我想做一个JavaScript应用程序,不是开源的,因此我希望学习如何可以混淆我的JS代码?这可能吗?


当前回答

试试这个工具Javascript混淆器

我在自己的HTML5游戏中使用了它,不仅将其大小从950KB减少到150 kb,而且还使源代码不可读闭包编译器和迷你器是可逆转的,我个人不知道如何扭转这种混乱。

其他回答

作为JavaScript/HTML/CSS混淆器/压缩器,你也可以尝试Patu Digua。

有许多免费的JavaScript混淆工具;然而,我认为重要的是要注意,很难混淆JavaScript到不能进行逆向工程的地步。

为此,我在一定程度上使用了几个选项:

YUI Compressor. Yahoo!'s JavaScript compressor does a good job of condensing the code that will improve its load time. There is a small level of obfuscation that works relatively well. Essentially, Compressor will change function names, remove white space, and modify local variables. This is what I use most often. This is an open-source Java-based tool. JSMin is a tool written by Douglas Crockford that seeks to minify your JavaScript source. In Crockford's own words, "JSMin does not obfuscate, but it does uglify." It's primary goal is to minify the size of your source for faster loading in browsers. Free JavaScript Obfuscator. This is a web-based tool that attempts to obfuscate your code by actually encoding it. I think that the trade-offs of its form of encoding (or obfuscation) could come at the cost of filesize; however, that's a matter of personal preference.

困惑:

试试YUI压缩机。这是一个非常流行的工具,由Yahoo UI团队构建、增强和维护。

你也可以使用:

闭包编译器 UglifyJS

更新:这个问题最初是在2008年提出的,并且所提到的技术已弃用。你可以使用:

Terser -更多信息在web.dev。

私有字符串数据:

保持字符串值为私有是另一个问题,混淆不会有太大的好处。当然,通过将您的源代码打包到一个混乱的、最小化的混乱中,您可以通过模糊获得轻量级的安全性。大多数情况下,是您的用户在查看源代码,客户端上的字符串值是为他们使用的,因此通常不需要那种私有字符串值。

If you really had a value that you never wanted a user to see, you would have a couple of options. First, you could do some kind of encryption, which is decrypted at page load. That would probably be one of the most secure options, but also a lot of work which may be unnecessary. You could probably base64 encode some string values, and that would be easier.. but someone who really wanted those string values could easily decode them. Encryption is the only way to truly prevent anyone from accessing your data, and most people find that to be more security than they need.

Sidenote:

众所周知,Javascript中的混淆会导致一些错误。混淆者在这方面做得越来越好,但许多公司认为他们从缩小和gzipping中看到了足够的好处,而混淆所带来的额外节省并不总是值得麻烦。如果您试图保护您的源代码,也许您会认为这是值得的,只是为了让您的代码更难阅读。JSMin是一个很好的替代方案。

解释型语言的问题在于,你要发送源代码才能让它们工作(除非你有一个字节码的编译器,但话说回来,反编译是相当简单的)。

因此,如果您不想牺牲性能,您只能对变量和函数名进行操作,例如。用a, b…aa、ab……或者a101 a102等等。当然,尽可能多地删除空间/换行符(这就是所谓的JS压缩器所做的)。 如果您必须实时加密和解密字符串,那么混淆字符串将会对性能造成影响。加上一个JS调试器可以显示最终值…

我正在使用闭包编译器实用程序的java脚本混淆。它减少了代码,并为混淆提供了更多的选项。 此实用程序可在谷歌代码在以下URL: 闭包的工具

但是现在我听到很多关于UglifyJS的消息。你可以在闭包编译器和UglifyJS之间找到各种比较,其中Uglify似乎是赢家。 UglifyJS:一种可以与闭包媲美的快速Node.js压缩器

很快我就给了UglifyJS机会。