About

 Next

Jasob 4.2

JavaScript Obfuscation Fascination™

www.jasob.com


Introducing Jasob

JavaScript is scripting programming language used in millions of Web pages worldwide. It can be embedded into the Web page to add functionality. Scripting languages are not compiled, which means that JavaScript source code has to be downloaded together with Web page in order to be run by the Web browser. This has several drawbacks:

  • JavaScript source code can be easily viewed by anyone. All it takes is to open Web page in the Web browser and to choose option View Source. This means that anyone can steal your JavaScript code, modify it and reuse it for his own purposes.

  • Source code has descriptive variable and function names. Also comments are added to make source code more readable. This can lead to large Web pages. On the other side, comments and descriptive variable and function names help the one that has stolen your JavaScript code to manage with it easily.

  • Large Web pages take more time to download and get displayed by the Web browser. Because browser interprets JavaScript code, shorter the statement, faster it runs.

Jasob addresses all mentioned issues. With Jasob your JavaScript code will become impossible to understand thus preventing anyone to steal and modify it, its size will shrink for around 70% which will significantly improve download time and execution speed in the Web browser. How Jasob achieves this? Jasob reads files with JavaScript code and replaces descriptive variable and function names like Customer, Salary, FirstName... with meaningless names like d, g, m... It also removes comments and unnecessary white space characters (space, tab, carriage return, line feed). The functionality of the code remains the same while source code changes dramatically. This process is called obfuscation. Obfuscated code is impossible to reverse-engineer and extremely hard or impossible to understand. The size of obfuscated code is much smaller than the original code. Typical shrinkage is around 70%. This allows for better download time and faster execution in the Web browser.

It is better to distribute obfuscated version of your JavaScript code and to keep your original JavaScript source code for yourself. The following is the example of original JavaScript source code and the obfuscated version of the same JavaScript source code:

//------------------------------------------------------
// Calculate salary for each employee in "aEmployees".
// "aEmployees" is array of "Employee" objects.
//------------------------------------------------------
function CalculateSalary(aEmployees)
{
    var nEmpIndex = 0;
    while (nEmpIndex < aEmployees.length)
    {
        var oEmployee = aEmployees[nEmpIndex];
        oEmployee.fSalary = CalculateBaseSalary(oEmployee.nType, oEmployee.nWorkingHours);
        if (oEmployee.bBonusAllowed == true)
        {
            oEmployee.fBonus = CalculateBonusSalary(oEmployee.nType,
                                                    oEmployee.nWorkingHours,
                                                    oEmployee.fSalary);
        }
        else
        {
            oEmployee.fBonus = 0;
        }
        oEmployee.sSalaryColor = GetSalaryColor(oEmployee.fSalary + oEmployee.fBonus);
        nEmpIndex++;
    }
}

Listing 1-1. Original JavaScript source code.

function c(g){var m=0;while(m<g.length){var r=g[m];r.l=d(r.n,r.o);if(r.j==true){r.k=e(r.n,
r.o,r.l);}else{r.k=0;}r.t=f(r.l+r.k);m++;}}

Listing 1-2. Obfuscated JavaScript source code.

CSS and non-JavaScript/CSS code

Jasob also hadles Cascading Style Sheet (CSS) code in a similar fashion as JavaScript code and also removes white space characters and comments from non-JavaScript/CSS code. Along with other features, this makes Jasob a complete solution for Web content optimization.

In this section

  • The Graphical User Interface


The Graphical User Interface

Figure 1-1. The Jasob Graphical User Interface.

The graphical user interface consists of the following main parts:

  • The Main Menu contains various operations that could be initiated.
  • The Toolbar provides a number of shortcuts to most frequently used operations.
  • Project Files displays all files that are part of the current project. Additional information for a single file is shown in the tooltip when mouse is pointed over a particular file.
  • The File Viewer shows the selected file content. Both source file content and obfuscated file content are shown depending on the currently selected tab (Source or Obfuscated) at the top of the file viewer. Syntax highlighting is applied to make the file content more readable.
  • Name Lists contain names that could be changed. There are two separate lists. The list to the left contains function names (which could as well be constructors) and the list to the right contains all other names (variables, properties and methods).


