Custom String Encodings

JS-Confuser

Custom String Encodings

Custom String Encodings allows you to define your own string encoding/decoding functions.

Option name: "customStringEncodings"

Option values: true/false/0-1

Input / Output

This example showcases how Custom String Encodings transforms the code. Try it out by changing the input code and see changes apply in real-time.

Input.js

Output.js

function Jme_IJp(Jme_IJp) {
  return atob(Jme_IJp);
}
function dphypO(dphypO) {
  if (typeof t4q5plC[dphypO] === 'undefined') {
    return t4q5plC[dphypO] = Jme_IJp(BVsr2gE[dphypO]);
  }
  return t4q5plC[dphypO];
}
var t4q5plC = {},
  BVsr2gE = 
  ["TFptcjAwNFdSenZiZFJtcHNLQ0JUTmJwWlROTU9IUUJLckJBTkJkaw=="
  , "cXJBSTRpT2YydkNKOGNhWUxCM0M=", 
  "YkNrRFFWcEdXQXdCMFNydTRnbVVVWWlFNTdGZEk2Z2c=", 
  "QU9DQmNRb1paTUZnOGdtemY3Y2hoVjFFMlpPRE0yMnNZcEwzcHZtM0FmQX
  BoelkwMQ==", 
  "TzZaeUhzaEdNT1REYVFtZndmYzI3UXdsdThpOWtYZWY4RkpLTlg=", 
  "eDVManFOalNYODR4aVdUaUprVFdsOUQ3ZXRYbjg=", 
  "d3lXYURva3ZHTDFGdFdxV0FxU3pVNm5TWEJs", "dnNUUEQxbXdV", 
  "bTJxVmFWVWI3ZWk3TnBaUnBWeFZISUl1WVE=", 
  "Zk1QN0ZqaTIySzM3d3lVVEFzWWlJSTdidWU=", "c2g4clo=", 
  "UUkwclF3akphSEtvRU5tZlN5MW9PczZaeW4zemtrUzBFNFl6SA==", 
  "SGd3SVR3aGNWdktpTnhRYjlqQmpTUTNv", 
  "VE0zUTZVb2o2MlFvRjlEdEhxUnJicGFITXJXajkwbG1YTFFsZXNGVVo=", 
  "RGVKejF1akg5cU9la1gxdHdNckFtdjU2dw==", 
  "a2tJT1pya3FTUVVrdVljbTJmYk9tRTBWU29VcjRQQ3ViTXpsOG5IWEx3RT
  RuT2Y=", 
  "V1RFMGdSY09MMGd2dUVMSGV3dTZIWlphanV4VHppalNacTNuZDVHeExl", 
  "RGpSWmd2cnJEbVVGeGt2THVubDhkWkE1SXA3SmpTQWw4bExk", 
  "aURYUTF5bg==", "aGd0RWgyQUtYdVpKOTN5R0lRQW9p", 
  "SDdqN1VrdURpUXhhWUZGNjhRRmhqQU40S2JEOEZvU0hJSUNoSEZSYkx0Z3
  E=", "ZWFmcGx6c25EZWVXUUhNVVAxVTZiQ29BTnJ2VHQ3Rw==", 
  "Y2NSeXlJSmxrVXNveWp3", 
  "MlhNZlYzenRXa1dXSUFZa083VEZ5SXR0aTVsSUNsWnllZ2Rm", 
  "dzZOMktI", "Y3VFYks=", 
  "ejhBUkpaa3AxSzZrREhFSTNSUXhEY1VOdWdiZTVT", 
  "bHhYUE92Q1FZYzg2ZU45SVNEMmw=", 
  "MmtnZDdScVFoNzJVQUZ3MFdUeXAxRmFqNFlkUjhRaWhvem5QaEF6YU1TaW
  tQRDFpNA==", 
  "NVRJekNSZnk5NUpBQ3JQVldNVWNvWTM1cktwdXdUUzRRa2FMWg==", 
  "T2FLeExQeU9Kc0FXcENaRXZFcnBaZjhXcFhVVUFKYVRHWHZoUng4UkdHUl
  FVcWdSSw==", "d3pIM1JTcUpZSkh5MGdyTmdueA==", 
  "T3htZ2VON2dZUXM4YW1RaGpDRGxkSWlsQTJEd3o0c3dWa2Y1SXVMemQ=", 
  "WjNGYTlaZjhoQU1DOTA2", "RWZDUlE=", "NDEzRzUzTjJlemhlbg==", 
  "YVNlSmNrZndRZ0RKZ0lFTm5uWXN3a0lCUnFySHRWSW50azU1a1JY", 
  "cmFrWGhidmd0NEd5alFVc2hnZGVG", 
