD8ztD -= -216 < AnCfc3A ? -631 : 23), (AnCfc3A *= (NYvTJV + 1 > xYPTGP ? 235 : 206) < n6wikC ? n6wikC + 310 : 2, AnCfc3A -= NYvTJV - 236), (xYPTGP *= 185 > eB6EbU ? -169 < xYPTGP ? 2 : 236 : -19, xYPTGP -= -59 < n6wikC ? 100 : n6wikC + 779);
763
- break;
764
- case -5006:
765
- console.log(6), (cD8ztD *= cD8ztD + (-100 < n6wikC ? -66 : 203), cD8ztD -= -87 < eB6EbU ? -101 : -261);
766
- break;
767
- case -16046:
768
- console.log(240 > AnCfc3A ? -70 : 7), (NYvTJV *= AnCfc3A - 240, NYvTJV -= 240 > AnCfc3A ? -66 : 304), AnCfc3A += eB6EbU - 76, (eB6EbU *= 154 > NYvTJV ? xYPTGP - 234 : 103 > xYPTGP ? -138 : 2, eB6EbU -= AnCfc3A - 409);
769
- break;
770
- case -9974:
771
- console.log(NYvTJV + (-225 > AnCfc3A ? -98 : -103)), xYPTGP += n6wikC + 260, eB6EbU += NYvTJV - 67, (AnCfc3A *= eB6EbU - 173, AnCfc3A -= eB6EbU - 132 < NYvTJV ? 19 : -107 > NYvTJV ? 145 : -44);
772
- break;
773
- case -8318:
774
- console.log(AnCfc3A - 45), (n6wikC *= -126 < xYPTGP ? 2 : 53, n6wikC -= n6wikC + 336);
775
- }
776
- }
777
- ```
778
-
779
- Available now on NPM: https://www.npmjs.com/package/js-confuser
780
-
781
- # `1.1.7`
782
- Website is Live
783
-
784
- - [https://master--hungry-shannon-c1ce6b.netlify.app/](https://master--hungry-shannon-c1ce6b.netlify.app/) is live!
785
- - Check out the [js-confuser-website](https://github.com/MichaelXF/js-confuser-website) repo for more info
786
-
787
- - **⚠️ Breaking change**: `Rename Globals` is now enabled by default
788
- - **Bug fix**: `Dead Code` no longers adds async code when `es5` option is enabled
789
- - Improved `Control Flow Flattening`
790
-
791
- # `1.1.6`
792
- New feature: Name Recycling
793
-
794
- - **New feature:** `nameRecycling`
795
- - - Attempts to reuse released names.
796
- - - Potency Medium
797
- - - Resilience High
798
- - - Cost Low
799
-
800
- ```js
801
- // Input
802
- function percentage(decimal) {
803
- var multiplied = x * 100;
804
- var floored = Math.floor(multiplied);
805
- var output = floored + "%"
806
- return output;
807
- }
808
-
809
- // Output
810
- function percentage(decimal) {
811
- var multiplied = x * 100;
812
- var floored = Math.floor(multiplied);
813
- multiplied = floored + "%";
814
- return multiplied;
815
- }
816
- ```
817
-
818
- - `delete` operator is now properly parsed
819
- - No longers changes `constructor` method on classes
820
- - Added two new Dead Code samples and fixed one
821
- - RGF now skips async and generator functions
822
- - Object Extraction now places the extracted properties in the same position as the declaration
823
- - Name Conflicts disabled to speed up obfuscation times
824
- - Improvements to Minify
825
- (better Variable Grouping)
826
- - The `renameGlobals` option now has affect
827
-
828
- Available now on NPM: https://www.npmjs.com/package/js-confuser
829
-
830
- # `1.1.5`
831
- Performance Improvements
832
-
833
- - **Bug fix**: Object Extraction
834
- - - Improved safety checks (searches further down tree)
835
- - - No longer applies to empty objects
836
-
837
- - String Concealing results are now cached
838
-
839
- - Minification improvements
840
- - - `a += -1` -> `a -= 1`
841
- - - `a -= -1` -> `a += 1`
842
- - - `a + -b` -> `a - b`
843
- - - `a - -b` -> `a + b`
844
-
845
- - Dispatcher no longer applies to redefined functions
846
-
847
- - Ensure `controlFlowFlattening` numbers don't get too large
848
- (hardcoded limit of 100,000)
849
-
850
- - Opaque Predicates now excludes await expressions
851
-
852
- Available now on NPM: https://www.npmjs.com/package/js-confuser
853
-
854
- # `1.1.4`
855
- Improved ES5 Support
856
-
857
- - Full support for transpiling [ES6 template strings](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals)
858
- - - Added `.raw` property for Tagged Template Literals
859
-
860
- - Transpiling [ES6 Classes](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Classes) down to ES5-compatible code
861
- - Transpiling the [ES6 spread operator in arrays](https://www.samanthaming.com/tidbits/92-6-use-cases-of-spread-with-array/)
862
- - Transpiling the [ES6 spread operator in objects](https://lucybain.com/blog/2018/js-es6-spread-operator/)
863
-
864
- - Improved `controlFlowFlattening` to use multiple state variables
865
- - Added chained-calls to `duplicateLiteralsRemoval`, similar to obfuscator.io's [`stringArrayWrappersChainedCalls`](https://github.com/javascript-obfuscator/javascript-obfuscator) option
866
-
867
- Available now on NPM: https://www.npmjs.com/package/js-confuser
868
-
869
- # `1.1.3`
870
- Minification Changes
871
-
872
- - Fixed minification errors
873
- - - No longer accidentally removes function declarations/class declarations
874
-
875
- - RGF Changes
876
- - - Function cannot rely on `this`
877
- - - Better support with `renameVariables`
878
-
879
- - Opaque Predicate Changes
880
- - - Now correctly applies to switch case tests
881
-
882
- - Fixed Flatten bug causing undefined return values
883
-
884
- - Support for transpiling [ES6 template strings](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals)
885
-
886
- Available now on NPM: https://www.npmjs.com/package/js-confuser
887
-
888
- # `1.1.2`
889
- New String Compression feature and Fixed Syntax errors
890
-
891
- - **New feature**: `stringCompression`
892
- - - String Compression uses LZW's compression algorithm to reduce file size. (`true/false/0-1`)
893
- - - `"console"` -> `inflate('replaĕ!ğğuģģ<~@')`
894
- - - Potency High
895
- - - Resilience Medium
896
- - - Cost Medium
897
-
898
- - Fixed error with String encoding
899
-
900
- - Fixed syntax error from obfuscating destructuring with computed keys
901
- - Fixed syntax error when getters/setters were being converted to arrow functions
902
- - Integrity fixes:
903
- - - Better support with Dispatcher
904
- - - Better support with Calculator
905
-
906
- Available now on NPM: https://www.npmjs.com/package/js-confuser
907
-
908
- # `1.1.1`
909
- General fixes
910
- - No longer encodes `"use strict"` and other directives
911
- - No longer encodes `require("str")` or `import("str")` strings
912
-
913
- - Fixed several `controlFlowFlattening` bugs:
914
- Fixed rare code corruption when nested
915
- Fixed obfuscation on `for` and `while` loops
916
-
917
- - Fixed `stack` from creating syntax errors
918
- (No longer applies to for-loop initializers)
919
-
920
- - Fixed renaming identifiers in object destructing
921
- - Better support for `let` variables
922
-
923
- - Checks for invalid options
924
- - Increased test coverage to 90%
925
-
926
- - `debugTransformations`, `Obfuscator` and `Transform` objects exposed.