Opening Files

There are many sources where JavaScript/CSS code could be found. From pure JavaScript files (.js files) or CSS files (.css files) to server side Web technologies like ASP.NET (.aspx files). Jasob is capable of reading JavaScript/CSS code from the following file types:

  • JavaScript Files (.js)
  • HTML Files (.htm, .html)
  • XHTML Files (.xht, .xhtm, .xhtml)
  • Server Side Includes Files (.shtm, .shtml)
  • ASP Files (.asp)
  • ASP.NET Files (.aspx, .ascx)
  • ATL Server Files (.srf)
  • PHP Files (.php, .php3, .php4, .php5)
  • JSP Files (.jsp, .jspf)
  • JSP Document Files (.jspx)
  • XML Files (.xml, .xsd)
  • XSLT Files (.xsl, .xslt)
  • Cold Fusion Files (.cfm)
  • ePerl Files (.iphtml)
  • CSS Files (.css)

Plus, you can define your own file types or edit existing file types. For more information, see File Types. You can also customize settings for each individual opened file. For more information, see The File Settings.

When opening a file, Jasob applies rules defined for that file type to find block(s) of JavaScript/CSS code. The file content is then displayed in the file viewer. Syntax highlighting is applied to distinguish blocks of JavaScript/CSS code from the other text inside the file. Further, syntax highlighting is applied to the blocks of JavaScript code to make them more readable.

Rules for JavaScript and CSS code blocks as well as syntax highlighting colors can be customized. For more information, see Options.

In this section

  • Opening a Single File
  • The Jasob Project
  • Opening a Web Site
  • The Web Site Settings
  • The File Settings
  • Editing and Refreshing Files
  • Entities


Opening a Single File

To open a file, choose File > Open... from the main menu, or click [image] on the toolbar. Alternatively, you can choose Add... from the project files context menu.

Figure 2-1. Opening a single file.

To select more than one file at a time, hold down Control or Shift key and then click on files you want to select.

First entry in the file types list (Project Files) designates the Jasob project. For more information, see The Jasob Project.


The Jasob Project

The project consists of an arbitrary number of files. Together with file names the following information is also stored:

  • Individual file settings for server side code. For more information, see File Types: The Server Side Code.
  • Individual file settings for client side JavaScript and CSS code. For more information, see File Types: The Client Side JavaScript and CSS Code.
  • Other individual file settings. For more information, see File Types: The Other Settings.
  • Whether individual file is excluded from the analysis and obfuscation.
  • File names of the saved obfuscated files.
  • All settings from File Types and Options dialogs (except Fonts and Colors settings).
  • Changes for names in name lists. Changes for a particular name include whether a name is marked for obfuscation, new name for a name, name status and changes for individual name occurrences in strings.

    IMPORTANT: Different individual settings for name occurrences in strings that have AS (Ambiguities in Strings) status cannot be preserved during the analysis or while saving the project or Web site settings. For more information on AS status and how to easily solve this potential issue, see Starting the Analysis: The AS Status. Warning message appears when you are opening or saving the project and Jasob detects at least one name with AS status. You can turn on/off this message by using File > Show Message If AS Status option from the main menu.

To create the project, open an arbitrary number of files and choose File > Save Project or File > Save Project As... from the main menu, or click [image] on the toolbar. The saved file has the .jsbp extension. File names that make up the project, are saved relative to the saved project file (relative to the .jsbp file).

To open the project, choose File > Open Project... from the main menu. Alternatively, you can choose File > Open... from the main menu, or click [image] on the toolbar and choose Project Files entry in the file types list.


Opening a Web Site

To open a Web site, choose File > Open Web Site... from the main menu, or click [image] (the arrow) on the toolbar and choose Open Web Site... from the context menu.

Figure 2-2. Opening a Web site.

Select the Web site folder and Jasob will go through all files in the selected folder and all it's subfolders, while opening only files of a supported file type. For a list of supported file types, see Opening Files.

If File > Exclude Hidden Folders from the main menu is checked, then files inside hidden folders will not be opened even if they are of a supported file type. For example, Microsoft FrontPage uses hidden folders to store data about Web pages. Files inside those hidden folders are named exactly as original Web pages even though they don't contain Web content. Obfuscating such files may lead to errors, so they must be excluded from obfuscation.