  "dTlaQm9hTndVcHVqakJsbHE2RkJuVXhjNFFGN0FjSlVIVlY3R0o=", 
  "ckZoVWpselRlWldZa1o0V0dWaHlKWlZ3N0tubmRUUA==", 
  "bDQ5M3M1OURtd2lIdFcwV3BPdGVIcmVGWkRRbzNZbDI=", 
  "TTdVaXUzaHl0VGJTWWVkM2phWUFwSXlHbXFTZVpHQmRTaGg3NkxGdg==", 
  "ZUpidXA0RlZNa1lqOU9kQ014ZXcwUWpOem1ISUFxRklSZnlnS3AzbTBB", 
  "OHY5d3Z0dm1GV21TNXBPQkRhSU5aZk9SaTdXZGdkZkpTU0lm", 
  "ZTdzajdPbkpmOXFiZnN0", 
  "T3ZVUTRDWVVrbllTWHlXNUtMRFhIZkk2b3J1", 
  "WDVhQzFMd01HMlN5TVJDYml0UGd4eVZWeFUyWk42SnFiVUJjSlNldzlYVA
  ==", "WlkwOWxSVUFIcGh4cXFSdUE=", 
  "Q3ZhNm44T05lRkxPY1FycUlrNXlLcndCcHVVZXBxRkRYaw==", 
  "SDJRaVNQOHlZQ3I3WTJWajZL", "RFBrNHlDWHZieHQ2VVFDS2VyU3I=", 
  "bE00OFkwQzlIMFh2SUpCN3c1ODV4UHVHbHpwZXBaS1d3SHRYNFA=", 
  "eTJXWFljV2gya05TV256MVQ0RWdGQm50NHdMbW1la1RrQlZaTUdqVXM=", 
  "cXgwUzF2SXdDRG9zaVFUZ3czRmJSYQ==", "QnFIQlpKVGg=", 
  "N2d1OGdNQkJvNWMxRw==", "ajVndkFDb0RmUzlqS3lMTWRl", 
  "NFBtbTFXU2V4UXQxN1RNQm5nNE9Obg==", 
  "YVF2ZXhLdDVGZ0tTS0JiaQ==", 
  "Nm5raVB3VE82eXdFbUVrZ2xnYkVyMDhB", 
  "Q05aVEtrRWN2T2pIeXBKSXo=", 
  "VEd4bk1kREx1RUZ3V1FJbjNWRGN5cFN5NHRnbWtZ", 
  "U2lVSDlaNHNIUW5iMlNJTVZSTmkwNnowR21wcktIbHVHSUY=", 
  "Sk13SmpvRnlrOWh4S1hlREhKR09QR3BHNQ==", 
  "cXNhaVE3aWt2cEJUZlhzVHBG", 
  "aHpJZXlsZGlObHJTa2FBcGZtYldYVXhG", 
  "cTBSd0xxMkhKUEtjbWp0NjBqOE1KVlB4SFhKMkJFU3dUTlpv", 
  "OGJpbkQ4Nw==", 
  "eENnTG1uMHFyTlBLUFdMUU1TbXJPSE9tVFo0Ymk5ZQ==", 
  "ZktHUUdDbVdK", 
  "R1REYXBUSlVaNVRVMGxuNTFZWWlSUWFvcUEwR1U3SEttYw==", 
  "VUtIR3VsUmNPb241cW9pNzM4cWhIRzU4UUVLRnZKTkFSdlJkV3dRbkRkVm
  9DUg==", "YUpsenZ5TjllSk93UUpiNjU=", 
  "b0k5RGpTV09MQWVKVmlaaUN6VktjbUZKODViQU94NQ==", 
  "aDRHZDRiYzlzSmJIQ0o=", 
  "RlNqMUVCakVYUk81d0VzZFF5S21pdmtTRlc=", 
  "V1p5b2M1RHJCRlF1OHplUUc5aGxVVnNPM056VExBSjdTdWFCN2lEbQ==", 
  "WFRwZVJvbzNJMzZxdg==", "RmMwNGgwSA==", 
  "MmVzeDM1eUFkYzN3TXc=", 
  "ZGpFMWkzcnI3NjFuYU9rUlA1UGRUdm5UNk9nQUM3Y2JnTTZhQw==", 
  "bENKcjlQS0gzb2wyODZmZEpubFM=", "UEJkMzFidk5LcTdVbER0OA==", 
  "bGk3VWZoR2FBQktMSVI3QUNJYWFw", 
  "S1AxR3NuQVYzbkozZjBjSUdxUDAzZXczckYybm1RdjJO", 
  "d3JMUnc1TllXVE5X", 
  "Qkc0ZXJwRklkcnl1SFZ6RXlJRGxON1F0RjcxTkkxSkhyTw==", 
  "cHV2ZWxUbGlRbmdsa3dBS0FtQjhoOUVvcVh6TEtDUW9paEpudFF0", 
  "Z1VvUm5YaE5vbnhvcTZjUWthWVk0", 
  "YzlUclNMZEFramxaODhxTnRiNkt2eDVxczN5cHZseGNycFdtYTRjRFBydm
  0=", 
  "dThzNkk1UHVqRVVOMEE4Tk9DMGtMd1dOWHpkVmJReDJKVm84bXJ2TGxlVD
  B6VQ==", "UGx6eWoyRDl6SUROQ0k=", "U3dKSW5BZGF1S2VS", 
