Webmaster Forum / HTML, CSS, Scripts / JavaScript / June 2006

Matt Kruse ():

I just amazed, its absolutely the wrong way, for me.
Well, is there a *normal* users, not highly "knowledgable users", which
capable think normally and can answer?

which from this two scripts is better, have more sense, etc:

http://dean.edwards.name/packer/
http://scriptasylum.com/tutorials/encdec/javascript_encoder.html

First script does not use ''unescape", second based on  unesacpe.

Lasse Reichstein Nielsen ():

What properties should it have? I.e., by what measure should it
be "good"? Anything that makes Javascript not immediately readable
should suffice as I understand you. Anything above that would
be aiming for security, not obfuscation, which you don't want.

A simple obfuscator is:
----
<textarea cols="72" rows="10" id="input">input here</textarea>
<br>
<input type="button" value="obfuscate" onclick="
  function lz(s,n) {
    s = '000' + s; // sufficient for n<=4.
    return s.substring(s.length-n);
  }
  var inp = document.getElementById('input').value;
  var scr = document.getElementById('script').checked;
  var res = [];
  if (scr) { res.push('<script type=\'text/javascript\'>'); }
  res.push('eval(\'');
  for(var i = 0; i < inp.length; i++) {
    var c = inp.charCodeAt(i);
    var ch = c.toString(16);
    if (c < 256) {
      res.push('\\x', lz(ch,2));
    } else {
      res.push('\\u', lz(ch,4));
    }
  }
  res.push('\');');
  if (scr) { res.push('<\/script>'); }
  var out = document.getElementById('output');
  out.value = res.join('');
  out.select();
 ">
<input type="checkbox" id="script" checked="checked"><label
for="script">include &lt;script...>...&lt/script></label>
<br>
<textarea cols="72" rows="10" id="output"
readonly="readonly"></textarea>

----
Is it "good"? That depends entirely on your requirements.
It obviously obfuscates.

==============

well, I just wanted to hear opinions those users who uses or used some
obfuscators.

What is good?  good obfuscator provide code that work on most
javascript enabled browsers, that will be able to open scrambled
documents without distortion. Making them extermely difficult to study,
analyse, reuse for users, while fully retaining functionality of the
original code.
The protected form will still be the usual script, thus it will work on
all platforms the original code worked on.
Obfuscation (scrambling) of JavaScript and JScript standalone files,
flexible settings for obfuscation that allow to fine-tune level of
scrambling(include unescape); checking of missing and/or extra
semicolons in JavaScript, JScript code; generate new non-understandable
names and rename functions and variables depending on user settings;
remove comments and white spaces, reducing the file size and minimizing
the loading time; pack the code as a long line add finishing ";" when
appropriate; work with command line.

I tried script sample you show, it not work.

Mistral
--------------------------

JRS:  In article <Xns97EEA84AA179Ceejj99@194.109.133.242>, dated Mon, 26
Jun 2006 14:32:35 remote, seen in news:comp.lang.javascript, Evertjan.
<exjxw.hannivoort@interxnl.net> posted :

The form at the end of <URL:http://www.merlyn.demon.co.uk/problems.htm>
will en/de-obfuscate that.

Evertjan. ():

----------------------------------------------------------

===== obfuscatorScript.html ===========

<script type='text/obfuscatorScript' id='S'>
ine g = 'boshfpngbeFpevcg guebhtu EBG13';
g = 'Guvf vf n qrzb bs ' + g;
qbphzrag.jevgr(g);
</script>

<script type='text/javascript'>
var __b__ = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
__b__ = __b__ + __b__.substr(0,13);
__b__ = __b__ + __b__.toLowerCase();
var __a__=document.getElementById('S').text;
eval(__a__.replace(/(.)/g,
     function(c){
       return((d=__b__.indexOf(c))<0)?
               c:__b__.charAt(d+13)}))
</script>

===========================

btw: eval is evil.

--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)
----------------------------------------

and how to implement the snippet into some workable application (html)?

Mistral

JRS:  In article <Xns97EEA84AA179Ceejj99@194.109.133.242>, dated Mon, 26
Jun 2006 14:32:35 remote, seen in news:comp.lang.javascript, Evertjan.
<exjxw.hannivoort@interxnl.net> posted :

On re-reading - actually IMHO plain ROT13 is not obfuscation; rather, it
is simple encryption.

Obfuscated code will run, on the WWWeb, as well as the original, with
the same results (so one might want to do something additional about the
contents of literal strings and of comment); encrypted code must be
decrypted before reading, for execution or otherwise.

Obfuscation thus means altering all programmer-defined identifiers to
meaningless and maybe hard to read, and maybe removing all non-essential
whitespace and comment.

Code can be compressed for transmission and if every browser can
decompress it that's irrelevant for security.

If code is worth encrypting, one can take other steps to protect it,
such as not letting everyone get it in the first place.

OTOH, if the page has
       <script>SomeString="<ROT-13 material>"</script>
       <script>exec(X(SomeString))</script>

ISTM that one can use ROT-13 to obfuscate all letters, X being a ROT-13
function (though ROT-13 itself would be a remarkably poor choice; if the
Unicode of the string is ROT-Xed for a suitable X, the character set a-z
can be ROTted into Arabic).