Name Protection

Name Protection in ByteHide Shield encompasses a set of powerful features that obfuscate identifier names and property names in your code, making it significantly harder to understand and reverse engineer.

This protection is available in all editions of ByteHide Shield.

How It Works

Name Protection works by transforming identifiers (variable names, function names, parameter names) and optionally property names into meaningless or randomized substitutes. For example, meaningful names like calculateTotal or userProfile might be transformed into names like _0x8f2a15 or a.

This transformation destroys the semantic meaning encoded in your identifier names, making the code much harder to understand. When combined with other obfuscation techniques, it creates multiple layers of protection against reverse engineering.

Protection Components

Name Protection includes several configurable components:

Identifier Names Generator

Protection ID: identifierNamesGenerator

Controls how new identifier names are generated during obfuscation.

• Value string : Specifies the generator type. "hexadecimal" by default
  • Available values:
    • 'hexadecimal': Names like _0x123abc
    • 'mangled': Short names like a, b, c
    • 'mangled-shuffled': Like mangled but with a randomized alphabet
    • 'dictionary': Uses names from a provided dictionary (requires identifiersDictionary option)

Rename Globals

Protection ID: renameGlobals

Controls whether global variables and functions with declarations are renamed.

• Enabled boolean : Enables renaming of global variables and functions. false by default

Rename Properties

Protection ID: renameProperties

Controls whether object property names are renamed.

• Enabled boolean : Enables renaming of object property names. false by default

• Mode string : Controls the safety level of property renaming. "safe" by default

  • Available values:
    • 'safe': Excludes built-in properties and common patterns to prevent runtime errors
    • 'unsafe': Renames properties more aggressively without safety checks

Configuration Examples

Basic Configuration (shield.config.json)

{
  "identifierNamesGenerator": "hexadecimal"
}

Advanced Configuration

{
  "identifierNamesGenerator": "mangled-shuffled",
  "renameGlobals": true,
  "renameProperties": true,
  "renamePropertiesMode": "safe",
  "reservedNames": ["^_", "^\\$", "^jQuery"]
}

Using Dictionary Generator

{
  "identifierNamesGenerator": "dictionary",
  "identifiersDictionary": ["foo", "bar", "baz", "qux", "norf"]
}

Build Tool Integration (Webpack)

// webpack.config.js
const ByteHideShieldPlugin = require('@bytehide/webpack-shield');

module.exports = {
  // ... other webpack config
  plugins: [
    new ByteHideShieldPlugin({
      projectToken: 'your-project-token',
      config: {
        identifierNamesGenerator: "hexadecimal",
        renameGlobals": false,
        renameProperties: false
      }
    })
  ]
}

Code Transformation Example

Original Code

function calculateTotal(items) {
  let subtotal = 0;
  
  for (let i = 0; i < items.length; i++) {
    const item = items[i];
    subtotal += item.price * item.quantity;
    
    if (item.discountApplicable) {
      subtotal -= item.discountAmount;
    }
  }
  
  const tax = subtotal * 0.08;
  const grandTotal = subtotal + tax;
  
  return {
    subtotal: subtotal,
    tax: tax,
    grandTotal: grandTotal
  };
}

// Global function
function formatCurrency(amount) {
  return "$" + amount.toFixed(2);
}

Transformed Code (with Identifier Names Generator)

function _0x5e2af9(_0x426730) {
  let _0x25cb4a = 0;
  
  for (let _0x16d87a = 0; _0x16d87a < _0x426730.length; _0x16d87a++) {
    const _0x4ba8cd = _0x426730[_0x16d87a];
    _0x25cb4a += _0x4ba8cd.price * _0x4ba8cd.quantity;
    
    if (_0x4ba8cd.discountApplicable) {
      _0x25cb4a -= _0x4ba8cd.discountAmount;
    }
  }
  
  const _0x19e82d = _0x25cb4a * 0.08;
  const _0x31c60e = _0x25cb4a + _0x19e82d;
  
  return {
    subtotal: _0x25cb4a,
    tax: _0x19e82d,
    grandTotal: _0x31c60e
  };
}

// Global function
function formatCurrency(_0x5a78e5) {
  return "$" + _0x5a78e5.toFixed(2);
}

Transformed Code (with Rename Globals and Rename Properties)

function _0x5e2af9(_0x426730) {
  let _0x25cb4a = 0;
  
  for (let _0x16d87a = 0; _0x16d87a < _0x426730["_0x3fb81c"]; _0x16d87a++) {
    const _0x4ba8cd = _0x426730[_0x16d87a];
    _0x25cb4a += _0x4ba8cd["_0x2e7a1d"] * _0x4ba8cd["_0x15ea3b"];
    
    if (_0x4ba8cd["_0x59a71c"]) {
      _0x25cb4a -= _0x4ba8cd["_0x3e7b21"];
    }
  }
  
  const _0x19e82d = _0x25cb4a * 0.08;
  const _0x31c60e = _0x25cb4a + _0x19e82d;
  
  return {
    ["_0x2c56a1"]: _0x25cb4a,
    ["_0x42fb7c"]: _0x19e82d,
    ["_0x5a83e4"]: _0x31c60e
  };
}

// Global function (renamed with renameGlobals: true)
function _0x28e7f3(_0x5a78e5) {
  return "$" + _0x5a78e5["_0x1dfe63"](2);
}

When to Use

Name Protection is beneficial in almost all obfuscation scenarios:

• Identifier Names Generator: Use in all protection cases as a baseline obfuscation technique
• Rename Globals: Use when your code doesn't need to expose specific global functions or variables
• Rename Properties: Use for internal code that doesn't interact with external APIs or when you have thorough tests in place

For optimal results:

1. Always use Identifier Names Generator as a minimum protection
2. Use Rename Globals with caution and thorough testing
3. Be especially careful with Rename Properties, considering the safe mode first
4. Use the Reserved Names option to protect critical identifiers that should remain unchanged

Compatibility Notes

Name Protection has the following compatibility considerations:

Identifier Names Generator

• Compatibility: Very high; rarely causes issues
• Performance: No runtime performance impact
• Code size: Minimal impact on code size

Rename Globals

• Compatibility: May break code that depends on specific global names
• External libraries: Can cause issues when your code must interact with external libraries
• DOM interactions: May break code that registers global event handlers

Rename Properties

• Compatibility: May break code that accesses properties dynamically or relies on specific property names
• External APIs: Can cause issues with code that interfaces with external APIs
• Framework integration: Can break integration with frameworks that expect specific property names

Related Protections

For maximum security, combine Name Protection with:

• String Array
• Control Flow Flattening
• Object Keys Transform