  "VXVVSnFBVjhyTmZBbm55ekczekZMS2xhN01KemprcUFib2g=", 
  "cEVWd0R4YTdhVDNpdjFoQTdrQjhtVVhQRlhkc1I=", 
  "dzdLQlg2NzhJT1dwT05FdVNuZVY1SnJQT0ZtQQ==", 
  "aFU1d3YxRE9SMXhYSmpVbDhOOXZvY1Fta0xwVGs=", "YnNDT2ExNTQ=", 
  "SGVsbG8sIFdvcmxkIQ==", "bG9n"];
function pGAtj7() {
  var Jme_IJp = [function () {
      return globalThis;
    }, function () {
      return global;
    }, function () {
      return window;
    }, function () {
      return new Function("return this")();
    }],
    dphypO,
    t4q5plC = [];
  try {
    dphypO = Object;
    t4q5plC.push("".__proto__.constructor.name);
  } catch (BVsr2gE) {}
  If5a4UC: for (var pGAtj7 = 0; pGAtj7 < Jme_IJp.length; 
  pGAtj7++) try {
    dphypO = Jme_IJp[pGAtj7]();
    for (var Lmo1gF = 0; Lmo1gF < t4q5plC.length; Lmo1gF++) 
    if (typeof dphypO[t4q5plC[Lmo1gF]] === "undefined") 
    continue If5a4UC;
    return dphypO;
  } catch (BVsr2gE) {}
  return dphypO || this;
}
var Lmo1gF = pGAtj7() || {},
  bQuAUE = Lmo1gF.TextDecoder,
  rmp_7q = Lmo1gF.Uint8Array,
  SpqWfEh = Lmo1gF.Buffer,
  ZSlIwF = Lmo1gF.String || String,
  arbXx0I = Lmo1gF.Array || Array,
  zxMCy2 = function () {
    var Jme_IJp = new arbXx0I(128),
      dphypO = ZSlIwF.fromCodePoint || ZSlIwF.fromCharCode,
      t4q5plC = [];
    return function (BVsr2gE) {
      var pGAtj7,
        Lmo1gF,
        bQuAUE = BVsr2gE.length;
      t4q5plC.length = 0;
      for (var rmp_7q = 0; rmp_7q < bQuAUE;) {
        Lmo1gF = BVsr2gE[rmp_7q++];
        Lmo1gF <= 0x7F ? pGAtj7 = Lmo1gF : Lmo1gF <= 0xDF ? 
        pGAtj7 = (Lmo1gF & 0x1F) << 6 | BVsr2gE[rmp_7q++] & 
        0x3F : Lmo1gF <= 0xEF ? pGAtj7 = (Lmo1gF & 0x0F) << 
        12 | (BVsr2gE[rmp_7q++] & 0x3F) << 6 | 
        BVsr2gE[rmp_7q++] & 0x3F : ZSlIwF.fromCodePoint ? 
        pGAtj7 = (Lmo1gF & 0x07) << 18 | (BVsr2gE[rmp_7q++] & 
        0x3F) << 12 | (BVsr2gE[rmp_7q++] & 0x3F) << 6 | 
        BVsr2gE[rmp_7q++] & 0x3F : (pGAtj7 = 63, rmp_7q += 
        3);
        t4q5plC.push(Jme_IJp[pGAtj7] || (Jme_IJp[pGAtj7] = 
        dphypO(pGAtj7)));
      }
      return t4q5plC.join('');
    };
  }();
function h9Y1FL(Jme_IJp) {
  return typeof bQuAUE !== "undefined" && bQuAUE ? new 
  bQuAUE().decode(new rmp_7q(Jme_IJp)) : typeof SpqWfEh !== 
  "undefined" && SpqWfEh ? 
  SpqWfEh.from(Jme_IJp).toString("utf-8") : zxMCy2(Jme_IJp);
}
var xHYuJQ = dphypO(98);
console[dphypO(99)](xHYuJQ);

