|
@@ -12,14 +12,21 @@ JavaScript obfuscator for Node.js is a free alternative to [js-obfuscator](https
|
|
* compatible with ES6;
|
|
* compatible with ES6;
|
|
* tested on Angular2 bundle.
|
|
* tested on Angular2 bundle.
|
|
|
|
|
|
-https://gist.github.com/sanex3339/ffc2876123b52e6d11ce45369fd53acf
|
|
|
|
|
|
+Online version: [javascriptobfuscator.herokuapp.com](https://javascriptobfuscator.herokuapp.com)
|
|
|
|
+
|
|
|
|
+Example of obfuscated code: [gist.github.com](https://gist.github.com/sanex3339/ffc2876123b52e6d11ce45369fd53acf)
|
|
|
|
+
|
|
|
|
+#### Plugins:
|
|
|
|
+* Webpack: [webpack-obfuscator](https://github.com/javascript-obfuscator/webpack-obfuscator)
|
|
|
|
+* Gulp: [gulp-javascript-obfuscator](https://github.com/javascript-obfuscator/gulp-javascript-obfuscator)
|
|
|
|
+* Grunt: [grunt-contrib-obfuscator](https://github.com/javascript-obfuscator/grunt-contrib-obfuscator)
|
|
|
|
|
|
[](https://badge.fury.io/js/javascript-obfuscator)
|
|
[](https://badge.fury.io/js/javascript-obfuscator)
|
|
-[](https://travis-ci.org/sanex3339/javascript-obfuscator)
|
|
|
|
-[](https://coveralls.io/github/sanex3339/javascript-obfuscator?branch=master)
|
|
|
|
|
|
+[](https://travis-ci.org/javascript-obfuscator/javascript-obfuscator)
|
|
|
|
+[](https://coveralls.io/github/javascript-obfuscator/javascript-obfuscator?branch=master)
|
|
|
|
|
|
-[](https://david-dm.org/sanex3339/javascript-obfuscator)
|
|
|
|
-[](https://david-dm.org/sanex3339/javascript-obfuscator#info=devDependencies)
|
|
|
|
|
|
+[](https://david-dm.org/javascript-obfuscator/javascript-obfuscator)
|
|
|
|
+[](https://david-dm.org/javascript-obfuscator/javascript-obfuscator#info=devDependencies)
|
|
|
|
|
|
## Installation
|
|
## Installation
|
|
|
|
|
|
@@ -109,15 +116,16 @@ Following options available for the JS Obfuscator:
|
|
debugProtection: false,
|
|
debugProtection: false,
|
|
debugProtectionInterval: false,
|
|
debugProtectionInterval: false,
|
|
disableConsoleOutput: true,
|
|
disableConsoleOutput: true,
|
|
- encodeUnicodeLiterals: false,
|
|
|
|
reservedNames: [],
|
|
reservedNames: [],
|
|
rotateUnicodeArray: true,
|
|
rotateUnicodeArray: true,
|
|
selfDefending: true,
|
|
selfDefending: true,
|
|
sourceMap: false,
|
|
sourceMap: false,
|
|
|
|
+ sourceMapBaseUrl: '',
|
|
|
|
+ sourceMapFileName: '',
|
|
sourceMapMode: 'separate',
|
|
sourceMapMode: 'separate',
|
|
unicodeArray: true,
|
|
unicodeArray: true,
|
|
- unicodeArrayThreshold: 0.8,
|
|
|
|
- wrapUnicodeArrayCalls: true
|
|
|
|
|
|
+ unicodeArrayEncoding: false,
|
|
|
|
+ unicodeArrayThreshold: 0.8
|
|
}
|
|
}
|
|
```
|
|
```
|
|
|
|
|
|
@@ -132,15 +140,16 @@ Following options available for the JS Obfuscator:
|
|
--debugProtection <boolean>
|
|
--debugProtection <boolean>
|
|
--debugProtectionInterval <boolean>
|
|
--debugProtectionInterval <boolean>
|
|
--disableConsoleOutput <boolean>
|
|
--disableConsoleOutput <boolean>
|
|
- --encodeUnicodeLiterals <boolean>
|
|
|
|
--reservedNames <list> (comma separated)
|
|
--reservedNames <list> (comma separated)
|
|
--rotateUnicodeArray <boolean>
|
|
--rotateUnicodeArray <boolean>
|
|
--selfDefending <boolean>
|
|
--selfDefending <boolean>
|
|
--sourceMap <boolean>
|
|
--sourceMap <boolean>
|
|
|
|
+ --sourceMapBaseUrl <string>
|
|
|
|
+ --sourceMapFileName <string>
|
|
--sourceMapMode <string> [inline, separate]
|
|
--sourceMapMode <string> [inline, separate]
|
|
--unicodeArray <boolean>
|
|
--unicodeArray <boolean>
|
|
|
|
+ --unicodeArrayEncoding <boolean|string> [true, false, base64, rc4]
|
|
--unicodeArrayThreshold <number>
|
|
--unicodeArrayThreshold <number>
|
|
- --wrapUnicodeArrayCalls <boolean>
|
|
|
|
```
|
|
```
|
|
|
|
|
|
### `compact`
|
|
### `compact`
|
|
@@ -151,9 +160,9 @@ Compact code output on one line.
