I left that project a long time ago, so I don't need it anymore. And don't really think anybody needs that at all.

I used {identifiersPrefix: '__$$LOGIN$$__'}, so every global identifier had that prefix. Then I replaced that on the go with username + encoded timestamp to watermark the bundle.

<?php
// ...
$activeTill = time() + (24 * 60 * 60) + rand(-60 * 60, 60 * 60);
$activeTill36 = base_convert($activeTill, 10, 36);
$loginReplacement = '_' . substr($_USERNAME, 0, 4) . $activeTill36 . '$'; // _da41qoimqm$
$content = str_replace('__$$LOGIN$$__', $loginReplacement, $content);

Also I added the same variable with regexp in some detector function:

const varToTakeTheTimestamp = (uselessOption) => {
  return __$$LOGIN$$____$$FAKE_HELPER_NAME$$__(uselessOption, uselessOption - 8), uselessOption; // _da41qoimqm$d(...);
};

const getActiveTill = (_) => {
  const fnAsString = varToTakeTheTimestamp.toString();
  const matched = fnAsString.match(new RegExp("_[0-9a-z]{4}([0-9a-z]+)", "i"));
  if (matched && fnAsString && matched[1]) {
    // some validation
    return matched[1];
  }
  return 0;
};
const activeTill = getActiveTill(_, '0x4e7', -'0x370');
if (parseInt(activeTill, 36) < currentTime) {
  // countermeasures
}

With such measures I was sure that if code leaked I would know the source (because it won't work without watermarks), and also code was securely protected from reusing it after expiration date.

Bonus: countermeasures section

window.Math.random = () => document.body.innerText.length;
const _temp = window.setTimeout;
window.setTimeout = window.setInterval;
window.setInterval = _temp;

Uh oh!

reservedStrings not working with vmObfuscation #1366

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions