eval() breaks Chrome Extensions

[HerrimanCoder]

I just tried out the obfuscator online here:
https://javascriptobfuscator.herokuapp.com/

...which I believe is based on this TS obfuscator. But after obfuscating the js files in my Chrome Extension, my extension breaks hard because eval() is illegal in some contexts of Chrome Extensions. This is a show-stopper for me, so I was wondering if there's some way to instruct the obfuscator to not ever use eval() in the obfuscation. It would be especially nice if you could tell me which setting(s) to avoid at javascriptobfuscator.herokuapp.com so I can retry there first. And then, how would I do the same thing in the downloaded TS app?

Thanks so much in advance, this seems like an awesome free tool.

[sanex3339]

Hi. Eval using in code of the custom nodes. You can try to disable selfDefending, debugProtection, and donainLock. But i will think how i can remove eval from code of this custom nodes.

[HerrimanCoder]

I disabled those 3 settings, but there are still eval() calls in there, breaking the extension. I would suggest an additional setting specific to eval, and when that is unchecked, no evals would ever be used in the obfuscated code. Thank you.

[sanex3339]

This is high priority for me now.

[sanex3339]

Oh, i was wrong. Right now you should set to false following options that using Function(...) in their code:
disableConsoleOutput
domainLock
stringArrayEncoding

Currently Function(...) using in third places (equal lines) for getting global object:
var getGlobal = Function('return (function() ' + '{}.constructor("return this")( )' + ');');

So i should change way of getting global object.

[HerrimanCoder]

Thank you, sanex. With your latest instructions I disabled those few settings and was able to obfuscate all my code so that it doesn't break in the extension. BUT when I de-obfuscate the obfuscated code at http://jsnice.org/, it successfully re-constructs the code in a mostly-understandable fashion. Some things are still nicely opaque, but many things are now understandable. When I enable those other obfuscation settings, jsnice can't touch it, and things remain very obfuscated, but as it stands, it's too easy. Is there any way you can make the obfuscation more hard-core without resorting to eval()? And perhaps have a separate checkbox just for "use eval()" or etc? That would be super awesome.

[sanex3339]

Did you use controlFlowFlattening option?

[HerrimanCoder]

One other note: https://javascriptobfuscator.com/ (the paid tool) can do quite impressive obfuscation without using eval and thus without breaking chrome extensions. So I know this is possible. Thanks in advance for anything you can do. I love that yours is free.

[sanex3339]

If you will use controlFlowFlattening option alongside with new deadCodeInjection (this option available only in 0.10.0-beta.x versions - transformations of code will very hardcode =))

Also new 0.10.0-beta.8 version with fix 2114064 will be available later today.

[HerrimanCoder]

Thanks! Here are the settings I used: http://www.zerogravpro.com/temp/obf_settings.png

[sanex3339]

stringArray option is very important

[sanex3339]

In 10-20 mins i will publish new beta release

[sanex3339]

Please try new javascript-obfuscator@0.10.0-beta.8
eval and Function(...) are no more using in code of custom nodes.

But be aware. Version on https://javascriptobfuscator.herokuapp.com/ will be changed only with stable release (currently panned in next one-two weeks).

[HerrimanCoder]

String Array does make the obfuscation MUCH stronger...but it uses eval() (on the website) and thus breaks my Chrome Extension. I am using the website version. I'm going to try javascript-obfuscator@0.10.0-beta.8. Are there instructions somewhere of what I need to install and how to make this work on my local windows PC?

[sanex3339]

String Array does make the obfuscation MUCH stronger...but it uses eval() and thus breaks my Chrome Extension. I am using the website version.

No. eval was used with stringArrayEncoding, you can disable it.

Why you can't use latest beta npm package? It has Node API and CLI.

[HerrimanCoder]

I did it all by command line. The obfuscation is awesome and the chrome extension works perfectly! Thanks so much for building an awesome tool and for helping me to get it working. THANKS!

[sanex3339]

Nice! If here no problem anymore, please, close the issue and be prepared for stable release of 0.10.0 in next two weeks.

[tomgallagher]

Hello

Great package!

Is there a date on the version on https://javascriptobfuscator.herokuapp.com/ without eval?

Also, it seems like, if you want to keep performance as fast as possible, you only recommend the compact
and mangles variable names options?

[sanex3339]

Version without eval already on https://javascriptobfuscator.herokuapp.com/