|
|
### `debugProtection`
|
|
### `debugProtection`
|
|
Type: `boolean` Default: `false`
|
|
Type: `boolean` Default: `false`
|
|
|
|
|
|
-##### :warning: Can freeze browser while Developer Tools are enabled! Use at own risk.
|
|
|
|
|
|
+##### :warning: Can freeze your browser if you open the Developer Tools.
|
|
|
|
|
|
-Force enable debug mode on page load if Developer Tools panel is enabled (in some, mainly WebKit-based, browsers). This makes it almost impossible to use the Console (the debug panel).
|
|
|
|
|
|
+This option makes it almost impossible to use the `console` tab of the Developer Tools (both on WebKit-based and Mozilla Firefox).
|
|
|
|
|
|
* WebKit-based: blocks the site window, but you still can navigate through Developer Tools panel.
|
|
* WebKit-based: blocks the site window, but you still can navigate through Developer Tools panel.
|
|
* Firefox: does *not* block the site window, but still won't let you use DevTools.
|
|
* Firefox: does *not* block the site window, but still won't let you use DevTools.
|
|
@@ -161,31 +170,27 @@ Force enable debug mode on page load if Developer Tools panel is enabled (in som
|
|
### `debugProtectionInterval`
|
|
### `debugProtectionInterval`
|
|
Type: `boolean` Default: `false`
|
|
Type: `boolean` Default: `false`
|
|
|
|
|
|
-##### :warning: Can freeze browser even while Developer Tools are disabled! Use at own risk.
|
|
|
|
-
|
|
|
|
-Works if `debugProtection` is enabled.
|
|
|
|
|
|
+##### :warning: Can freeze your browser! Use at own risk.
|
|
|
|
|
|
-Force enable debug mode in some browsers (mainly WebKit-based) when Developer Tools panel is enabled, even after page is loaded.
|
|
|
|
|
|
+If checked, an interval is used to force the debug mode on the Console tab, making it harder to use other features of the Developer Tools. Works if `debugProtection` is enabled.
|
|
|
|
|
|
### `disableConsoleOutput`
|
|
### `disableConsoleOutput`
|
|
Type: `boolean` Default: `true`
|
|
Type: `boolean` Default: `true`
|
|
|
|
|
|
-Disable `console.log`, `console.info`, `console.error` and `console.warn` messages output into the browser console.
|
|
|
|
-
|
|
|
|
-### `encodeUnicodeLiterals`
|
|
|
|
-Type: `boolean` Default: `false`
|
|
|
|
|
|
+Disables the use of `console.log`, `console.info`, `console.error` and `console.warn` by replacing them with empty functions. This makes the use of the debugger harder.
|
|
|
|
|
|
-##### :warning: `unicodeArray` option must be enabled
|
|
|
|
|
|
+### `domainLock`
|
|
|
|
+Type: `string[]` Default: `[]`
|
|
|
|
|
|
-This option can slightly slow down your code speed.
|
|
|
|
|
|
+Locks the obfuscated source code so it only runs on specific domains and/or sub-domains. This makes really hard for someone just copy and paste your source code and run elsewhere.
