js-confuser icon indicating copy to clipboard operation
js-confuser copied to clipboard

We can stored data in variable ... NAME?

Open doctor8296 opened this issue 11 months ago • 8 comments

I found new approuach to store any data in variable name.

const some_interesting_text = 100;
let variable_name;
for (const key in {some_interesting_text}) {
    variable_name = key;
}

variable_name // "some_interesting_text"

With that we can store code, decrypt codes etc etc in variable name. This also can be used as the protection from renaming variables (var names integrity check). We can force user to keep the original name of the variable and variable names can be infinitely long! It will be extremely irratating to work with such code.

We also can keep logic in evals. Example:


let someOutsideEvelVariable = false;
const someOutsideEvelVariableName = (() => {
  for (const key in {someOutsideEvelVariable} ) {
    return key;
  }
})();
eval(`${someOutsideEvelVariableName}=true`);

doctor8296 avatar Dec 06 '24 21:12 doctor8296

This is just using the shorthand syntax, which Babel and most tools will support. It did break https://deobfuscate.io/.

path.scope.rename("some_interesting_text", "RENAMED")
const RENAMED = 100;
let variable_name;
for (const key in {
  some_interesting_text: RENAMED
}) {
  variable_name = key;
}
console.log(variable_name); // "some_interesting_text"

MichaelXF avatar Dec 06 '24 23:12 MichaelXF

Oh, sad. But concept is fire

doctor8296 avatar Dec 07 '24 05:12 doctor8296

@MichaelXF and another one! image

doctor8296 avatar Jan 13 '25 06:01 doctor8296

also it seems it is unredefineable damn, I should've save this for myself

image

image

doctor8296 avatar Jan 13 '25 06:01 doctor8296

This approach works with both class constructors and function constructors. It ensures they cannot be renamed! In essence, it’s a win—no functions or classes can be renamed, and even some variables used to construct a class remain unaffected. So all non-constant variables are safe well. Damn, I am pure evil

With function it was always a thing, idk why I didn't think about that much. Maybe I thought that name can be redefined

doctor8296 avatar Jan 13 '25 07:01 doctor8296

Here the shortest version

Screenshot 2025-01-13 at 11 48 19

doctor8296 avatar Jan 13 '25 08:01 doctor8296

also interesting thing: image

doctor8296 avatar Jan 13 '25 08:01 doctor8296

Screenshot 2025-01-13 at 11 59 48

that's funny how you basicaly can put any code in there and it will be reflected in signature (as well as func code lol)

Screenshot 2025-01-13 at 12 00 18

doctor8296 avatar Jan 13 '25 09:01 doctor8296