927
-
928
- Available now on NPM: https://www.npmjs.com/package/js-confuser
929
-
930
- # `1.1.0`
931
- New feature: Stack, and various improvements
932
- - **New feature:** `stack`
933
- Local variables are consolidated into a rotating array. (`true/false/0-1`)
934
- [Similar to Jscrambler's Variable Masking](https://docs.jscrambler.com/code-integrity/documentation/transformations/variable-masking)
935
- - Potency Medium
936
- - Resilience Medium
937
- - Cost Low
938
-
939
- ```js
940
- // input
941
- function add3(x, y, z){
942
- return x + y + z;
943
- }
944
-
945
- // output
946
- function add3(...AxaSQr){AxaSQr.length=3;return AxaSQr.shift()+AxaSQr.shift()+AxaSQr.shift()}
947
- ```
948
-
949
- - Improvements to `flatten`
950
- - Properly renames `let` variables now
951
- - Improvements to `dispatcher`
952
-
953
- Available now on NPM: https://www.npmjs.com/package/js-confuser
954
-
955
- # `1.0.9`
956
- Support for lower versions of NodeJS
957
-
958
- - Adjusted babel config to be more forgiving to the older versions of NodeJS.
959
-
960
-
961
- # `1.0.8`
962
- New shuffle feature and improvements
963
- - New feature for shuffle:
964
- `hash` - Shift based on the hash of the array contents
965
- If the hash changes, the order of the array will be messed up causing your program to brick.
966
-
967
- - Lock improvements
968
- Fixed issue with `nativeFunctions`
969
- Now errors when `countermeasures` callback can't be found.
970
- Countermeasures callback works with `Integrity`.
971
- New rules for `countermeasures` callback:
972
- Must be top-level,
973
- No references to locked code (otherwise infinite loop)
974
-
975
- - General improvements
976
- Updated presets and documentation
977
- Added `index.d.ts` for type-intellisense
978
-
979
- Available now on NPM: https://www.npmjs.com/package/js-confuser
980
-
981
-
982
-
983
- # `1.0.7`
984
- Integrity fixed
985
- - Integrity Improvements
986
- - - Countermeasures function works with Integrity
987
- - - Fixed hashing issues
988
- - - - Wrote more tests for integrity
989
- - Documentation Update
1
+ # `2.0.1`
2
+ Fixes
3
+
4
+ - Fixed [#167](https://github.com/MichaelXF/js-confuser/issues/167)
5
+ - Fixed [#190](https://github.com/MichaelXF/js-confuser/issues/190)
6
+
7
+ - Improved `Control Flow Flattening`
8
+ - - Fixed implicit return bug causing incorrect return values
9
+ - - The switch-case transitions now are computed by other state variables
10
+ - - No longer lifted by [nullableVoidPtr's deobfuscator](https://github.com/nullableVoidPtr/deobf) - a complete CFF-in-CFF solver
11
+
12
+ ```js
13
+ // Input code:
14
+ console.log(1)
15
+
16
+ // 2.0.0
17
+ case 245:
18
+ console["log"](1);
19
+ ((c += -311), (d += 251), (e += 346));
20
+ break;
21
+
22
+ // 2.0.1
23
+ case 245:
24
+ console["log"](1);
25
+ ((c += e - -174), (d += e - -114), (e += c - 329));
26
+ break;
27
+ ```
28
+
29
+ # `2.0.0`
30
+ 2.0 Rewrite 🎉
31
+
32
+ ### Complete rewrite of JS-Confuser using Babel! 🎉
33
+
34
+ **⚠️ Breaking changes**
35
+
36
+ > Check out the [Migration guide](./Migration.md) on how to properly update from 1.X to 2.0. The obfuscation upgrades in 2.0 are worth the small refactoring.
37
+
38
+ - Revamped API Interface
39
+
40
+ - - JSConfuser.obfuscate() resolves to an object
41
+
42
+ | Property | Type | Description |
43
+ | --- | --- | --- |
44
+ | `code` | `string` | The obfuscated code. |
45
+
46
+ - Renamed `Stack` to `Variable Masking`
47
+
48
+ - Added configurable limits to options:
49
+
50
+ ```js
51
+ const options = {
52
+ target: "node",
53
+
54
+ rgf: {
55
+ value: 0.5, // = 50% of eligible functions
56
+ limit: 10 // Maximum of 10 changes for performance reasons
57
+ },
58
+
59
+ // Original format is still valid (No limit applied)
60
+ rgf: 0.5
61
+ }
62
+ ```
63
+
64
+ ### 2.0 Changes
65
+
66
+ - Added [Custom String Encoding](https://js-confuser.com/docs/options/customStringEncodings) and [Custom Lock Code](https://js-confuser.com/docs/options/customLocks) options
67
+
68
+ - Added `Rename Labels` [Learn more here](https://js-confuser.com/docs/options/renamelabels#rename-labels)
69
+
70
+ - Added `Pack` [Learn more here](https://js-confuser.com/docs/options/pack#pack)
71
+
72
+ - RGF no longers uses `new Function` instead uses `eval`
73
+
74
+ - Improved code transforms!
75
+
76
+ - Improved `Control Flow Flattening`
77
+
78
+ - - Obfuscates the [Call Graph](https://en.wikipedia.org/wiki/Call_graph)
79
+
80
+ - - Now supports lexical bindings (`let`, `const`, `class`)
81
+
82
+ - - `with () { }` statement obfuscation
83
+
84
+ - Improved `Minify`
85
+
86
+ - - Removes unused variables and functions
87
+
88
+ - Improved `Moved Declaration` ability to move variables as unused function parameters
89
+
90
+ - Improved `String` transforms
91
+
92
+ - - [Template literals](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals) are now obfuscated (First converted into equivalent String Literal)
93
+
94
+ - - [Regular expressions](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_expressions) are now obfuscated (First converted into equivalent RegExp() constructor calls)
95
+
96
+ - - `String Compression` now uses LZ-string compression ([lz-string](https://www.npmjs.com/package/lz-string))
97
+
98
+ - New Comment Syntax
99
+
100
+ - - `/* @js-confuser-var */ "name"` for improved variable mappings, such as eval() calls
101
+
102
+ ```js
103
+ // Input
104
+ var name = "Internet User";
105
+ eval( "console.log(" + /* @js-confuser-var */ "name" + ")" );
106
+
107
+ // Output
108
+ var zC3PLKu = "Internet User";
109
+ eval("console.log(" + "zC3PLKu" + ")");
110
+ ```
111
+
112
+ Note: The function `__JS_CONFUSER_VAR__` is still supported.
