Can google closure generated code with advanced settings be reversed engineered?

Question

Does anybody know if JavaScript code that was generated by Google closure with advanced settings be reversed engineered?

Google closure renames most of the js variable and function names so I curious to know if it's a good option for protecting code from being stolen.

Thanks

Answer 1

Yes, it can easily be reversed. Google Closure is a code optimizer which is almost the opposite of code obfuscation. That is not always obvious to everyone because some of the things it does, actually obfuscate a little bit your code. I talking about the variable and function renaming, whitespace and comment removal.

But it is not meant to protect. For instance, the new names it generates are always the same (deterministic). And the reason is that it only renames variables and functions to replace them with short ones. It does not care for protection. It does not have anything to change the control flow, which is what you'll want if you seek protection. It does not have anything to obfuscate strings and other literals as well. On the contrary, it uses techniques such as Constant Folding and Constant Propagation which actually make your code simpler and easier to follow.

For protection I really think your best option is JScrambler. They have good range of source code transformations and code traps that are meant for protection.

Answer 2

Yes it can be reversed, however, if your code in ADVANCED_OPTIMIZATIONS has a lot of inlining to it, it can be much harder to reverse engineer. Secondly, since there is a lot of constant folding, it makes the code much harder to read, ie:

/** 
 *  @type {number}
 *  @const
 */
var FLAG_A=0x4FFFFFF0;

/** 
 *  @type {number}
 *  @const
 */
var FLAG_B=0x01;

/** @type {number} */
var flags=FLAG_A|FLAG_B;

console.log(flags,(flags&FLAG_A)>0);

outputs to:

console.log(1342177265,!0);

This makes the actual code much harder to read and figure out what it's doing. The less you rely on inheritance and strings, and move towards bit flags -- will make the reverse engineered code work, but make it much harder to change or extend.