|
|
|
|
|
|
-All literals in Unicode array become encoded in Base64.
|
|
|
|
-To decode strings, a special function will be inserted on the page under `unicodeArray` node.
|
|
|
|
|
|
+##### Multiple domains and sub-domains
|
|
|
|
+It's possible to lock your code to more than one domain or sub-domain. For instance, to lock it so the code only runs on **www.example.com** add `www.example.com`, to make it work on any sub-domain from example.com, use `.example.com`.
|
|
|
|
|
|
### `reservedNames`
|
|
### `reservedNames`
|
|
Type: `string[]` Default: `[]`
|
|
Type: `string[]` Default: `[]`
|
|
|
|
|
|
-Disable obfuscation of variable names, function names and names of function parameters that match the passed RegExp pattern.
|
|
|
|
|
|
+Disables the obfuscation of variables names, function names and function parameters that match the Regular Expression used.
|
|
|
|
|
|
Example:
|
|
Example:
|
|
```javascript
|
|
```javascript
|
|
@@ -202,24 +207,55 @@ Type: `boolean` Default: `true`
|
|
|
|
|
|
##### :warning: `unicodeArray` must be enabled
|
|
##### :warning: `unicodeArray` must be enabled
|
|
|
|
|
|
-Shift the `unicodeArray` values by a random number of places during the code obfuscation and insert a helper function for shifting the array back into the source code. (It works just like the Caesar cypher.)
|
|
|
|
|
|
+Shift the `unicodeArray` array by a fixed and random (generated at the code obfuscation) places. This makes it harder to match the order of the removed strings to their original place.
|
|
|
|
|
|
-Keep in mind that this option affects only how the code is visually organised, since the original arrays can be easily accessed during the debug process.
|
|
|
|
|
|
+This option is recommended if your original source code isn't small, as the helper function can attract attention.
|
|
|
|
|
|
-It is also not recommended to enable `rotateUnicodeArray` for small source code because a helper function might attract attention.
|
|
|
|
|
|
|
|
### `selfDefending`
|
|
### `selfDefending`
|
|
Type: `boolean` Default: `true`
|
|
Type: `boolean` Default: `true`
|
|
|
|
|
|
##### :warning: this option forcibly set `compact` value to `true`
|
|
##### :warning: this option forcibly set `compact` value to `true`
|
|
|
|
|
|
-Enables self-defending for obfuscated code. If obfuscated compact code is formatted, it will not work any more.
|
|
|
|
|
|
+This option makes the output code resilient against formatting and variable renaming. If one tries to use a JavaScript beautifier on the obfuscated code, the code won't work anymore, making it harder to understand and modify it.
|
|
|
|
|
|
### `sourceMap`
|
|
### `sourceMap`
|
|
Type: `boolean` Default: `false`
|
|
Type: `boolean` Default: `false`
|
|
|
|
|
|
Enables source map generation for obfuscated code.
|
|
Enables source map generation for obfuscated code.
|
|
|
|
|
|
|
|
+Source maps can be useful to help you debug your obfuscated Java Script source code. If you want or need to debug in production, you can upload the separate source map file to a secret location and then point your browser there.
|
|
|
|
+
|
|
|
|
+### `sourceMapBaseUrl`
|
|
|
|
+Type: `string` Default: ``
|
|
|
|
+
|
|
|
|
+Sets base url to the source map import url when `sourceMapMode: 'separate'`.
|
|
|
|
+
|
|
|
|
+CLI example:
|
|
|
|
+```
|
|
|
|
+javascript-obfuscator input.js --output out.js --sourceMap true --sourceMapBaseUrl 'http://localhost:9000'
|
|
|
|
+```
|
|
|
|
+
|
|
|
|
+Result:
|
|
|
|
+```
|
|
|
|
+//# sourceMappingURL=http://localhost:9000/out.js.map
|
|
|
|
+```
|
|
|
|
+
|
|
|
|
+### `sourceMapFileName`
|
|
|
|
+Type: `string` Default: ``
|
|
|
|
+
|
|
|
|
+Sets file name for output source map when `sourceMapMode: 'separate'`.
