Forums » Code » Protect your code the right way ( I like it )

Sooo... we all know that baking and minifying compressing and other stuff dont do the trick to prevent people from stealing your code.

Yesterday I found awesome tool which I used on my baked game. Not only it reduced the weight of the source code from 950KB to 150KB but it also scrambled the code so it is pretty much unreadable - plus it works without any plugins and such so you bake your game, use this tool and drop it on your server as you would normally do and IT WORKS!

Check it out - I downloaded the demo version - it can do one file at the time but that's all you need with game.min.js :)

check it out!

$E(a`%&((`\"V$);a`2r!(`( #` o(`(&!a);}}`/2(` 7'[0]`2w\"clip` h3if (`#o+clip.addEventListener`.f!playthrough\", `$i&ev`%l$remove` :<arguments.callee,`%h\");`!>(`%b#true, ev);}` >%`!K3error`!G.` NC}` q!`#V3 = [clip`(Z\"`%e(`%2,1`$*~urn`$n!;}, ge`+6(pa`/4!`%/!`!1#`&b/`+A+,` g\"`%^$` Q$[i++];`(<#`\"w!paused ||` F!.ended` 4(` )$` (!`.y#Time`/c\"`!l)}` }%0]` r\"();` ((` O,` V$` 9&`/l$Music`.K0tracks:[],`0E$Track`.U#` ,#Index:0, random:`%H!, _`/(&_loop` /%fadeInterval:0` *#Timer` q#_`\"a!`&H$Bound`/U5`$4!` >/`$L$` -*.bind`,_!`)q\"Object`1W#Property) {` #1` S!, \"`\"2\"\", {get:`!!!getV` 1!` v', s` 7$s` ,/});` i9loop` t,Looping` l5` ..});} else `/4%__`!+\"Getter__`#<%` )+(`\"?&`\"+5`) #` S$S` D3`\"L0` L+`!,&`\"R#`\":6` |5` N(`\"Y1)`3H!ad`3@(music`)<#!`3u,) {`(P\"`/\"p`3G\"` N! instanceof`,A% ?` 6\".` D!:` '\";var `(d!`(|\"soundManager`,G\"`.+\"`-}#` E!.loop`':%loop` 1#`#R\"` 1%` )\"` 5#`/;/nded`\"j$`(2/`!+&his.`*G\"`-b\"` '!`(>\"!`-6\"`*T'`%j$` (( =`\">\"`#]!nex`)X+` _&` #leng`.D!`#X$`$P\"top`/3%`+S'`\"I$`+\\\" ? Math.floor(` &!` 3\"() *` C\"` w+:`'u#` g)+ 1) %` =/`!3)`\"5%` =&[` [-]` M\"play(`2l!`.k!`\"K4`#=+`\"U)` 0(`/M%}, stop` 'e` (.`0z-, play` P^`\"i%`*!&` g*`1O#`'_'}`,p!` ;.l`,A%`(7#l`3z(i` ]#`$=\"` C$`$J#i]`(j$l`&|!`,c%`!17`(u#`!H\"` =-v`!D%`)J%v.limit(0, 1)`!/H`)2}}, fadeOu`(`(time`#g@clear`3^$`/r#`3m(`%>#`3r% = new ig.` *!`!\"\"`.B#` L( = set` f/Step`1L)50`%3!` 4%`#]*var v`\"K$`!=%.delta().map(-` -,target, 0, 1, 0)`#d(`*Q$`#6$if (v <= 0.01`#k$`+L/`'!\"`#l2`#\">`3U#`-=.` h&v`$d!`.O*`(e.`'N&`!d$`(R$` v(next();}}});`1+%`0p!Class.extend({path:\"\", `!@\":1, `!V#Clip:null, multiChannel:true, ini`&@(`1R\"` <(`!T%`2c\"pa`-e$` 9(`2}!` $'!==`1\"\"` E\"`2N!`%V!loa`3~(loa`\"y%`3v7if` :-` #(`#E\"`!u\"true);}`(,$if (ig.ready) {`3w1` R(`\"),`!l\"`!/%`$3%ig.addResource`'z\"`%1!`-l3`\"\"/`-n0Clip`$x\"`!Z)get`!\\&`'?*Clip`&P&` I,` 2#`(B#`']#` N-`/(&`0}2` A,`%K$` W)`0u/` 4!`0v-`'>(.FORMAT = {MP3:{ext:\"mp3\", mime:\"audio/mpeg\"}, M4A` <$4a` 3-4; codecs=mp4a\"}, OGG` I#ogg` A+ogg` G%vorbis\"}, WEBM` L#webm` E+webm` B/CAF` M#caf` D+x-caf\"}}`\"I&use = [`\"T+.OGG, ` %,MP3]` P&c`&n\"s = 4` ,&`&+# =`'w!;`#X\"bak` )&ig.module(\"impact`'s!er\").requires` 1%image\", ` ($font` $'`&9!\").defines(`%^*g.L` t!`,-0r`(E#s:[], game` ;!`,3#status:0, done:`+7!, _un`!e!d` O!_drawS` @%_i`.m#Id` *!`)](Bound` t#`,s+`!1%, `!J%`'I$` 3% =`!X&`'M\"` C% =` N&`3&#`!)-`0m%` .(`2';for (var i`(/! i <` L\"` r%.length; i++`!W$`\"f%.push`)Q\"` H%[i]`*x#}`.6.`-4#ystem.`2?!(\"#000\")`31!!`!'1`!/$end();`,G$`!ERloa`-`*`!l))`-?#`$h' = set`3|*draw`#;', 16`0l%` u$`\"J'r`$t!re`19#`$53` ]!en`\"~,`-/$done`.},done`(t$`#H!`!Y*`!{'`)G!`#p#setGam`\"W#`&5%`!:!draw`!2*`

