How to prevent deobfuscating JavaScript code

Question

Is there a way to prevent de-obfuscating JavaScript code which has already been obfuscated.

Obfuscated JS:

var _0xb5ae=["\x73\x68\x6F\x77","\x2E\x6C\x6F\x61\x64\x65\x72","\x6D\x6F\x75\x73\x65\x6D\x6F\x76\x65","\x2E\x62\x6C\x6F\x63\x6B"];$(_0xb5ae[3])[_0xb5ae[2]](function(){clearTimeout(e);e= setTimeout(function(){$(_0xb5ae[1])_0xb5ae[0]},1000)})

yep, add a comment //Please be kind not to try to de-obfuscate this before your code, and you should be good. — Kaiido
– Kaiido, Commented Nov 30, 2016 at 6:30
"Obfuscator converts the JavaScript source code into obfuscated and completely unreadable form, preventing it from analysing and theft." I call that false advertising... Some people pay for it!!?? — xShirase
– xShirase, Commented Nov 30, 2016 at 6:39

xShirase · Accepted Answer · 2016-11-30 07:02:45Z

3

No, there is no way to prevent deobfuscating, but you could probably minify it aggressively before obfuscating it, just to render it as complex as possible.

In any case, the client will be able to see the source, and with the right amount of motivation, there's nothing that can't be read and understood.

If you wish to protect your code, execute it only server-side.

Having said that, you can prevent (or at least limit) theft by using the appropriate license and/or copyright on your code. This of course will not prevent anyone from stealing it, but gives you a legal recourse in case they try to make money off your hard work.

edited Nov 30, 2016 at 7:02

answered Nov 30, 2016 at 6:33

xShirase

12.4k4 gold badges55 silver badges86 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Hitesh Misro Over a year ago

well, Thanks for your answer!

xShirase Over a year ago

@HiteshMisro No problems. Some companies go very far into trying to make their JS unreadable, but it is a worthless endeavour. If the thing you are trying to protect is so valuable, someone will take the time to understand the code. Edited post to offer legal alternatives

synthet1c · Accepted Answer · 2016-11-30 07:12:04Z

1

Too easy brah!

var _0xb5ae =["\x73\x68\x6F\x77","\x2E\x6C\x6F\x61\x64\x65\x72","\x6D\x6F\x75\x73\x65\x6D\x6F\x76\x65","\x2E\x62\x6C\x6F\x63\x6B"];

var code = `$(_0xb5ae[3])[_0xb5ae[2]](function(){clearTimeout(e);e= setTimeout(function(){$(_0xb5ae[1])_0xb5ae[0]},1000)})`

function deObfuscate(code, keys) {
  for (let key in keys) {
    code = code.replace(new RegExp(key+'\\[(\\d+)\\]', 'gim'), (_, index) => {
      return `'${keys[key][index]}'`
    })
  }
  return code
}

console.log(
  deObfuscate(code, { _0xb5ae })
)

$('.block').mousemove(function(){
  clearTimeout(e)
  e = setTimeout(function(){
    $('.loader').show()
  }, 1000)
})

<script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script>

edited Nov 30, 2016 at 7:12

answered Nov 30, 2016 at 6:53

synthet1c

6,3024 gold badges28 silver badges41 bronze badges

Collectives™ on Stack Overflow

How to prevent deobfuscating JavaScript code

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related