113
+
114
+ ### JS-Confuser.com Revamp
115
+
116
+ A new UI for [JS-Confuser.com](https://js-confuser.com), featuring an advanced playground and documentation pages.
117
+
118
+ The previous version will remain available at [old--confuser.netlify.com](https://old--confuser.netlify.app/).
119
+
120
+ **Removed features**
121
+
122
+ - Removed `ES5` option - Use Babel Instead
123
+
124
+ - Removed `Browser Lock` and `OS Lock` - Use [Custom Locks](https://js-confuser.com/docs/options/customlocks#custom-locks) instead
125
+
126
+ - Removed `Shuffle`'s Hash option
127
+
128
+ - Removed `Indent` option
129
+
130
+
131
+ # `1.7.3`
132
+ Tamper Protection
133
+
134
+ ### `Tamper Protection`
135
+
136
+ Tamper Protection safeguards the runtime behavior from being altered by JavaScript pitfalls.
137
+
138
+ [Learn more here.](/docs/TamperProtection.md)
139
+
140
+ ---
141
+
142
+ - Rename Variables improvements:
143
+
144
+ - A new exposed function, `__JS_CONFUSER_VAR__`, can be used to access renamed variables. [Learn more here](/docs/RenameVariables.md).
145
+
146
+
147
+ ```js
148
+ // Input
149
+ var name = "John Doe";
150
+ eval("console.log(" + __JS_CONFUSER_VAR__(name) + ")");
151
+
152
+ // Output
153
+ var CA1HU0 = 'John Doe';
154
+ eval('console.log(' + 'CA1HU0' + ')');
155
+ ```
156
+
157
+ - Improved the `Zero Width` identifier generator (Thanks @doctor8296!)
158
+
159
+ - Pad the `String Concealing` array with more fake strings
160
+
161
+ - Improve `String Compression`
162
+
163
+ - New Web UI sneak peak: https://js-confuser.com/
164
+
165
+
166
+ # `1.7.2`
167
+ Updates
168
+
169
+ - `Anti Tooling` & `Expression Obfuscation` improvements
170
+ - - No longer expanded by [webcrack](https://github.com/j4k0xb/webcrack), [synchrony](https://github.com/relative/synchrony) & [REstringer](https://github.com/PerimeterX/restringer)
171
+
172
+ - `String Concealing` improvements
173
+ - - Randomizes the charset for each obfuscation
174
+ - - Place multiple decryption functions throughout the code
175
+ - - These changes aim to defeat [JSConfuser-String-Decryptor](https://github.com/0v41n/JSConfuser-String-Decryptor) and any other RegEx-based decoders
176
+
177
+ - `Moved Declarations` improvements
178
+ - - Now moves some variables as unused parameters on certain functions
179
+
180
+ - `RGF` improvements
181
+ - - More likely to transform functions containing functions
182
+
183
+ - Fixed [#96](https://github.com/MichaelXF/js-confuser/issues/96)
184
+ - - Removed hardcoded limits on `String Concealing`, `String Compression`, and `Duplicate Literals Removal`
185
+
186
+ - Fixed [#106](https://github.com/MichaelXF/js-confuser/issues/106)
187
+ - - Final fix with const variables for `Object Extraction`
188
+
189
+ - Fixed [#131](https://github.com/MichaelXF/js-confuser/issues/131)
190
+ - - __dirname is no longer changed by `Global Concealing`
191
+
192
+ **New Option**
193
+
194
+ ### `preserveFunctionLength`
195
+ - Modified functions will retain the correct `function.length` property. (`true/false`)
196
+ Enabled by default.
197
+
198
+ Minor improvements
199
+ - Preserve `function.length`
200
+ - Preserve Strict Mode behaviors
201
+ - Preserve indirect vs. direct [`eval`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval) use
202
+
203
+
204
+ # `1.7.1`
205
+ Updates
206
+
207
+ - Fixed [#107](https://github.com/MichaelXF/js-confuser/issues/107)
208
+ - - RGF and Integrity clash issue fixed
209
+
210
+ - Fixed [#106](https://github.com/MichaelXF/js-confuser/issues/106)
211
+ - - Object Extraction to properly handle `const` objects
212
+
213
+ - Fixed [#105](https://github.com/MichaelXF/js-confuser/issues/105)
214
+ - - Duplicate Literals Removal updated to not cause this error
215
+
216
+ - Fixed [#103](https://github.com/MichaelXF/js-confuser/issues/103)
217
+ - - Dispatcher will no longer apply to these types of functions to prevent this error
218
+
219
+ - Added documentation page for [ES5](https://github.com/MichaelXF/js-confuser/blob/master/docs/ES5.md)
220
+
221
+ - Rollup Plugin created: https://github.com/ayecue/rollup-js-confuser (Thanks @ayecue !)
222
+
223
+ # `1.7.0`
224
+ Updates
225
+
226
+ - Fixed [#89](https://github.com/MichaelXF/js-confuser/issues/89)
227
+ - - Flatten to not break functions with invalid identifier names
228
+
229
+ - Fixed [#88](https://github.com/MichaelXF/js-confuser/issues/88)
230
+ - - Stack to not break functions with syncing arguments
231
+
232
+ - Fixed [#91](https://github.com/MichaelXF/js-confuser/issues/91)
233
+ - - Minify to preserve function.length property
234
+
235
+ - Fixed [#95](https://github.com/MichaelXF/js-confuser/issues/95)
236
+ - - Rename Variables optimized to obfuscate much faster
237
+
238
+ - Added documentation pages for [RGF](https://github.com/MichaelXF/js-confuser/blob/master/docs/RGF.md) and [Control Flow Flattening](https://github.com/MichaelXF/js-confuser/blob/master/docs/ControlFlowFlattening.md)
239
+
240
+ - Removed `eval` option in favor of `rgf` option.
241
+
242
+ - - Removed the `"all"` option from `rgf`.
243
+
244
+ - Removed `nameRecycling` option
245
+
246
+ # `1.6.0`
247
+ Website Redesign + Updates
248
+
249
+ The website is now redesigned and live at [js-confuser.com](https://wwww.js-confuser.com)!
250
+
251
+ - Check out the source code for the website here: https://github.com/MichaelXF/js-confuser-website
252
+
253
+ #### New feature
254
+
255
+ ### `selfDefending`
256
+
257
+ Prevents the use of code beautifiers or formatters against your code.
