javascript-obfuscator VS jsfuck

I don't need/use IDA, Nemlei just used https://obfuscator.io/, which just obfuscates the crap out of the code using various known methods (which I won't go into detail, it's public knowledge) and an un-obfuscation was cooked up by others. The one fucked-up thing the website does is randomizing function names, it just changes every variable/function name. We can't "un-obfuscate" those, so it's up to our brains to figure out what the code does, and change the names back.

I was considering using a obfuscation library (https://github.com/javascript-obfuscator/javascript-obfuscator) and noticed in the usage example that backticks are used and the javascript is enclosed within. The issue is that my javascript already has backticks from using template literals so my code then errors out.

Obfuscation: JavaScript Obfuscator

What I ended up doing is having two build steps, one for renderer and other for the main process, in the main process build I use https://github.com/javascript-obfuscator/javascript-obfuscator. Works pretty fine.

It's to purposefully makes your code harder to read so it prevents people from stealing your work. Here's a tool that does it: https://obfuscator.io/

I just tested it on a little snippet of my code obfuscated with https://obfuscator.io/ and it worked seemingly perfectly.

My original code:

  function resizeImage(img) {

https://obfuscator.io/ produces a similar result, perhaps that's all they used.

Also worthwhile is their home page: https://jsfuck.com/

That wasn't the point of this exercise - nobody is saying that these are actual code is examples you'd see in real life.

The point is that in lots of languages these statements would simply result in compile time errors. In JS, though, the type coercion rules are so loose (and in many cases extremely non-obvious) that you can see this head scratching behavior.

It's the same underlying behavior that leads to very cool/very insane stuff like JSFuck: https://jsfuck.com/

That's partly why, among other ridiculousness involving type, it's possible to code with only []()!+ in JS.

You forgot about JSFuck

If you want to see why JavaScript is such a ~shitty~ interning language, look at this: https://jsfuck.com/

jsfuck.com

First of all, consider security. As with any REPL, malicious actors could try to send their victims code to execute locally on their machine to whatever effect, so at least a warning is in order. Validation against such attacks is utterly useless, just take a look at JSF*ck and give up.