Double javascript obfuscation

Question

First of all, I know that obfuscation does not prevent reverse engineering ; it just makes it harder and longer, and that is what I am looking for.

My code uses jquery; this is the only addiction. I am looking at the google closure compiler and jscrambler , which seems to be well regarded. What happens if I pass my code first through the google close compiler and then through jscrambler?

Will the code work in every browser / platform as it is now? Does double entanglement mean any difficulty in reverse engineering the source?

Answer 1

Will the code work in every browser / platform as it is now?

Yes, the external script will execute its internal script, which again forces your browser to execute the internal script that is inside the internal script. In other words, ou can put eval in eval .

Does double entanglement affect any complexity to reverse engineer the source?

This does not necessarily add complexity, but it leads to an extra step that you need to take to get to your source. Please note that the internal obfuscation that you use is itself obfuscated by external obfuscation, so in one pass the obfuscation code of your internal obfuscation is presented to the reverse engineer, but not your actual source code.

When I used to do reverse engineering (to determine if there was any executable file as a virus), I literally stumbled upon a C # program that, in a confused form, first decompresses another file, this other file decompresses another DLL file again, which then gets the load, and then actually loads the code from the resource into this DLL file, which is finally executed and does some nasty code to connect to some online service.

The bottom line is that it took me quite a while to get to this confusing nasty code.

So yes, double obfuscation can increase complexity and take longer to get to your code.

But make sure that you do not incur any performance or maintenance overhead as a result.

And yes, in the end, all that they have confusing access can be a reverse engineer ...

Answer 2

How obfuscation works, it pretty much just renames the variables to "a", "b", "c", etc., to make it less readable. It also usually removes all code formatting, which makes the entire class just a few lines long, for example, from several hundred lines.

Anyone who really wants to know what the code is doing will be. This, as you said, makes reading and reverse engineering difficult. Unfortunately, since you cannot compile javascript, you are stuck with it to be plain text, so protection is not a great option.

I know there are products that will allow you to encrypt the script, but the script can still be decrypted by simply running the script locally. As a result, a little effort will create an unencrypted script.