js-confuser Documentation

JS-Confuser is a JavaScript obfuscation tool designed to make programs extremely difficult to read. Key obfuscation features include:

• Variable renaming: Renames variables to obscure their purpose.
• Control Flow obfuscation: Alters the logic flow of the code to make it harder to follow.
• String concealing: Hides string literals within the code.
• Function obfuscation: Obfuscates function structures and logic.
• Locks: Implements runtime restrictions such as domainLock and date locks.
• Integrity: Detects unauthorized changes to the source code.

When defining a custom countermeasure callback within the locked code, you must follow these rules to prevent infinite loops:

1. The function must be defined at the top-level of your program.
2. The function must not rely on any scoped variables.
3. The function cannot call functions outside its context.

Tamper Protection enhances two core security features:

1. Global Concealing

It detects if global functions have been monkey-patched by inspecting their .toString() value. It ensures that (1) arguments cannot be intercepted and (2) behavior cannot be altered. It also uses a secure eval invocation to obtain the real global object (for both Browser and NodeJS) to prevent scope-based hijacking.

2. RGF (Runtime-Generated-Functions)

Normally, RGF behavior can be altered by overriding the default Function constructor. When lock.tamperProtection is enabled, RGF switches from using the Function constructor to using eval with a strict integrity check. This ensures that even if eval is redefined, the concealed code remains inaccessible and its behavior cannot be changed.

Control Flow Flattening significantly reduces the execution performance of your program due to the overhead of the while/switch loop and the complex state calculations.

To balance security and performance, you should configure the controlFlowFlattening option as a percentage that is appropriate for your specific application's requirements.

When Tamper Protection detects an attempt to alter the runtime (such as monkey-patching or running in Strict Mode), it triggers a response.

• Default Behavior: If no response is configured, the program will crash.
• Custom Behavior: You can define how the application responds to tampering using the lock.countermeasures option.

RGF (Recursive Guard Functions) is an obfuscation technique that applies to arbitrary code, including code passed to new Function(). When enabled, it transforms logic into complex, non-linear structures.

Important Constraints for RGF:

• It only applies to Function Declarations or Function Expressions.
• The target function cannot be an async function or a generator function.
• The function cannot rely on variables from an outside scope.
• The function cannot use this, arguments, or eval.

When RGF is active, even the string content inside a new Function() constructor will be obfuscated (e.g., using Control Flow Flattening).

{
  target: "node",
  rgf: true,
  controlFlowFlattening: true
}

Control Flow Flattening works by converting standard control structures into a 'goto style' of code. It replaces high-level logic with a large, complex while loop containing a switch statement. The state of the program is managed through variable updates that determine which case in the switch statement executes next.

This process can flatten the following statement types:

1. If Statement
2. For Statement
3. While Statement / Do While Statement
4. Switch Statement

// Input
if(true) {
  console.log("This code runs");
}

// Output (Conceptual)
while (state != end) {
  switch (state) {
    case 1: 
      console.log("This code runs");
      state = 2;
      break;
    case 2: 
      // end
      break;
  }
}

By default, RGF only works on functions that are self-contained. If a function relies on variables defined in an outer scope, RGF will skip it. To resolve this, enable the flatten option alongside rgf.

flatten isolates functions from their original scope, allowing RGF to be applied to them by restructuring how they access external variables.

{
  target: "node",
  rgf: true,
  flatten: true
}

In JS-Confuser 2.0+, the JSConfuser.obfuscate() method returns a Promise that resolves to an object instead of a raw string. To access the obfuscated source code, you must access the .code property on the resulting object.

const JSConfuser = require("js-confuser");
const sourceCode = `console.log("Hello World")`;
const options = {
  target: "node",
  preset: "high"
};

JSConfuser.obfuscate(sourceCode, options).then(result => {
  // 'result' is an object containing the obfuscated code
  console.log(result.code);
});