Depending on which Web technology you use, it is not always possible to move your Web site to a different location by simply copying files from one folder to another. That is basicaly what happens when you are saving an obfuscated Web site. You choose folder for the obfuscated Web site and the original Web site content together with obfuscated files is copied to that folder. For more information, see Saving an Obfuscated Web Site. So, if you are using Web technology that doesn't allow you to move a Web site to a different location by simply copying files from one folder to another, you should first make a copy of the original Web site using tools that are provided by the particular Web technology. Once you make a copy of the original Web site you should open that copy with Jasob. When saving the obfuscated Web site, choose the same folder from where you have opened the Web site. This way original files in the Web site copy will be replaced with obfuscated files. For example, if you have ASP.NET project you should open that project with Microsoft Visual Studio .NET and make a copy of that project by using the Project > Copy Project... command from the Microsoft Visual Studio .NET main menu. Then you should open that project copy with Jasob and obfuscate it. For more information, see Example: How to Obfuscate a Dynamic Web Site.


Web Site Settings

 Previous | Next

The Web Site Settings

When working with a Web site, it is very useful to be able to save settings for all files that make up the Web site and to save changes for names in name lists. Then, when you open the same Web site again you can simply apply those changes and start working from where you left off when you last saved the Web site settings. The Web site settings file consists of a supported (opened) Web site file names and changes for names in name lists. Together with file names the following information is also stored:

  • Individual file settings for server side code. For more information, see File Types: The Server Side Code.
  • Individual file settings for client side JavaScript and CSS code. For more information, see File Types: The Client Side JavaScript and CSS Code.
  • Other individual file settings. For more information, see File Types: The Other Settings.
  • Whether individual file is excluded from the analysis and obfuscation.
  • All settings from File Types and Options dialogs (except Fonts and Colors settings).
  • Changes for names in name lists. Changes for a particular name include whether a name is marked for obfuscation, new name for a name, name status and changes for individual name occurrences in strings.

    IMPORTANT: Different individual settings for name occurrences in strings that have AS (Ambiguities in Strings) status cannot be preserved during the analysis or while saving the project or Web site settings. For more information on AS status and how to easily solve this potential issue, see Starting the Analysis: The AS Status. Warning message appears when you are applying or saving the Web site settings and Jasob detects at least one name with AS status. You can turn on/off this message by using File > Show Message If AS Status option from the main menu.

To save the Web site settings, open a Web site, make changes and choose File > Save Web Site Settings or File > Save Web Site Settings As... from the main menu, or click [image] on the toolbar. The saved file has the .jsbw extension. File names that make up the Web site, are saved relative to the saved Web site settings file (relative to the .jsbw file).

To apply the Web site settings, open a Web site and choose File > Apply Web Site Settings... from the main menu, or click [image] on the toolbar.


Customizing File Settings

 Previous | Next

The File Settings

To customize the file settings, right-click the file in the project files list and choose Settings... from the project files context menu.

Figure 2-3. Customizing file settings.

For complete explanation of the fields on the File Settings dialog box, see File Types.

To apply settings to all files that have the same filter description as the current file, click the Apply To All Filter button on the File Settings dialog box.


Editing and Refreshing Files

Sometimes it is necessary to modify source files while they are opened with Jasob. To modify source file, right-click the file in the project files list and choose Edit With... from the project files context menu. Another menu will appear with applications that you can use to edit the file. If desired application is not in the list, click Choose Program... and then choose the application you wish to use among all applications that are installed on the computer.

After you have finished editing the file and have set focus back to Jasob, modified files will be automatically detected and refreshed. You can turn on/off automatic detection of the modified files by using Edit > Detect Modified Files option from the main menu. To manually refresh source file, right-click the file in the project files list and choose Refresh from the project files context menu.

When refreshing a file, all settings for that file will remain the same, only file content will be refreshed. If name lists are populated with names, refreshed file will be analyzed and name lists will be updated according to the new file content.


Entities

JavaScript code can be placed inside various file types (like HTML, XML...) where you can use character entity references (entities) to represent characters that can't be entered directly because they would be interpreted as markup or because they can't be easily entered on a keyboard. Jasob doesn't take the meanings of the entities into account when they are found inside JavaScript code that is placed inside HTML elements or when the whole file represents JavaScript code. In all other cases (including HTML attributes, XML elements and attributes...) Jasob takes into account the meanings of the following entities:

Entities | Meaning
&#13; or &#xD; or &#10; or &#xA; | line break (new line)
&#32; or &#x20; or &#9; or &#x9; or &#12; or &#xC; or &#160; or &#xA0; or &nbsp; | whitespace
&#39; or &#x27; or &apos; | ' (apostrophe)
&#34; or &#x22; or &quot; | " (quotation mark)
&#92; or &#x5C; | \ (backslash)


The File Viewer

The file viewer shows selected project file content. Depending on the currently selected tab at the top of the file viewer, source or obfuscated file content is displayed. Syntax highlighting is applied to the file content to make it more readable. Syntax highlighting colors can be customized. For more information, see Fonts and Colors. There are many ways to manage with the file content inside the file viewer, like finding text, going to the specified line and character number and using bookmarks.

