Obfuscation and DOMAIN lock

[ftguy2018]

Hello,

I am about to complete a project with PANDA2 however I want to add some obfuscation and domain lock, what are the possible options here without making the whole project to run from 60fps to 5 fps ? I tried jscrambler but it made the whole app so slow it is not practical in that matter, I had like to hear some suggestions of what is currently available/possible.

Thank you

[ftguy2018]

Actually I found out one could use code annotation to direct jscrambler to do (or not do) obfuscation on some part of the jscript which could be used to improve performances :

 

https://docs.jscrambler.com/code-integrity/tutorials/code-annotations

 

However will the web export keep the code annotation if I put some in the code / the engine itself ? I am under the impression that all comment are erased at export, so will it be way to add support for code annotation ?

[enpu]

Obfuscation that slows down the game from 60fps to 5fps doesn't sound right. Have you tried this one: https://github.com/javascript-obfuscator/javascript-obfuscator

 

[ftguy2018]

@enpu Actually jscrambler is doing very deep obscurity (not only obfuscation) so that does explain it, but we do not really need it on the engine itself but only on the part of our sensible licensing code, so is there a way to turn off the PANDA2 export minify process so we could add code annotation (comment) to a web export project ?  

[enpu]

@ftguy2018

I have added this feature to the roadmap

[ftguy2018]

@enpu unfortunately, the obfuscator link you provided does not work with the game.min.js, I tried to upload game.min.js to https://obfuscator.io/  and just do a simple obfuscation and the code is breaking

TypeError: _0x4af513.prototype is undefined[Learn More] game.min.js:1:171373
_0x552186<
game.min.js:1:171373
<anonymous>
game.min.js:1:171085
<anonymous>
game.min.js:1:171021
_loadModules
game.min.js:1:17263
_loadModules
game.min.js:1:17416
_loadModules
game.min.js:1:17416
_loadModules
game.min.js:1:17416
_DOMReady
game.min.js:1:10884
_loadNativeExtensions/Function.prototype.bind/<
game.min.js:1:19806

 

So we are totally stuck at the moment, is there a workaround possible ? Can we eventually obfuscate the original game\main.js before the export ? Will it work ? Any suggestion would be welcome as we need to delay our release until we can securely obfuscate the code. Please kindly advise.

[ftguy2018]

From chrome console :

game.min.js:1 Uncaught TypeError: Cannot set property 'apply' of undefined
    at game.min.js:1
    at _0x1777d6 (game.min.js:1)
    at Object.body (game.min.js:1)
    at Object._loadModules (game.min.js:1)
    at Object._loadModules (game.min.js:1)
    at Object._loadModules (game.min.js:1)
    at Object._loadModules (game.min.js:1)
    at Object._DOMReady (game.min.js:1)
    at HTMLDocument.<anonymous> (game.min.js:1)

[ftguy2018]

Some updates : It seems if we add some code annotation to disable the obfuscation on the engine and only keep it for our code then we can succeed to have the project starting and the performances are quite OK so I believe we will go this way while waiting for a better version with integrated obfuscation features.

[Astralax]

Careful of doing a full obfuscation on all code. It will execute more slowly. 

You're better off obfuscating portions of the code that aren't as speed sensitive.

You'll also want to obfuscate the portion of your code that uses domain locking. (Write this yourself using document.location or use JSlockit or DomainLock JS -- both of which are under 1k).