Code obfuscation

What is obfuscation?

• During JS compilation, code is transformed with junk instructions and control-flow changes to protect source code

Getting started

• IDEA creates an obfuscator.json file under the project module
• Obfuscation is off by default — set binPath correctly in the JSON config

Install and configure the obfuscator

Install Node.js

• Reference: https://blog.csdn.net/qq_48485223/article/details/122709354

Install npm install -g javascript-obfuscator

• On Windows, run in cmd or PowerShell
• Reference: https://www.npmjs.com/package/javascript-obfuscator
• Or search for javascript-obfuscator installation guides

1
npm install -g javascript-obfuscator
2
npm install -g class-validator

Configuration

• Default settings below are tested and working. See the tool site for more: [https://www.npmjs.com/package/javascript-obfuscator]
• nodeBinPath: path to Node.js node.exe — see example
• obfuscatorBinPath: path to the javascript-obfuscator executable
• After installing Node.js, global modules are usually at: C:\Users\Administrator\AppData\Roaming\npm\node_modules (check with npm root -g; username varies)
• Copy the full path to javascript-obfuscator under node_modules

1
{
2
  "nodeBinPath": "D:\\programe\\nodejs\\node.exe",
3
  "obfuscatorBinPath": "C:\\Users\\Administrator\\AppData\\Roaming\\npm\\node_modules\\javascript-obfuscator\\bin\\javascript-obfuscator",
4
  "target": "node",
5
  "compact": false, // compress code
6
  "log": true, // show log output
7
  "optionsPreset": "high-obfuscation", // obfuscation level
8
  "deadCodeInjection": false,
9
  "simplify": false,
10
  "seed": 10, // random seed count
11
  "controlFlowFlattening": true,
12
  "controlFlowFlatteningThreshold": 1,
13
  "unicodeEscapeSequence": false,
14
  "stringArray": true,
15
  "stringArrayRotate": false,
16
  "stringArrayShuffle": false,
17
  "stringArrayThreshold": 1,
18
  "stringArrayWrappersCount": 5,
19
  "stringArrayEncoding": ["rc4"],
20
  "stringArrayCallsTransform": false,
21
  "selfDefending": false,
22
  "splitStrings": false,
23
  "splitStringsChunkLength": 1
24
}

Notes

• If obfuscatorBinPath is set and the file exists, obfuscation runs by default for both JS and dex compile modes
• Clear obfuscatorBinPath or delete obfuscator.json to disable obfuscation during compile
• Obfuscation increases bundle size — avoid very long single files; split into modules
• Custom settings may break scripts after obfuscation — restore defaults if that happens
• Enable log to see obfuscation details during compile
• Obfuscation is CPU-heavy — disable during daily dev; enable for release or packaging