In this section

  • Finding Text
  • Going to the Line Number
  • Bookmarks


Finding Text

To find text within files content, choose Edit > Find... from the main menu. The search starts from the current caret position in the file viewer. If the currently selected tab is Source, then search is done on original (source) files content. When the currently selected tab is Obfuscated, search is done on obfuscated files content.

Figure 3-1. Finding text.

Fields on the Find dialog box have the following meanings:

  • Text to find contains text to search for.
  • Case sensitive designates whether search is case sensitive.
  • Match whole word designates whether founded text must be the whole word.
  • Search up designates whether search is done from the current caret position to the beginning of the file.
  • Search selection designates whether to search only the selected text in the currently selected file.
  • Current file designates whether to search only the currently selected file.
  • Global designates whether to search through all project files.
  • Find Next starts the search when clicked.

To search for the next occurrence of the searched text, choose Edit > Find Next from the main menu.


Going to the Line Number

To move the caret to the specific line number, choose Edit > Go To Line Number... from the main menu. The caret is moved to the specified line number in the currently selected file. You can also specify character number inside the specified line. The current line and character positions of the caret are displayed in the Ln and Ch indicators on the status bar.

Figure 3-2. Going to the line number.

Fields on the Go To Line Number dialog box have the following meanings:

  • Line number contains line number where to move the caret.
  • Character number contains character number inside the specified line number. If this field is empty, the caret is moved to the first character of the specified line number.


Bookmarks

Use bookmarks to quickly move the caret from one location to another. There can be more than one bookmark in a single line of text. This is important when you want to put bookmarks in the obfuscated code because each obfuscated block of JavaScript code can be placed into a single line.

Figure 3-3. Using bookmarks.

The following operations may be used when working with bookmarks:

Operation | Main Menu | Toolbar
Toggle bookmark at the current caret position. | Edit > Bookmarks > Toggle Bookmark |
Move the caret to the next bookmark. | Edit > Bookmarks > Go To Next Bookmark |
Move the caret to the previous bookmark. | Edit > Bookmarks > Go To Previous Bookmark |
Move the caret to the first bookmark in the next line. | Edit > Bookmarks > Go To Next Line Bookmark |
Move the caret to the first bookmark in the previous line. | Edit > Bookmarks > Go To Previous Line Bookmark |
Clear all bookmarks in the current line. | Edit > Bookmarks > Clear Line Bookmarks |
Clear all bookmarks in the current file. | Edit > Bookmarks > Clear File Bookmarks |
Clear all bookmarks in all files. | Edit > Bookmarks > Clear All Bookmarks |


Analyzing Files

Once files have been loaded, they need to be analyzed. The analysis is a process of finding JavaScript names that can be changed. Not all JavaScript names can be changed. For example, reserved words or properties like while or lastIndex can't be changed. Names that can't be changed are called system names. When analysis has finished, name lists are populated with names that can be changed. System names don't appear in name lists. Whether or not names that appear in JavaScript strings will be placed in name lists depends on JavaScript strings settings. For more information on JavaScript strings settings, see File Types: Obfuscate all names in JavaScript strings that are found in JavaScript code and File Types: Obfuscate all JavaScript strings as JavaScript code.

In this section

  • Starting the Analysis
  • A Name in Strings
  • Navigating to Names


Starting the Analysis

To start the analysis, choose Obfuscate > Analyze from the main menu, or click [image] on the toolbar. To exclude/include file from the analysis, select file from the project files list and choose Excluded from the project files context menu. To include all excluded files into the analysis, choose Include All from the project files context menu.

Figure 4-1. Analyzed files.

