Tamper Protection

Option name: "lock.tamperProtection"
Option values: true/false/Function

Requires Non-Strict Mode

The obfuscated code will not work properly in Strict Mode. You can use the Pack option to bypass Strict Mode constraints.

Requires Eval

The obfuscated code will contain unsafe eval expressions. The code will not work properly in environments that have disabled eval.

Input / Output

This example showcases how Tamper Protection transforms the code. Try it out by changing the input code and see changes apply in real-time.

Input.js

// Input.js
function onTamperDetected() {
  throw new Error('Tampering detected!');
}

fetch('https://jsonplaceholder.typicode.com/users')
  .then((response) => response.json())
  .then((data) => {
    console.log(data); // Array of users with names, usernames, and emails
  });

// Output.js
var OwC2TMP = DprDtyN();
function DprDtyN() {
  var OwC2TMP = !1;
  eval('OwC2TMP' + ' = true');
  if (!OwC2TMP) {
    lG8lOFt();
    return {};
  }
  const DprDtyN = eval('this');
  return DprDtyN;
}
function CTBxqb(DprDtyN) {
  switch (DprDtyN) {
    case '_ddqLa':
      return OwC2TMP.fetch;
    case 'n80sCw5':
      return OwC2TMP.ijQHZd;
    case 'gVVA59':
      return OwC2TMP.Object;
    case 'uw3kiq':
      return OwC2TMP.F62Lbae;
    case 'k4obAl':
      return OwC2TMP.nUVJmGR;
    case 'ESzasGT':
      return OwC2TMP.BvLsIb;
    case 'dOdNV5':
      return OwC2TMP.MWXJYC;
    case 'DKzduJ0':
      return OwC2TMP.hbCba7T;
    case 'rsj7xR':
      return OwC2TMP.G6uO7b;
    case 'ittybgG':
      return OwC2TMP.cOtxdi;
    case 'aegLcBL':
      return OwC2TMP.KZot4U;
    case 'Mlu316f':
      return OwC2TMP.zjZwngz;
    case 'TN2dHY':
      return OwC2TMP.P_4ucsg;
    case 'bcFe2m':
      return OwC2TMP.oeGHBm6;
    case 'nHf92io':
      return OwC2TMP.L8xuwcN;
    case 'qSqc6yH':
      return OwC2TMP.EHCN5sa;
    case 'O5uaSP':
      return OwC2TMP.yXI6GZf;
    case 'RgiO3rf':
      return OwC2TMP.GVGwjV;
    case 'Llvyd8w':
      return OwC2TMP.OObJNw;
    case 'gV8C5B':
      return OwC2TMP.K89Qjjj;
    case 'gAitmLo':
      return OwC2TMP.dFVId6;
    case 'F3ZB0x':
      return OwC2TMP.YCkUvH;
    case 'H2c3sf':
      return OwC2TMP.fA2LFt;
    case 'DVZ80M':
      return OwC2TMP.N0QAzFM;
    case 'TxxCnK':
      return OwC2TMP._dZgpuo;
    case 'wSKInc':
      return OwC2TMP.G9xNJ2O;
    case 'w9ZLKcj':
      return OwC2TMP.console;
    case 'gKRWmWC':
      return OwC2TMP.ppd9BE;
    case 'jy8OxT6':
      return OwC2TMP.Fsv8Jn0;
    case 'KhfHB1':
      return OwC2TMP.uZ7GnP;
    case '9p7JZNV':
      return OwC2TMP.kBsL6cY;
    case 'gZhGqkx':
      return OwC2TMP.xb72F1W;
    case 'HiW4371':
      return OwC2TMP.djmQT_;
    case 'cwGrXaF':
      return OwC2TMP.V5kBAvl;
    case 'f5PBQc':
      return OwC2TMP.NjLukC;
    case 'pzcetk':
      return OwC2TMP.AAh_8Jc;
    case 'mykkU0':
      return OwC2TMP.bbyUGcw;
    case 'DuCgOl':
      return OwC2TMP.PRxPU7;
    case 'XAf2uM':
      return OwC2TMP.iTeV3n;
    case 'dtjEKH':
      return OwC2TMP.whkNfE;
    case '_i9Do4':
      return OwC2TMP.Error;
    case '58pWu4':
      return OwC2TMP.DvFX7iZ;
  }
}
var L7j0jSR = !1;
function lG8lOFt() {
  if (L7j0jSR) return;
  L7j0jSR = !0;
  _Onsic();
}
function zRcUvK() {
  function OwC2TMP(OwC2TMP, DprDtyN) {
    const L7j0jSR = OwC2TMP.length,
      zRcUvK = DprDtyN.length;
    let _Onsic = 0;
    if (zRcUvK > L7j0jSR) {
      return -1;
    }
    for (let fPmo3Zl = 0; fPmo3Zl <= L7j0jSR - zRcUvK; fPmo3Zl++)
      for (let CTBxqb = 0; CTBxqb < zRcUvK; CTBxqb++)
        if (OwC2TMP[fPmo3Zl + CTBxqb] === DprDtyN[CTBxqb]) {
          _Onsic++;
          if (_Onsic === zRcUvK) {
            return fPmo3Zl;
          }
        } else {
          _Onsic = 0;
          break;
        }
    return -1;
  }
  function DprDtyN(DprDtyN) {
    if (
      OwC2TMP('' + DprDtyN, '{ [native code] }') === -1 ||
      typeof CTBxqb('gVVA59').getOwnPropertyDescriptor(DprDtyN, 'toString') !==
        'undefined'
    ) {
      lG8lOFt();
      return;
    }
    return DprDtyN;
  }
  var L7j0jSR = arguments;
  if (L7j0jSR.length === 1) {
    return DprDtyN(L7j0jSR[0]);
  } else if (L7j0jSR.length === 2) {
    var zRcUvK = L7j0jSR[0],
      _Onsic = L7j0jSR[1],
      fPmo3Zl = zRcUvK[_Onsic];
    fPmo3Zl = DprDtyN(fPmo3Zl);
    return fPmo3Zl.bind(zRcUvK);
  }
}
(function () {
  function OwC2TMP() {
    try {
      var OwC2TMP = [];
      delete OwC2TMP.length;
    } catch (e) {
      return !0;
    }
    return !1;
  }
  if (OwC2TMP()) {
    lG8lOFt();
    zRcUvK = void 0;
  }
})();
function _Onsic() {
  throw new (CTBxqb('_i9Do4'))('Tampering detected!');
}
zRcUvK(CTBxqb('_ddqLa'))('https://jsonplaceholder.typicode.com/users')
  .then((OwC2TMP) => {
    return OwC2TMP.json();
  })
  .then((OwC2TMP) => {
    zRcUvK(CTBxqb('w9ZLKcj'), 'log')(OwC2TMP);
  });

