Phaser code obfuscation

[mariogarranz]

I am trying to obfuscate my Phaser game code so that it can't be easily manipulated. It was built by extending State and Sprite classes mainly, which means I do rarely use variables, but mostly object properties instead.

 

What I have noticed is that UglifyJS wont obfuscate the code, even if using the mangle option, because object properties are not obfuscated.

 

An alternative to this was to use Closure Compiler with ADVANCED_OPTIMIZATIONS mode. This is supposed to obfuscate object properties too, but after throwing hundreds of warnings, the produced code is totally broken.

 

So I was wondering if any of you have had any success with this?

 

 

PS: I know obfuscated code can still be de-obfuscated. The thing is right now it just takes some basic JS knowledge and 5 minutes reading the code to break the highscores. I'm pretty sure if I can make it harder, cheaters wont spend their time with that.

[Heppell08]

jscompress.com

 

Pretty useless because people can use 

 

http://jsbeautifier.org/

 

Use that on minified code to see it better

[mariogarranz]

Yeah, well, jscompress.com is using UglifyJS without mangling. So, it's just removing unnecessary whitespaces and comments, not really obfuscating the code. That's why it's so easily reversed.

[Heppell08]

what about this: http://javascriptobfuscator.com/

[Heppell08]

or this one is better

 

http://www.jsobfuscate.com/

 

Done a good job masking it but my state set up broke when i tried to run the obbed code.

[mariogarranz]

or this one is better

 

http://www.jsobfuscate.com/

 

Done a good job masking it but my state set up broke when i tried to run the obbed code.

 

WOW.

After having tried many different configurations for the most known "compiler" projects out there, like UglifyJS and Closure Compiler, I didn't think a simple online tool would solve my problem.

Not only it obfuscated the code, but it also reduced it to half the size of the UglifyJS minified version.

Thanks

[Heppell08]

No problem! Glad you got it running and working.

There's a lot of js tool sites out there. You'd be surprised

[v0van1981]

google closure:
java -jar compiler.jar --charset UTF-8 --compilation_level ADVANCED_OPTIMIZATIONS --js src/*.js --js_output_file out.min.js --externs phaser.min.js 2>NUL

 

[Arcanorum]

I'm pretty sure if I can make it harder, cheaters wont spend their time with that.

 

How true (or not) that statement is might worry you...

 

You should consider anything that you put on the web to be already compromised. If people want to mess with all your hard work, they will, regardless of how many speed bumps you throw in there.

 

Any sensitive stuff shouldn't be handled by the client.

[enriqueto]

we use jscrambler:

 

http://www.ravalmatic.com/2014/07/jscrambler-is-helping-us-to-protect-our.html

[MorpheusZ]

sounds like you're seeking security by obscurity, not good

I'm assuming you have a global leader board somewhere that all clients will access. Even if the code is not understandable, the packets sent to this leader board can be monitored and then imitated.

 

Consider using a secret key and a backend to ensure no one fiddles with your high scores. As an example, here's a tutorial on how clay.io suggests you handle this issue:

http://clay.io/docs/encryption

 

Perhaps deploying your game there could be a solution (you'd still need a backend).

[matias_ini]

On 9/10/2014 at 7:01 AM, v0van1981 said:

google closure:
java -jar compiler.jar --charset UTF-8 --compilation_level ADVANCED_OPTIMIZATIONS --js src/*.js --js_output_file out.min.js --externs phaser.min.js 2>NUL

 

Hi v0van1981 

I am trying to minimize a Phaser project using Google Closure Compiler with ADVANCED_OPTIMIZATIONS compilation_level.

I tried using phaser.min.js file as externs but I get 14 ERRORS when running the .jar.

Have you been able to make it work?