When analysis has finished, name lists are populated with names. You can customize the appearance of a name list by right-clicking the name list header and choosing which columns to show or hide in the name list. Name lists can have the following columns:

  • Name contains a name as it appears in original files. Check box designates whether to change this name to a new name. When (*) character (without parenthesis) is found at the end of the name, it designates that this name is case insensitive. For more information on how to specify where case insensitive names are found, see Options section and then choose desired Web technology.
  • New Name contains a name that will replace the original name.
  • Status shows current name status. The following flags can be used:

    Status | Description
    N (New) | A name is new to the name lists. This flag is set automatically when a name first appears in a name list. After first interaction with a name, N flag is automatically cleared. It can be also set or cleared manually by selecting names from a name list and by choosing Status > Set [New] or Status > Clear [New] from the name list context menu.
    NS (New in Strings) | A name has new occurrences in strings. This flag is set automatically for a name occurrence in string when it first appears in a name in strings list. To see exactly which name occurrences in strings for a given name have NS status, right-click the name in the name list and choose In Strings... from the name list context menu. After first interaction with a name, NS flag is automatically cleared. It can be also set or cleared manually by selecting names from a name list (or name in strings list) and by choosing Status > Set [New In Strings] or Status > Clear [New In Strings] from the name list (or name in strings list) context menu.
    AS (Ambiguities in Strings) The AS flag is set automatically for name occurrences in strings when Jasob is unable to distinguish those name occurrences in strings and is therefore unable to preserve different settings (marked/unmarked and NS status flag) for them during the analysis or while saving the project or Web site settings. To see exactly which name occurrences in strings for a given name have AS status, right-click the name in the name list and choose In Strings... from the name list context menu.

    To distinguish name occurrences in strings, Jasob takes into account name position inside the string, the string content and the function name inside which the string is found. So, if there is more than 1 name occurrence in strings for a given name for which all those 3 elements are the same, Jasob is unable to preserve different settings for those name occurrences in strings and will preserve only settings for one such name occurrence in strings and set it to all other name occurrences in strings with AS status for that name. This is actually not the problem if settings for those name occurrences in strings for a given name are the same (for example when all those name occurrences in strings are marked or unmarked for obfuscation). Potential issue can emerge when you have different settings for those name occurrences in strings for a given name. In that case you should change at least one of those 3 elements Jasob uses to distinguish name occurrences in strings for some of those name occurrences in strings. The easiest way to solve this issue and remove AS status would be to change slightly some of those strings where such name occurrences are found (for example by appending blank character to them) or to use variable instead of the same string literals or to use <JasobNoObfsStr> elements to designate regions in which strings shouldn't be obfuscated (and therefore won't even appear in name in strings list), like in the following examples:

    //---------------------------------------------------------
// In this function all name occurrences in strings for
// 'myDiv' will get AS status.
//---------------------------------------------------------
function MyFunction()
{
    var oDiv = document.getElementById("myDiv");
    alert("myDiv");
    var oStartTag = document.getElementById("myDiv");

    //
    // code
    //
}

//-------------------------------------------------------------
// In slightly modified function none of the name occurrences
// in strings for 'myDiv' will get AS status.
//-------------------------------------------------------------
function MyFunction()
{
    var strMyDiv = "myDiv";
    var oDiv = document.getElementById(strMyDiv);
    alert("myDiv ");
    var oStartTag = document.getElementById(strMyDiv);

    //
    // code
    //
}

//-----------------------------------------------------------------
// In another slightly modified function none of the name
// occurrences in strings for 'myDiv' will get AS status.
//-----------------------------------------------------------------
function MyFunction()
{
    var strMyDiv = "myDiv";
    var oDiv = document.getElementById(strMyDiv);
    // <JasobNoObfsStr>
    alert("myDiv");
    // </JasobNoObfsStr>
    var oStartTag = document.getElementById(strMyDiv);

    //
    // code
    //
}

    Please note one extra blank character in second modified function in alert("myDiv "); that was added to distinguish that string from string in var strMyDiv = "myDiv";. The point is to modify slightly those strings in a way that will not affect the functionality of the code. For more information on <JasobNoObfsStr> element and how to use it in your source files, see File Types: Obfuscate all names in JavaScript strings that are found in JavaScript code.