258
+
259
+ [Identical to Obfuscator.io's Self Defending](https://github.com/javascript-obfuscator/javascript-obfuscator#selfdefending)
260
+
261
+ #### Improvements
262
+
263
+ - Fixed [#56](https://github.com/MichaelXF/js-confuser/issues/56)
264
+ - - Calculator improved to apply to more operators
265
+
266
+ - ES5 to handle destructuring member expressions
267
+
268
+ - Improved Control Flow Flattening techniques
269
+
270
+ - - Outlining expressions
271
+
272
+ - - Control object to store numbers and strings
273
+
274
+ - Updated the String concealing encoding algorithm
275
+
276
+ - Optimizations / Small fixes
277
+
278
+ # `1.5.9`
279
+ Big update
280
+
281
+ This updates comes with many bug fixes:
282
+
283
+ - Fixed [#72](https://github.com/MichaelXF/js-confuser/issues/72)
284
+ - - ES5 to handle Class Fields
285
+
286
+ Note: The `ES5` option is not meant to replace Babel. It is only intended to undo ES6 features the obfuscator may have added to your code.
287
+
288
+ - Fixed [#74](https://github.com/MichaelXF/js-confuser/issues/74)
289
+ - - Anti Tooling to not break Symbols
290
+
291
+ - Fixed [#75](https://github.com/MichaelXF/js-confuser/issues/75)
292
+ - - Minify to properly handle Object constructors
293
+
294
+ - Fixed [#76](https://github.com/MichaelXF/js-confuser/issues/76)
295
+ - - Minify to not cause syntax errors when objects used `^`, `` ` ``, `[`, `]` as property keys
296
+
297
+ - Fixed [#77](https://github.com/MichaelXF/js-confuser/issues/77)
298
+ - - Dispatcher to not break code that uses generic names like `toString` and `hasOwnProperty`
299
+
300
+ - Fixed [#78](https://github.com/MichaelXF/js-confuser/issues/78)
301
+ - - Object Extraction to not error on objects with spread elements
302
+
303
+ - Fixed [#79](https://github.com/MichaelXF/js-confuser/issues/79)
304
+ - - JsConfuser now supports `BigInt` literals
305
+
306
+ - Fixed [#80](https://github.com/MichaelXF/js-confuser/issues/80)
307
+ - - Rename Variables to not break code that had `var` and `let` variables in the same scope
308
+
309
+ - Fixed [#81](https://github.com/MichaelXF/js-confuser/issues/81)
310
+ - - Control Flow Flattening to not break `typeof` expressions
311
+
312
+ - Fixed [#82](https://github.com/MichaelXF/js-confuser/issues/82)
313
+ - - String Concealing to not break class constructors
314
+
315
+ # `1.5.8`
316
+ Several fixes
317
+
318
+ - Fixed [#46](https://github.com/MichaelXF/js-confuser/issues/46)
319
+ - - Updated the validation on `lock` options
320
+
321
+ - Fixed [#68](https://github.com/MichaelXF/js-confuser/issues/68)
322
+ - - Name Recycling fixed to not break certain function declarations
323
+
324
+ - Fixed [#69](https://github.com/MichaelXF/js-confuser/issues/69), [#70](https://github.com/MichaelXF/js-confuser/issues/70) and [#71](https://github.com/MichaelXF/js-confuser/issues/71)
325
+ - - Import statements to be properly handled
326
+
327
+ - Slight improvements to String Concealing
328
+
329
+ # `1.5.7`
330
+ Countermeasures function fixes
331
+
332
+ This update focuses on fixing Countermeasures bugs
333
+
334
+ The `countermeasures` is custom callback function to invoke when a lock is triggered.
335
+
336
+ - Fixed [#66](https://github.com/MichaelXF/js-confuser/issues/66)
337
+ - - RGF to properly handle the countermeasures function
338
+
339
+ - Added additional code to prevent an infinite loop from occurring
340
+
341
+ - Slight improvements to RGF
342
+
343
+ # `1.5.6`
344
+ Website changed and RGF fixes
345
+
346
+ The website is back at a different domain now: [https://master--hungry-shannon-c1ce6b.netlify.app/](https://master--hungry-shannon-c1ce6b.netlify.app/)
347
+
348
+ This update focuses on fixing RGF bugs
349
+
350
+ - Fixed [#64](https://github.com/MichaelXF/js-confuser/issues/64)
351
+ - - RGF to properly handle Arrow functions and function expressions
352
+
353
+ - RGF will no longer change getter/setter methods
354
+
355
+ - RGF will no longer change class methods
356
+
357
+ - RGF now works when using `mangled` variable names
358
+
359
+ - Minify will remove unreachable code following a Throw statement
360
+
361
+ # `1.5.5`
362
+ Updates
363
+
364
+ - Fixed [#53](https://github.com/MichaelXF/js-confuser/issues/53)
365
+ - - Shuffle to not use common variable names like `x`
366
+
367
+ - Fixed [#60](https://github.com/MichaelXF/js-confuser/issues/60)
368
+ - - Rename Variables to properly handle function parameters
369
+
370
+ - Fixed [#62](https://github.com/MichaelXF/js-confuser/issues/62)
371
+ - - Rename Variables to properly handle catch-clause parameters
372
+
373
+ # `1.5.4`
374
+ Small fix
375
+
376
+ - Fixed [#45](https://github.com/MichaelXF/js-confuser/issues/45)
377
+ - - Opaque predicates fixed to not this cause error
378
+
379
+
380
+ # `1.5.3`
381
+ Shuffle fix
382
+
383
+ - Fixed [#48](https://github.com/MichaelXF/js-confuser/issues/48)
384
+ - - Shuffle was re-assigning `const` variables, fixed in this version.
385
+
386
+ # `1.5.2`
387
+ Mini fixes
388
+
389
+ - Fixed [#41](https://github.com/MichaelXF/js-confuser/issues/41)
390
+ - - Obfuscator mishandled switch statements with a `default` case
391
+
392
+ - Fixed [#43](https://github.com/MichaelXF/js-confuser/issues/43)
393
+ - - Obfuscator mishandled variable destructuring in for-loops
394
+
395
+ # `1.5.1`
396
+ Object Extraction Fix
397
+
398
+ - Fixed [#37](https://github.com/MichaelXF/js-confuser/issues/37)
399
+ - - Object Extraction was applying to objects with get/set methods, fixed in this version.
400
+
401
+ - Slight improvement to `Flatten`
402
+
403
+ # `1.5.0`
404
+ Hexadecimal Numbers
405
+
406
+ - The hexadecimal representation can now be used. [#29](https://github.com/MichaelXF/js-confuser/issues/29)
407
+ - New option `hexadecimalNumbers` to control this behavior.
408
+
409
+ ### `hexadecimalNumbers`
410
+
411
+ Uses the hexadecimal representation (`50` -> `0x32`) for numbers. (`true/false`) -->
412
+
413
+ - Slight improvement to `Control Flow Flattening`
414
+ - Slight improvement to `Calculator`
415
+
416
+ # `1.4.3`
417
+ Minify Fix
418
+
419
+ - Fixed [#34](https://github.com/MichaelXF/js-confuser/issues/34)
420
+ - - Minify was removing `return` statements too aggressively, fixed in this version.