 Please help

[samme]

@matias_ini try it with phaser.js

[matias_ini]

I tried both with phaser.js and phaser.min.js but both give me errors.

java -jar compiler.jar --compilation_level ADVANCED_OPTIMIZATIONS --js ./GamePlay.js --js_output_file=out.js --externs ./phaser.js

I get a lot of warnings and this errors:

./phaser.js:2604: ERROR - variable Phaser is undeclared
    this.anchor = new Phaser.Point(0, 0);
                      ^^^^^^

./phaser.js:2710: ERROR - variable lastLineWidth is undeclared
            lineWidths.push(lastLineWidth);
                            ^^^^^^^^^^^^^

./phaser.js:9817: ERROR - variable tempPoint is undeclared
    this.worldTransform.applyInverse(point,  tempPoint);
                                             ^^^^^^^^^

./phaser.js:10204: ERROR - variable GraphicsData is undeclared
    return new GraphicsData(
               ^^^^^^^^^^^^

./phaser.js:12427: ERROR - variable exports is undeclared
    if (typeof exports !== 'undefined') {
               ^^^^^^^

./phaser.js:12428: ERROR - variable module is undeclared
        if (typeof module !== 'undefined' && module.exports) {
                   ^^^^^^

./phaser.js:12432: ERROR - variable define is undeclared
    } else if (typeof define !== 'undefined' && define.amd) {
                      ^^^^^^

./phaser.js:13711: ERROR - variable PIXI is undeclared
PIXI.Circle = Phaser.Circle;
^^^^

./phaser.js:19989: ERROR - variable CocoonJS is undeclared
        CocoonJS.App.onSuspended.addEventListener(function () {
        ^^^^^^^^

./phaser.js:43527: ERROR - variable localStorage is undeclared
            device.localStorage = !!localStorage.getItem;
                                    ^^^^^^^^^^^^

./phaser.js:43729: ERROR - variable process is undeclared
        if (typeof process !== "undefined" && typeof require !== "undefined")
                   ^^^^^^^

./phaser.js:43729: ERROR - variable require is undeclared
        if (typeof process !== "undefined" && typeof require !== "undefined")
                                                     ^^^^^^^

./phaser.js:64791: ERROR - variable global is undeclared
!function(e){"object"==typeof exports?module.exports=e():"function"==typeof define&&define.amd?define(e):"undefined"!=typeof window?window.p2=e():"undefined"!=typeof global?global.p2=e():"undefined"!=typeof self&&(self.p2=e())}(function(){var define,module,exports;return (function e(t,n,r){function s(o,u){if(!n[o]){if(!t[o]){var a=typeof require=="function"&&require;if(!u&&a)return a(o,!0);if(i)return i(o,!0);throw new Error("Cannot find module '"+o+"'")}var f=n[o]={exports:{}};t[o][0].call(f.exports,function(e){var n=t[o][1][e];return s(n?n:e)},f,f.exports,e,t,n,r)}return n[o].exports}var i=typeof require=="function"&&require;for(var o=0;o<r.length;o++)s(r[o]);return s})({1:[function(require,module,exports){
                                                                                                                                                                      ^^^^^^

./phaser.js:77529: ERROR - variable p2 is undeclared
p2.Body.prototype.parent = null;

 

[samme]

I'm not sure you needs externs at all.

What about 

java -jar compiler.jar --compilation_level ADVANCED_OPTIMIZATIONS --js ./GamePlay.js --js ./phaser.js --js_output_file=out.js

 

[matias_ini]

I I totally agree that what you tell me would be the BEST solution, in that way I would obfuscate everything together and it would be a great solution.

But I have tried it before and I got the same errors as with externs.

Samme, could you try running the code:

java -jar compiler.jar --compilation_level ADVANCED_OPTIMIZATIONS --js ./GamePlay.js --js ./phaser.js --js_output_file=out.js

and see if you also have errors?

Please????

GamePlay.js only has this code:

var GamePlayManager = {
    init: function() {
        console.log("init");
    },
    preload: function() {
        console.log("preload");
    },
    create: function() {
        console.log("create");
    },
    update: function() {
        console.log("update");
    }
}

var game = new Phaser.Game(1136, 640, Phaser.CANVAS);
    
game.state.add("gameplay", GamePlayManager);
game.state.start("gameplay");

 

[stupot]

I've used the closure compiler in a phaser project with maximum optimisations, the output was smaller and faster than uglify2. But it took a lot of work to manually create and maintain all the required externs,  I don't do this anymore becasue of this, mobiles have become much more powerful to compensate.  Phaser has a lot functions/properties created programatically that cannot automatically be scanned for,  so debugging the optimised code back to the source to see what else whould be extern'd was a nightmare.  Luckily I only used a minimal portion of Phaser so didn't have to do a full job on it.