Javascript obfuscation tricks
a day ago
- Functions can read themselves via comments, allowing arbitrary string data to be embedded and used; deobfuscators that remove comments will break the code.
- Stack trace line and column numbers can be used as encryption keys; reformatting or removing functions changes these numbers, causing decryption to fail.
- Browser crashes can be triggered by async fork bombs (e.g., async function calling itself twice) that hide the crash location in devtools.
- Variable names can be extracted as strings through object key iteration, enabling data storage in identifiers and enforcing name integrity with eval.
- To thwart LLM-based deobfuscation, embed threatening Base64 instructions (with noise) that cause models to refuse, or overload the context window by making every code segment essential.