421
+
422
+ - Slight improvement to Control Flow Flattening
423
+
424
+ # `1.4.2`
425
+ Eval Fix
426
+
427
+ - Fixed [#31](https://github.com/MichaelXF/js-confuser/issues/31)
428
+ - - Eval and Integrity didn't work together, fixed in this version.
429
+
430
+ # `1.4.1`
431
+ AntiDebug Fix
432
+
433
+ - Fixed [#28](https://github.com/MichaelXF/js-confuser/issues/28)
434
+ - - AntiDebug was causing syntax errors in some scenarios, fixed in this version.
435
+
436
+ # `1.4.0`
437
+ Confusing Control Flow
438
+
439
+ - `Control Flow Flattening` overhaul, now flattens embedded control structures
440
+
441
+ - - `If statements`
442
+ - - `For statements`
443
+ - - `While statements`
444
+ - - `Switch statements`
445
+ - - `Do While statements`
446
+
447
+ - - Certain functions
448
+
449
+ ```js
450
+ // Input
451
+ console.log(1);
452
+ console.log(2);
453
+ console.log(Number("3"));
454
+
455
+ for (var i = 4; i < 6; i++) {
456
+ console.log(i);
457
+ }
458
+
459
+ var i = 0;
460
+ do {
461
+ console.log(i + 6);
462
+ } while (i++ < 4);
463
+
464
+ // Output
465
+ var a = -123, b = 414, c = -191;
466
+ while (a + b + c != 104) {
467
+ var d = (a + b + c) * -28 + 172;
468
+ switch (d) {
469
+ case -276:
470
+ !(a *= 138 > b ? 2 : 158, a -= -5 < c ? -90 : -152, b *= b + 206, b -= a + -539, c += b + -372);
471
+ break;
472
+ case -2628:
473
+ var e = (console['log'](-106 > c ? 1 : 182), console['log'](a + 125), console['log'](Number('3')), -87 < a ? -189 < a ? -133 : 93 : 107 < c ? 227 : 4);
474
+ ~(a *= (-114 > c ? -164 : -107) < c ? -164 : 2, a -= 188 > b ? b + -211 : -369, b += -62 > c ? 168 > c ? -539 : 56 : 26, c += (c + 362 > a ? 73 : -157) < b ? 207 : 341);
475
+ break;
476
+ case -4420:
477
+ +(a *= a + (a + 18), a -= 190 > a ? -344 : 71, b *= -206 < b ? c + -173 : -221, b -= b + 94, c += 89 > b ? -311 : 170);
478
+ break;
479
+ case -3972:
480
+ if (e < c + -144) {
481
+ !(a *= b + 127, a -= b + (b + 671), b += c + 82, c *= 61 < a ? -139 : 2, c -= b + -35);
482
+ break;
483
+ }
484
+ typeof (a *= c + -148, a -= c + 271, b += c + 184, c += -89 < c ? -42 : -114);
485
+ break;
486
+ case -3244:
487
+ +(a += a + 220, b += b + 317, c += b + -218);
488
+ break;
489
+ case -4308:
490
+ !(a += 134 < b ? -233 : 89, b += -79 < b ? -69 : -241, c *= -107 > a ? -97 : 2, c -= (56 < a ? -27 : -184) > c ? -163 : 231);
491
+ break;
492
+ case -3664:
493
+ ~(a += b + -362, b += -87 < b ? -666 : -172, c += c + 710);
494
+ break;
495
+ case -5344:
496
+ +(a *= c + (-165 < a ? -266 : 182) > c ? 124 : 2, a -= -154 > b ? c + 92 : -388, b += c + -193, c *= c + (c + -30), c -= a + -11);
497
+ break;
498
+ case -2572:
499
+ if (e++ < ((-125 < a ? -62 : 87) < c ? -112 : 4)) {
500
+ ~(a += c + -268, b += 215 < b ? 136 : 18 < b ? -233 : 536, c += b + -535);
501
+ break;
502
+ }
503
+ ~(a *= (123 > a ? -105 : 238) < b ? 216 : 2, a -= a + 57, b *= a + 59, b -= a + -369, c *= b + -236, c -= 200 > c ? -288 : -11);
504
+ break;
505
+ case -4784:
506
+ +(console['log'](e), a *= c + -223, a -= 7 > c ? -227 > b ? -4 : 192 : -157, b *= a + (-186 > b ? 211 : 17), b -= -127 > c ? 76 : 280, c *= -63 > c ? a + 264 : 2, c -= (119 < c ? -206 : 85) < a ? 215 : 179);
507
+ break;
508
+ case -724:
509
+ void (console['log'](e + (c + -246)), a *= -177 < c ? 2 : 207, a -= 152 > a ? 122 : -190, b *= c + -250, b -= b + 160, c += -141 < a ? a + 258 : 21);
510
+ break;
511
+ case -3804:
512
+ var e = -143 > a ? 0 : 24;
513
+ typeof (a += c + -9, b += c + 125, c += a + -261);
514
+ break;
515
+ case -1648:
516
+ ~(e++, a += a + 3, b *= c + 68, b -= 89 < b ? -173 > b ? -147 : 267 : -228 > c ? -80 : -216 > b ? 93 : 68, c += 65 > a ? b + 156 : 216);
517
+ break;
518
+ }
519
+ }
520
+ ```
521
+
522
+ - New encoding type `Hex Table`
523
+
524
+ ```js
525
+ "{0x7E494534,0x688,0x7E6D53,0x401,0x7E584D4B,0x688,0x7E775853,0x688,0x7E5333,0x81}"
526
+
527
+ // => "Hello World"
528
+ ```
529
+
530
+ - Improvements to renaming labels
531
+ - Fixed [#24](https://github.com/MichaelXF/js-confuser/issues/24)
532
+ - Fixed [#25](https://github.com/MichaelXF/js-confuser/issues/25)
533
+ - Fixed [#26](https://github.com/MichaelXF/js-confuser/issues/26)
534
+
535
+ # `1.3.0`
536
+ String Splitting Improvement
537
+
538
+ - `String Splitting` now supports percentages and a custom callback. ([#22](https://github.com/MichaelXF/js-confuser/issues/22))
539
+
540
+ ```js
541
+ {
542
+ // percentage
543
+ stringSplitting: 0.75, // = 75%
544
+
545
+ // exclude certain strings
546
+ stringSplitting: (str)=>{
547
+ if ( str == "dont-split-string" ) {
548
+ return false;
549
+ }
550
+
551
+ return true;
552
+ },
553
+ }
554
+ ```
555
+
556
+ # `1.2.2`
557
+ Global name fix
558
+
559
+ - **Bug fix**: `Rename Variables` breaking access to global variables
560
+
561
+ ```js
562
+ // Say `a` is a global library
563
+ // Input
564
+ function myFunction(param1){
565
+ a(param1);
566
+ }
567
+
568
+ // Output on 1.2.1
569
+ function a(a){
570
+ a(a);
571
+ }
572
+
573
+ // Output on 1.2.2
574
+ function b(b){
575
+ a(b);
576
+ }
577
+ ```
578
+
579
+ - **Bug fix**: `Flatten` to not accidentally remove function parameters
580
+ - **Bug fix**: `Dispatcher` on function calls within classes
581
+ - **Bug fix**: `Minify` fixed syntax error
582
+
583
+ ```js
584
+ // Input
585
+ var o = {Infinity: 0};
586
+
587
+ // Output on 1.2.1
588
+ var o = {1/0: 0};
589
+
590
+ // Output on 1.2.2
591
+ var o = {[1/0]: 0};
592
+ ```
593
+
594
+ - Added `base32` encoding to `String Concealing`
595
+ - `Minify` improvements
596
+ - - `true` -> `!0`
597
+ - - `false` -> `!1`
598
+ - Subtle changes to `String Compression`
599
+ - Updated presets
600
+
601
+ # `1.2.1`
602
+ Bug fixes
603
+
604
+ - **Bug fix**: `Control Flow Flattening` on classes no longer creates syntax errors
605
+ - **Bug fix**: `String Concealing` will check for duplicate strings
606
+ - **Bug fix**: `String Concealing` now handles class properties
607
+ - **Bug fix**: `Stack` and `Control Flow Flattening` no longer modifies floats
608
+
609
+ - **New API:**
610
+
611
+ ## `obfuscateAST(AST, options)`
612
+
613
+ Obfuscates an [ESTree](https://github.com/estree/estree) compliant AST. Returns a [`Promise`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise).