Sooo this is how a bit of my source code looks like now - I wish you luck descrambling it :D

useless if you ask me .. a regular js packer or yui compressor will do it .. ..
its browser side interpreted anyway ..

the only thing you could do is quit developing browser games .. / not that regular games are safer .. ;)

if somebody can lern something from that code .. why not ? .. and even if they publish a other titel .. / you own the source code .. you wrote it .. so its YOUR IP ..

i would not worry to much about a licence agreement helps way more ..

dominic releases the whole packets as source .. would you like to just get an API and work on a server programm ? probably not ..

in my point of view .. a decodet source just invites guys to digg deeper

and suchs algorythms arent that hard to decode at all ;) console.log() helps alot at it

pretty expensive, $99 bucks! how's the performance of the games like ? slow load time i bet (due to decoding)

Well it seems people missed the point of this tool - Minifying and YUI or Closure Compiler still leave readable code - this one scrambles it to the non readable form. Granted its easy to decode it but sometimes just presenting the scrambled code puts people off. Another thing is the script's weight - I minified mine, used closure compiler and it weighed 950-960kb - packing it to 150KB is an impressive result no matter if it is easy to descramble it or not.

@fgufish -Try the trial and nope mate - it runs smoothly as it was just baked version - did not notice any loss of the performance. It is similar to the p.a.c.k.e.r so it uses eval() to run the scrambled code. Personally I would not pay for it but I work for a digital agency so it was bought for me today. I'm just surprised by the quality of the compression - on average it achieves great compression results - like I said 950Kb to 150 it has to count for something.

Just bake your game and run it through it - and test.

Quote from BlackDolphinMedia
and suchs algorythms arent that hard to decode at all ;) console.log() helps alot at it

Yeah I get your point I descrambled my game with one line of code but that is not the issue to anyone who knows what they are doing.

There is no way to successfully prevent people from descrambling your js unless you are using scrambling based on private/public keys or distribute it as executable.

Another plus 950 to 150KB without setting gzipping on the server and serve it this way.


Just to clarify - I am not flogging this program here - its just a tool that I used and was impressed with the result.

@Jerczu - well said! i'll give it a spin and report back

i do agree at the script weight .. but that would be the only reasion .. as i mentioned .. backing + packing with a other lib would do it .. just my 2 cents

and put guys away .. yes some of them ...

BUT MOST OF THEM WILL FIND A WAY to decode it ;) at least writing a algo once to decode them all they check the code for a reasion .. INTERREST ..

the only fruity reasion to use it is the compression ..

@fugufish loadingtime must be faster .. > the script gets deliverd to the browser and does the stuff :) so the transfer of the script is faster and the decoding probably takes a couple ms more but overall it should be faster

bottom line : isnt worth it for that bit more compression probably 5%
YUI-compressor will do it as well .. or other js packing + scrambeling there are a million of them for free ..

Quote from BlackDolphinMedia
bottom line : isnt worth it for that bit more compression probably 5%
YUI-compressor will do it as well

You see YUI-Compressor can match it only if you gzip the minified source. To work with gzipped script you need to deliver it through CDN or set up your server which is not possible on shared hosting.

This tool dont gzip it an achieves 80% reduction in size and don't require you to set up your server in any way. The unreadable source is just an icing on the cake.

Quote from Jerczu
Yeah I get your point I descrambled my game with one line of code but that is not the issue to anyone who knows what they are doing.

There is no way to successfully prevent people from descrambling your js unless you are using scrambling based on private/public keys or distribute it as executable.

Another plus 950 to 150KB without setting gzipping on the server and serve it this way.


Just to clarify - I am not flogging this program here - its just a tool that I used and was impressed with the result.

I'm really amazed how this javascript obfuscator scrambled our game.min.js into a more unintelligible js gibberish.

I would also like to use this for protecting my Impact source codes but I'm just curious at how you de-scrambled your obfuscated code in just one line of code. That you were able too must mean that this obfuscator is not yet that secure (at least for pro coders and js hackers) :D

Thanks.

I am pretty sure this product does the same (or something similar) to this:

http://dean.edwards.name/packer/

(enable Base64 encoding).

By adding that initial descrambling time could actually present an initialization performance hit, probably more noticeably on mobile.

Open your sources people. It helps everybody become better programmers. ;)

I used nihilogic's JS to PNG compression method before on my 10k Apart entry and it worked out great. I've had a ton of requests from people for the source code because I'm sure none of them could figure out how to decompress it.

http://ajaxian.com/archives/want-to-pack-js-and-css-really-well-convert-it-to-a-png-and-unpack-it-via-canvas

The only downfall is that there is a short decode time. You can see the blink in my entry because I compressed the CSS into the PNG as well, so the styling has to wait on the JS to run. http://10k.aneventapart.com/1/Entry/325

Here's the more technical explanation for doing the JS to PNG conversion and decoding.

http://blog.nihilogic.dk/2008/05/compression-using-canvas-and-png.html