Improves Global Concealing

Tamper Protection with Global Concealing can detect at runtime if certain global functions have been monkey-patched. The following code exemplifies this:

Native function check

var _fetch = fetch;
fetch = (...args)=>{
  console.log("Fetch request intercepted!", ...args)
  return _fetch(...args)
}

This monkey-patch can be detected by inspecting the fetch.toString() value:

// Untampered
fetch.toString() // "function fetch() { [native code] }"

// Tampered
fetch.toString()  // "(...args)=>{\n  console.log("Fetch request intercepted!", ...args)\n  return _fetch(...args)\n}"

Certain global functions are checked before each invocation to ensure that (1) the arguments cannot be intercepted and (2) their behavior cannot be altered.

Stealthy global

A direct eval invocation can access the local scope, only if it has not been redefined.

let root = {};
eval("root=this"); // Window {window: ...}

This method securely obtains the real global object for both the browser and NodeJS. Properties on the global object can still be changed however.

Disallows Strict Mode

Tamper Protection requires the script to run in non-strict mode. Detection of the script in Strict Mode will be considered tampering. You can control the tampering response using the lock.countermeasures option.

Custom Implementation

`options.lock.tamperProtection(fnName)`

Control which functions are changed. Returns a boolean.

Parameter	Type	Description
`fnName`	`string`	The function name proposed receive native check protection.

Usage Example

The provided code example will obfuscate the file input.js and write the output to a file named output.js.

Usage Example

import JSConfuser from "js-confuser";
import {readFileSync, writeFileSync} from "fs";

// Read input code
const sourceCode = readFileSync("input.js", "utf8");
const options = {
  target: 'browser',
  lock: {
    tamperProtection: true,
    countermeasures: 'onTamperDetected',
  },
  globalConcealing: true,
};

JSConfuser.obfuscate(sourceCode, options).then((result)=>{
  // Write output code
  writeFileSync("output.js", result.code);
}).catch(err=>{
  // Error occurred
  console.error(err);  
});

Getting Started

Options

Presets

Requires Non-Strict Mode

Requires Eval

Input / Output

Improves Global Concealing

Native function check

Stealthy global

Disallows Strict Mode

Custom Implementation

`options.lock.tamperProtection(fnName)`

Usage Example

Enabled In

See Also

Requires Non-Strict Mode

Requires Eval

​Input / Output

​Improves Global Concealing

​Native function check

​Stealthy global

​Disallows Strict Mode

​Custom Implementation

​options.lock.tamperProtection(fnName)

​Usage Example

​Enabled In

​See Also

Input / Output

Improves Global Concealing

Native function check

Stealthy global

Disallows Strict Mode

Custom Implementation

`options.lock.tamperProtection(fnName)`

Usage Example

Enabled In

See Also