614
+
615
+ **Note:** Mutates the object.
616
+
617
+ | Parameter | Type | Description |
618
+ | --- | --- | --- |
619
+ | `AST` | `object` | The [ESTree](https://github.com/estree/estree) compliant AST. This object will be mutated. |
620
+ | `options` | `object` | The obfuscator settings. |
621
+
622
+ # `1.2.0`
623
+ Bug fixes
624
+
625
+ - **Bug fix**: `Eval` moves function declarations to the top of the lexical block
626
+ - **Bug fix**: `Stack` no longers changes function declarations
627
+ - Improvements to `Stack` rotations
628
+
629
+ ```js
630
+ // Input
631
+ function add3(x,y,z){
632
+ ok(typeof x === "number");
633
+ ok(typeof y === "number");
634
+ ok(typeof z === "number");
635
+
636
+ return x + y + z;
637
+ }
638
+
639
+ console.log(add3(1,2,3))
640
+
641
+ // Output on 1.1.9
642
+ function _WFZLw(..._WFZLw) {
643
+ void (_WFZLw.length = 3, ok(typeof _WFZLw[0] === 'number'), ok(typeof _WFZLw[1] === 'number'), ok(typeof _WFZLw[2] === 'number'));
644
+ return _WFZLw[0] + _WFZLw[1] + _WFZLw[2];
645
+ }
646
+ console['log'](_WFZLw(1, 2, 3));
647
+
648
+ // Output on 1.2.0
649
+ var KZ6LyAL = (...KZ6LyAL) => {
650
+ ~(KZ6LyAL.length = 3, ok(typeof KZ6LyAL[0] === 'number'), KZ6LyAL[186] = KZ6LyAL[0], ok(typeof KZ6LyAL[1] === 'number'), KZ6LyAL[227] = -22, ok(typeof KZ6LyAL[KZ6LyAL[KZ6LyAL[227] + 249] + 24] === 'number'));
651
+ return KZ6LyAL[KZ6LyAL[227] - (KZ6LyAL[227] - 186)] + KZ6LyAL[KZ6LyAL[227] + 23] + KZ6LyAL[KZ6LyAL[KZ6LyAL[227] + 249] - (KZ6LyAL[227] - (KZ6LyAL[227] + 24))];
652
+ };
653
+ console.log(KZ6LyAL(1, 2, 3));
654
+ ```
655
+
656
+ # `1.1.9`
657
+ Browser Lock and OS Lock
658
+
659
+ - Added `Browser Lock` and `OS Lock`
660
+
661
+ | Mode | Target | Method |
662
+ | --- | --- | --- |
663
+ | `Browser Lock` | `"browser"` | Checks `window.navigator.userAgent` |
664
+ | `Browser Lock` | `"node"` | N/A |
665
+ | `OS Lock` | `"browser"` | Checks `window.navigator.userAgent` |
666
+ | `OS Lock` | `"node"` | Checks `require('os').platform()` |
667
+
668
+ ---
669
+
670
+ - #### `Browser Lock`
671
+
672
+ - Array of browsers where the script is allowed to run. (`string[]`)
673
+
674
+ - - Potency Low
675
+ - - Resilience Medium
676
+ - - Cost Medium
677
+
678
+ - Allowed values: `"firefox"`, `"chrome"`, `"iexplorer"`, `"edge"`, `"safari"`, `"opera"`
679
+
680
+ - Example: `["firefox", "chrome"]`
681
+
682
+ ---
683
+
684
+ - #### `OS Lock`
685
+
686
+ - Array of operating-systems where the script is allowed to run. (`string[]`)
687
+
688
+ - - Potency Low
689
+ - - Resilience Medium
690
+ - - Cost Medium
691
+
692
+ - Allowed values: `"linux"`, `"windows"`, `"osx"`, `"android"`, `"ios"`
693
+
694
+ - Example: `["linux", "windows"]`
695
+
696
+ ---
697
+
698
+ - **Bug fix**: `Moved Declarations` no longer applies to loops
699
+ - - Previously broke Switch statements
700
+
701
+ - `String Splitting` use larger chunk sizes to avoid creating too many strings
702
+
703
+ Available now on NPM: https://www.npmjs.com/package/js-confuser
704
+
705
+ # `1.1.8`
706
+ Bug Fixes and Improvements
707
+
708
+ - **Bug fix**: Stack no longer replaces identifiers that are in nested contexts
709
+
710
+ - `es5` converts
711
+ - - `fn(...args)` -> `fn.apply(this, args)`
712
+ - - `fn(...arguments)` -> `fn.apply(this, [].concat(Array.prototype.slice.call(arguments)))`
713
+
714
+ - Changes to `identifierGenerator`
715
+ - - `mangled` Now uses both lowercase and uppercase alphabets
716
+
717
+ - Added `antiTooling` to stop [JSNice.org](https://JSNice.org) from expanding sequence expressions
718
+
719
+ ```js
720
+ // Input
721
+ (console.log(1), console.log(2), console.log(3))
722
+
723
+ // Output
724
+ +(console.log(1), console.log(2), console.log(3))
725
+
726
+ // JSNice on Input
727
+ console.log(1)
728
+ console.log(2)
729
+ console.log(3)
730
+
731
+ // JSNice on Output
732
+ +(console.log(1), console.log(2), console.log(3))
733
+ ```
734
+
735
+ - Improved `controlFlowFlattening`
736
+ - - No longer changes blocks with `const` variables
737
+ - - Now obscures order of expressions
738
+ ```js