Custom String Encoding API

The Custom String Encoding API allows you to define your own string encoding/decoding functions. These encodings will be randomly inserted throughout the code.

Options.js

module.exports = {
  target: "node",
  // Should be enabled
  stringConcealing: true,
  // Simple Base64 Encoding
  customStringEncodings: [
    {
      // This template decoder function will be inserted into 
      the code
      code: `
            function {fnName}(str){
              return atob(str);
            }`,
      // Tells the obfuscator how to encode the string
      encode: (str) => btoa(str),
    },
  ],
};

The properties of the type Custom String Encoding are:

Property	Type	Description
code	string	Template decoder code that must contain '{fnName}'.
encode	Function	Encoding algorithm.
decode?	Function	Decoding algorithm. (Optional)
identity?	string	Distinguishes multiple encodings. (Optional)

The template code should contain the string {fnName}, which the obfuscator can interpolate with the function name.
The functions encode and decode have the type: (strValue: string) => string.
The function decode is optional. If provided, the obfuscator will validate each string to ensure it can be decoded. If the string cannot be decoded, the obfuscator will ignore the string.

Advanced Randomized Encoding

The following example implements a custom Base64 encoding that uses a shuffled charset to encode and decode strings.

This encoding algorithm is instantiated multiple times, each with a different shuffled charset. This makes it difficult to reverse-engineer the encoding algorithm.