|
|
|
|
+
|
|
|
|
+CLI example:
|
|
|
|
+```
|
|
|
|
+javascript-obfuscator input.js --output out.js --sourceMap true --sourceMapBaseUrl 'http://localhost:9000' --sourceMapFileName example
|
|
|
|
+```
|
|
|
|
+
|
|
|
|
+Result:
|
|
|
|
+```
|
|
|
|
+//# sourceMappingURL=http://localhost:9000/example.js.map
|
|
|
|
+```
|
|
|
|
+
|
|
### `sourceMapMode`
|
|
### `sourceMapMode`
|
|
Type: `string` Default: `separate`
|
|
Type: `string` Default: `separate`
|
|
|
|
|
|
@@ -230,28 +266,33 @@ Specifies source map generation mode:
|
|
### `unicodeArray`
|
|
### `unicodeArray`
|
|
Type: `boolean` Default: `true`
|
|
Type: `boolean` Default: `true`
|
|
|
|
|
|
-Put all literal strings into an array and replace every literal string by an array call.
|
|
|
|
-
|
|
|
|
-### `unicodeArrayThreshold`
|
|
|
|
-Type: `number` Default: `0.8` Min: `0` Max: `1`
|
|
|
|
|
|
+Removes string literals and place them in a special array. For instance the string `"Hello World"` in `var m = "Hello World";` will be replaced with something like `var m = _0x12c456[0x1];`
|
|
|
|
+
|
|
|
|
+### `unicodeArrayEncoding`
|
|
|
|
+Type: `boolean|string` Default: `false`
|
|
|
|
|
|
##### :warning: `unicodeArray` option must be enabled
|
|
##### :warning: `unicodeArray` option must be enabled
|
|
|
|
|
|
-The probability that the literal string will be inserted into `unicodeArray`.
|
|
|
|
-Use this option for huge source code size, because many calls to `unicodeArray` will slow down code performance.
|
|
|
|
|
|
+This option can slightly slow down your script.
|
|
|
|
|
|
-`unicodeArrayThreshold: 0` equals to `unicodeArray: false`.
|
|
|
|
|
|
+Encode all string literals of the `unicodeArray` using `base64` or `rc4` and inserts a special code that used to decode it back at runtime.
|
|
|
|
|
|
-### `wrapUnicodeArrayCalls`
|
|
|
|
-Type: `boolean` Default: `true`
|
|
|
|
|
|
+Available values:
|
|
|
|
+* `true` (`boolean`): encode `unicodeArray` values using `base64`
|
|
|
|
+* `false` (`boolean`): don't encode `unicodeArray` values
|
|
|
|
+* `'base64'` (`string`): encode `unicodeArray` values using `base64`
|
|
|
|
+* `'rc4'` (`string`): encode `unicodeArray` values using `rc4`. **About 30-35% slower then `base64`, but more harder to get initial values**
|
|
|
|
+
|
|
|
|
+### `unicodeArrayThreshold`
|
|
|
|
+Type: `number` Default: `0.8` Min: `0` Max: `1`
|
|
|
|
|
|
##### :warning: `unicodeArray` option must be enabled
|
|
##### :warning: `unicodeArray` option must be enabled
|
|
|
|
|
|
-Instead of using direct calls to `unicodeArray` items `var t = _0x43a123[0x0]`, when index `0x0` can be easily reverted to `0` with few js beautifiers, this option will wrap all calls to special function instead.
|
|
|
|
|
|
+You can use this setting to adjust the probability (from 0 to 1) that a string literal will be inserted into the `unicodeArray`.
|
|
|
|
|
|
-```javascript
|
|
|
|
-var t = _0x12a634('0x0')
|
|
|
|
-```
|
|
|
|
|
|
+This setting is useful with large code size because repeatdely calls to the `Unicode Array` function can slow down your code.
|
|
|
|
+
|
|
|
|
+`unicodeArrayThreshold: 0` equals to `unicodeArray: false`.
|
|
|
|
|
|
## License
|
|
## License
|
|
Copyright (C) 2016 [Timofey Kachalov](http://github.com/sanex3339).
|
|
Copyright (C) 2016 [Timofey Kachalov](http://github.com/sanex3339).
|
|
@@ -274,4 +315,4 @@ DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
|
|
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
|
|
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
|
|
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
|
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
|
-THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
|
|
+THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|