1

I am about to ship an ionic 3 app and i am running in the process of obfuscating and uglifying the code.

For uglification, we are using the builtin uglifyer which gets executed when building with --prod.

For obfuscation we are running WEBPACK-OBFUSCATOR (Javascript-obfuscator) https://github.com/javascript-obfuscator/javascript-obfuscator

The below order is executed when building: 1- the webpack configuration runs --> which leads to obfuscating the code. and 2- the uglification performed by default by ionic3

Questions: Is this the correct order? should we obfuscate and then uglify or should we uglify and then obfuscate. I am running into this since we tried to set obfuscation with "selfDefend" enabled, which basically does not allow any change on the code after obfuscation: so after uglification we code failed.

So we are left with 2 options:
1- Change the order: does not seem possible in Ionic . (please confirm) .
2- Disable the self defense option.

Thank you in advance.

Elio Khattar
  • 320
  • 1
  • 3
  • 16
  • Intuitively it seems to me the correct order would be first minify THEN obfuscate (and only if you really insist). The reason is that obfuscators might produce buggy output (depends on how aggressive you are options wise). Also, if you are aggressively obfuscating then your performance will actually drop due to all the extra inserted junk. Running a minifier AFTER an obfuscator would probably try to strip out all the extra junk. – Bjoern Rennhak May 30 '18 at 15:38
  • Funnily enough, JS based malware often needs to not only be small, but also highly obfuscated to resist reverse engineering. One standard practice in that context is to roll some kind of base64 encoded and encrypted piecemeal madness. At the end of the day you can still reverse engineer it given enough time and effort. So basically what I'm saying is... I wonder if obfuscation buys you much. – Bjoern Rennhak May 30 '18 at 15:44
  • Here 1 month later looking for a similar answer. I noticed npm has a obfuscate package for ionic. Not sure if you've tried this or what you did worked?https://www.npmjs.com/package/ionic-voricles-obfuscate – Stephen Romero Jul 11 '18 at 13:58
  • 1
    @StephenRomero I tried it and it's not working. It Obfuscates the file perfectly but when you try to launch the app, you just see a white screen. – Ankit Pant Oct 01 '19 at 14:26

0 Answers0