Options.js

const { default: JsConfuser } = require("js-confuser");
const { stringLiteral } = require("@babel/types");
function shuffle(array) {
  // Fisher-Yates shuffle
  let currentIndex = array.length,
    randomIndex;
  while (currentIndex !== 0) {
    randomIndex = Math.floor(Math.random() * currentIndex);
    currentIndex--;
    [array[currentIndex], array[randomIndex]] = [
      array[randomIndex],
      array[currentIndex],
    ];
  }
  return array;
}
function createCustomStringEncoding() {
  function encode(input, charset) {
    const inputBuffer = new TextEncoder().encode(input);
    let output = "";
    for (let i = 0; i < inputBuffer.length; i += 3) {
      const chunk = [inputBuffer[i], inputBuffer[i + 1], 
      inputBuffer[i + 2]];
      const binary = (chunk[0] << 16) | (chunk[1] << 8) | 
      (chunk[2] || 0);
      output += charset[(binary >> 18) & 0x3f];
      output += charset[(binary >> 12) & 0x3f];
      output +=
        typeof chunk[1] !== "undefined" ? charset[(binary >> 
        6) & 0x3f] : "=";
      output += typeof chunk[2] !== "undefined" ? 
      charset[binary & 0x3f] : "=";
    }
    return output;
  }
  const customCharset =
    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123
    456789+/";
  const shuffledCharset = 
  shuffle(customCharset.split("")).join("");
  return {
    code: new JsConfuser.Template(`
      // Creates a reverse lookup table from the given 
      charset
      function createReverseCharset(charset) {
        if (charset.length !== 64) {
          throw new Error("Charset must be exactly 64 
          characters long.");
        }
        const reverseCharset = {};
        for (let i = 0; i < charset.length; i++) {
          reverseCharset[charset[i]] = i;
        }
        return reverseCharset;
      }
      // Base64 decode using the shuffled charset
      function decode(input, charset) {
        const reverseCharset = createReverseCharset(charset);
        const cleanedInput = input.replace(/=+$/, '');  // 
        Remove padding
        const byteArray = [];
        let buffer = 0;
        let bitsCollected = 0;
        for (let i = 0; i < cleanedInput.length; i++) {
          buffer = (buffer << 6) | 
          reverseCharset[cleanedInput[i]];
          bitsCollected += 6;
          if (bitsCollected >= 8) {
            bitsCollected -= 8;
            byteArray.push((buffer >> bitsCollected) & 0xFF);
          }
        }
        // Convert to string, ensuring no extra characters
        return new 
        TextDecoder().decode(Uint8Array.from(byteArray));
      }
      var {fnName} = (str) => decode(str, {shuffledCharset});
      `).setDefaultVariables({
      // This simply inserts 'shuffledCharset' (with proper 
      escaping)
      shuffledCharset: stringLiteral(shuffledCharset),
    }),
    encode: (input) => {
      // Encode the string
      return encode(input, shuffledCharset);
    },
    // Identity key to help distinguish between different 
    variants
    identity: shuffledCharset,
  };
}
module.exports = {
  target: "node",
  stringConcealing: true,
  customStringEncodings: [createCustomStringEncoding],
};

Usage Example

The provided code example will obfuscate the file input.js and write the output to a file named output.js.

Usage Example

import JSConfuser from "js-confuser";
import {readFileSync, writeFileSync} from "fs";
// Read input code
const sourceCode = readFileSync("input.js", "utf8");
const options = {
  target: 'browser',
  customStringEncodings: [
    {
      code: `
            function {fnName}(str){
              return atob(str)
            }
            `,
      encode: function(e){return btoa(e)},
      decode: function(e){return atob(e)},
    },
  ],
  stringConcealing: true,
};
JSConfuser.obfuscate(sourceCode, options).then((result)=>{
  // Write output code
  writeFileSync("output.js", result.code);
}).catch(err=>{
  // Error occurred
  console.error(err);  
});

Enabled In

Feedback

Please help us improve by
providing feedback

View Source

Contents

Custom String Encodings

Input / Output

Custom String Encoding API

Advanced Randomized Encoding

Usage Example

Enabled In