739
+ // Input
740
+ console.log(1)
741
+ console.log(2)
742
+ console.log(3)
743
+ console.log(4)
744
+ var five = 5;
745
+ console.log(five);
746
+
747
+ // Output
748
+ var oI8J9w6 = (console['log'](1), console['log'](2), console['log'](3), console['log'](4), 5);
749
+ console['log'](oI8J9w6);
750
+ ```
751
+
752
+ - - Now entangles number literals with the state variables ex:
753
+
754
+ ```js
755
+ // Input
756
+ console.log(1);
757
+ console.log(2);
758
+ console.log(3);
759
+ console.log(4);
760
+ console.log(5);
761
+ console.log(6);
762
+ console.log(7);
763
+ console.log(8);
764
+ console.log(9);
765
+ console.log(10);
766
+
767
+ // Output
768
+ var xYPTGP = -164, NYvTJV = -40, eB6EbU = 55, cD8ztD = -73, AnCfc3A = 237, n6wikC = 52;
769
+ while (xYPTGP + NYvTJV + eB6EbU + cD8ztD + AnCfc3A + n6wikC != 33) {
770
+ var ruVzem = (xYPTGP + NYvTJV + eB6EbU + cD8ztD + AnCfc3A + n6wikC) * -184 - 38;
771
+ switch (ruVzem) {
772
+ case -3350:
773
+ console.log(4), (NYvTJV *= -66 > AnCfc3A ? n6wikC + (134 > xYPTGP ? -190 : 194) : 2, NYvTJV -= 77 < xYPTGP ? 28 : 66), xYPTGP += AnCfc3A - 201, (AnCfc3A *= n6wikC + 109, AnCfc3A -= 16 < NYvTJV ? 661 : -169);
774
+ break;
775
+ case -26902:
776
+ console.log(31 > AnCfc3A ? 39 : -2 > AnCfc3A ? -137 : 3), (NYvTJV *= -174 > n6wikC ? AnCfc3A - 292 : 2, NYvTJV -= n6wikC - 91), (eB6EbU *= 155 > cD8ztD ? 2 : 42, eB6EbU -= 155 > AnCfc3A ? 1 : -227), (cD8ztD *= 183 < eB6EbU ? 222 : 2, cD8ztD -= 214 < AnCfc3A ? 270 : 70);
777
+ break;
778
+ case -12366:
779
+ console.log(196 < eB6EbU ? -5 : 1), eB6EbU += -47 > cD8ztD ? -225 : 57, (xYPTGP *= AnCfc3A - 235, xYPTGP -= -126 < eB6EbU ? 46 : -434);
780
+ break;
781
+ case -20646:
782
+ console.log(2), (n6wikC *= cD8ztD + 75, n6wikC -= ((107 > xYPTGP ? -244 : -80) > cD8ztD ? 65 : 149) > cD8ztD ? -138 > eB6EbU ? cD8ztD + 284 : 159 : 73 < AnCfc3A ? -14 : 83), AnCfc3A += xYPTGP - 95 < n6wikC ? 199 : 147, xYPTGP += 227 < xYPTGP ? -238 : 46;
783
+ break;
784
+ case -10526:
785
+ console.log(10), xYPTGP += n6wikC + 524, n6wikC += cD8ztD + 263, (AnCfc3A *= 67 > xYPTGP ? n6wikC + (xYPTGP - 433 > n6wikC ? -21 : -111) : 2, AnCfc3A -= AnCfc3A + 247);
786
+ break;
787
+ case -2614:
788
+ console.log(5), (n6wikC *= xYPTGP - 333, n6wikC -= (-41 > cD8ztD ? -38 > AnCfc3A ? 96 : -97 : 49) < NYvTJV ? 131 : 112), (cD8ztD *= eB6EbU + 115, cD8ztD -= -216 < AnCfc3A ? -631 : 23), (AnCfc3A *= (NYvTJV + 1 > xYPTGP ? 235 : 206) < n6wikC ? n6wikC + 310 : 2, AnCfc3A -= NYvTJV - 236), (xYPTGP *= 185 > eB6EbU ? -169 < xYPTGP ? 2 : 236 : -19, xYPTGP -= -59 < n6wikC ? 100 : n6wikC + 779);
789
+ break;
790
+ case -5006:
791
+ console.log(6), (cD8ztD *= cD8ztD + (-100 < n6wikC ? -66 : 203), cD8ztD -= -87 < eB6EbU ? -101 : -261);
792
+ break;
793
+ case -16046:
794
+ console.log(240 > AnCfc3A ? -70 : 7), (NYvTJV *= AnCfc3A - 240, NYvTJV -= 240 > AnCfc3A ? -66 : 304), AnCfc3A += eB6EbU - 76, (eB6EbU *= 154 > NYvTJV ? xYPTGP - 234 : 103 > xYPTGP ? -138 : 2, eB6EbU -= AnCfc3A - 409);
795
+ break;
796
+ case -9974:
797
+ console.log(NYvTJV + (-225 > AnCfc3A ? -98 : -103)), xYPTGP += n6wikC + 260, eB6EbU += NYvTJV - 67, (AnCfc3A *= eB6EbU - 173, AnCfc3A -= eB6EbU - 132 < NYvTJV ? 19 : -107 > NYvTJV ? 145 : -44);
798
+ break;
799
+ case -8318:
800
+ console.log(AnCfc3A - 45), (n6wikC *= -126 < xYPTGP ? 2 : 53, n6wikC -= n6wikC + 336);
801
+ }
802
+ }
803
+ ```
804
+
805
+ Available now on NPM: https://www.npmjs.com/package/js-confuser
806
+
807
+ # `1.1.7`
808
+ Website is Live
809
+
810
+ - [https://master--hungry-shannon-c1ce6b.netlify.app/](https://master--hungry-shannon-c1ce6b.netlify.app/) is live!
811
+ - Check out the [js-confuser-website](https://github.com/MichaelXF/js-confuser-website) repo for more info
812
+
813
+ - **⚠️ Breaking change**: `Rename Globals` is now enabled by default
814
+ - **Bug fix**: `Dead Code` no longers adds async code when `es5` option is enabled
815
+ - Improved `Control Flow Flattening`
816
+
817
+ # `1.1.6`
818
+ New feature: Name Recycling
819
+
820
+ - **New feature:** `nameRecycling`
821
+ - - Attempts to reuse released names.
822
+ - - Potency Medium
823
+ - - Resilience High
824
+ - - Cost Low
825
+
826
+ ```js
827
+ // Input
828
+ function percentage(decimal) {
829
+ var multiplied = x * 100;
830
+ var floored = Math.floor(multiplied);
831
+ var output = floored + "%"
832
+ return output;
833
+ }
834
+
835
+ // Output
836
+ function percentage(decimal) {
837
+ var multiplied = x * 100;
838
+ var floored = Math.floor(multiplied);
839
+ multiplied = floored + "%";
840
+ return multiplied;
841
+ }
842
+ ```
843
+
844
+ - `delete` operator is now properly parsed
845
+ - No longers changes `constructor` method on classes
846
+ - Added two new Dead Code samples and fixed one
847
+ - RGF now skips async and generator functions
848
+ - Object Extraction now places the extracted properties in the same position as the declaration
849
+ - Name Conflicts disabled to speed up obfuscation times
850
+ - Improvements to Minify
851
+ (better Variable Grouping)
852
+ - The `renameGlobals` option now has affect
853
+
854
+ Available now on NPM: https://www.npmjs.com/package/js-confuser
855
+
856
+ # `1.1.5`
857
+ Performance Improvements
858
+
859
+ - **Bug fix**: Object Extraction
860
+ - - Improved safety checks (searches further down tree)
861
+ - - No longer applies to empty objects
862
+
863
+ - String Concealing results are now cached
864
+
865
+ - Minification improvements
866
+ - - `a += -1` -> `a -= 1`
867
+ - - `a -= -1` -> `a += 1`
868
+ - - `a + -b` -> `a - b`
869
+ - - `a - -b` -> `a + b`
870
+
871
+ - Dispatcher no longer applies to redefined functions
872
+
873
+ - Ensure `controlFlowFlattening` numbers don't get too large
874
+ (hardcoded limit of 100,000)
875
+
876
+ - Opaque Predicates now excludes await expressions
877
+
878
+ Available now on NPM: https://www.npmjs.com/package/js-confuser
879
+
880
+ # `1.1.4`
881
+ Improved ES5 Support
882
+
883
+ - Full support for transpiling [ES6 template strings](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals)
884
+ - - Added `.raw` property for Tagged Template Literals
885
+
886
+ - Transpiling [ES6 Classes](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Classes) down to ES5-compatible code
887
+ - Transpiling the [ES6 spread operator in arrays](https://www.samanthaming.com/tidbits/92-6-use-cases-of-spread-with-array/)
888
+ - Transpiling the [ES6 spread operator in objects](https://lucybain.com/blog/2018/js-es6-spread-operator/)
889
+
890
+ - Improved `controlFlowFlattening` to use multiple state variables
891
+ - Added chained-calls to `duplicateLiteralsRemoval`, similar to obfuscator.io's [`stringArrayWrappersChainedCalls`](https://github.com/javascript-obfuscator/javascript-obfuscator) option
892
+
893
+ Available now on NPM: https://www.npmjs.com/package/js-confuser
894
+
895
+ # `1.1.3`
896
+ Minification Changes
897
+
898
+ - Fixed minification errors
899
+ - - No longer accidentally removes function declarations/class declarations
900
+
901
+ - RGF Changes
902
+ - - Function cannot rely on `this`
903
+ - - Better support with `renameVariables`
904
+
905
+ - Opaque Predicate Changes
906
+ - - Now correctly applies to switch case tests
907
+
908
+ - Fixed Flatten bug causing undefined return values
909
+
910
+ - Support for transpiling [ES6 template strings](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals)
911
+
912
+ Available now on NPM: https://www.npmjs.com/package/js-confuser
913
+
914
+ # `1.1.2`
915
+ New String Compression feature and Fixed Syntax errors
916
+
917
+ - **New feature**: `stringCompression`
918
+ - - String Compression uses LZW's compression algorithm to reduce file size. (`true/false/0-1`)
919
+ - - `"console"` -> `inflate('replaĕ!ğğuģģ<~@')`
920
+ - - Potency High
921
+ - - Resilience Medium
922
+ - - Cost Medium
923
+
924
+ - Fixed error with String encoding
925
+
926
+ - Fixed syntax error from obfuscating destructuring with computed keys
927
+ - Fixed syntax error when getters/setters were being converted to arrow functions
928
+ - Integrity fixes:
929
+ - - Better support with Dispatcher
930
+ - - Better support with Calculator
931
+
932
+ Available now on NPM: https://www.npmjs.com/package/js-confuser
933
+
934
+ # `1.1.1`
935
+ General fixes
936
+ - No longer encodes `"use strict"` and other directives
937
+ - No longer encodes `require("str")` or `import("str")` strings
938
+
939
+ - Fixed several `controlFlowFlattening` bugs:
940
+ Fixed rare code corruption when nested
941
+ Fixed obfuscation on `for` and `while` loops
942
+
943
+ - Fixed `stack` from creating syntax errors
944
+ (No longer applies to for-loop initializers)
945
+
946
+ - Fixed renaming identifiers in object destructing
947
+ - Better support for `let` variables
948
+
949
+ - Checks for invalid options
950
+ - Increased test coverage to 90%
951
+
952
+ - `debugTransformations`, `Obfuscator` and `Transform` objects exposed.
953
+
954
+ Available now on NPM: https://www.npmjs.com/package/js-confuser
955
+
956
+ # `1.1.0`
957
+ New feature: Stack, and various improvements
958
+ - **New feature:** `stack`
959
+ Local variables are consolidated into a rotating array. (`true/false/0-1`)
960
+ [Similar to Jscrambler's Variable Masking](https://docs.jscrambler.com/code-integrity/documentation/transformations/variable-masking)
961
+ - Potency Medium
962
+ - Resilience Medium
963
+ - Cost Low
964
+
965
+ ```js
966
+ // input
967
+ function add3(x, y, z){
968
+ return x + y + z;
969
+ }
970
+
971
+ // output
972
+ function add3(...AxaSQr){AxaSQr.length=3;return AxaSQr.shift()+AxaSQr.shift()+AxaSQr.shift()}
973
+ ```
974
+
975
+ - Improvements to `flatten`
976
+ - Properly renames `let` variables now
977
+ - Improvements to `dispatcher`
978
+
979
+ Available now on NPM: https://www.npmjs.com/package/js-confuser
980
+
981
+ # `1.0.9`
982
+ Support for lower versions of NodeJS
983
+
984
+ - Adjusted babel config to be more forgiving to the older versions of NodeJS.
985
+
986
+
987
+ # `1.0.8`
988
+ New shuffle feature and improvements
989
+ - New feature for shuffle:
990
+ `hash` - Shift based on the hash of the array contents
991
+ If the hash changes, the order of the array will be messed up causing your program to brick.
992
+
993
+ - Lock improvements
994
+ Fixed issue with `nativeFunctions`
995
+ Now errors when `countermeasures` callback can't be found.
996
+ Countermeasures callback works with `Integrity`.
997
+ New rules for `countermeasures` callback:
998
+ Must be top-level,
999
+ No references to locked code (otherwise infinite loop)
1000
+
1001
+ - General improvements
1002
+ Updated presets and documentation
1003
+ Added `index.d.ts` for type-intellisense
1004
+
1005
+ Available now on NPM: https://www.npmjs.com/package/js-confuser
1006
+
1007
+
1008
+
1009
+ # `1.0.7`
1010
+ Integrity fixed
1011
+ - Integrity Improvements
1012
+ - - Countermeasures function works with Integrity
1013
+ - - Fixed hashing issues
1014
+ - - - Wrote more tests for integrity
1015
+ - Documentation Update
990
1016
  - - Fixed errors in examples