    If you have opened file with names that have AS status in Jasob, then have modified source file in a way to remove AS status and then have set focus back to Jasob so file gets analyzed, it is possible that name occurrences in strings will still have AS status even though you have properly modified your code. This happens when old name occurrences in strings with AS status had different settings and now after analysis it is not certain which of those old settings should be used for new modified occurrences in strings. This means that you should now review settings for those new modified occurrences in strings and make corrections if necessary. After next analysis phase, AS status for those name occurrences in strings will be removed. You can also remove it immediately by right-clicking the file in the project files list and by choosing Refresh from the project files context menu.
    G (Global) A name is global. This flag is set automatically when there is at least one name occurrence found outside of any function.

    When defining JavaScript classes, all properties/methods defined inside constructor function will not have G flag (of course, this is true only if that same properties/methods are also not found somewhere else outside of any function). To set G flag for properties/methods in the same place where you have defined JavaScript class, you can write your code like the following:

    //---------------------------------------------------------
// Properties/methods defined inside constructor function
// initially will not get G status flag.
//---------------------------------------------------------
function MyClass(sProp1, nProp2)
{
    this.sProp1 = sProp1;
    this.nProp2 = nProp2;

    this.method1 = function (nPar1, nPar2)
    {
        return nPar1 + nPar2;
    }

    this.method2 = function (sMessage)
    {
        alert(sMessage);
    }
}

//---------------------------------------------------
// Properties/methods found outside of any function
// will get G status flag.
//---------------------------------------------------
MyClass.sProp1;
MyClass.method2;
    INN (Invalid New Name) A name has invalid new name. When certain new name can't be used as valid new name (for example when such name already exists in the source) it can be temporarily set as invalid new name. Invalid new names can be later validated if conditions change and those names could then be used as valid new names.

    During the analysis, if a new name can't be used as a valid new name anymore, it is automatically invalidated. Attempt to automatically validate invalid new names after each analysis phase can be made if option Obfuscate > Validate New Name When Analyzing from the main menu is checked. New names can be manually set as invalid by selecting names from a name list and by choosing Status > Set [Invalid New Name] from the name list context menu. To manually validate new names, select names from a name list and choose Validate New Name from the name list context menu. To try to validate all invalid new names in both name lists, choose Obfuscate > Validate New Names from the main menu. You can also clear INN status for selected names by choosing Status > Clear [Invalid New Name] from the name list context menu. If option Obfuscate > Validate New Name If Clearing INN Status from the main menu is checked then when clearing INN status it will be cleared only if new name in question can be validated.
  • Code shows number of name occurrences in code.
  • Strings shows number of name occurrences in strings.
  • Total shows total number of name occurrences in code and strings.
  • Name Length shows number of characters in the original name.
  • Name Size shows total number of characters the original name occupies in all source files.
  • Obfs Name Length shows number of characters in a name that will replace the original name. The values of this column may be NDEF, which means that value is not defined (in a case when a name is marked for obfuscation but there is currently no new name that will replace the original name).
  • Obfs Name Size shows total number of characters a name that will replace the original name occupies in all obfuscated files. The values of this column may be NDEF, which means that value is not defined (in a case when a name is marked for obfuscation but there is currently no new name that will replace the original name).
  • Net Reduction shows total number of characters by which the obfuscated name size is smaller than the original name size (Obfs Name Size - Name Size). The values of this column may be NDEF, which means that value is not defined (in a case when a name is marked for obfuscation but there is currently no new name that will replace the original name).
  • Reduction shows ratio by which the obfuscated name size is smaller than the original name size (1 - (Obfs Name Size / Name Size)). The values of this column may be NDEF, which means that value is not defined (in a case when a name is marked for obfuscation but there is currently no new name that will replace the original name).

You can sort a name list on any column by clicking on the column header. Click once for an ascending sort. Click a second time for a descending sort.

To simplify navigation to certain names in name lists, you can group names based on certain criteria. To group names in a name list, choose Group By from the name list context menu and then choose criteria you wish to use for grouping. Names satisfying choosen criteria appear at the top of the name list.

NOTE: Whether or not names that appear in JavaScript strings will be placed in name lists depends on JavaScript strings settings. For more information on JavaScript strings settings, see File Types: Obfuscate all names in JavaScript strings that are found in JavaScript code and File Types: Obfuscate all JavaScript strings as JavaScript code.


A Name in Strings

Each name that appears in a name list can also have its occurrences in strings. To see name occurrences in strings, select name from a name list and choose In Strings... from the name list context menu.

Whether or not names that appear in JavaScript strings will be placed in name lists (and their occurrences in strings in name in strings list) depends on JavaScript strings settings. For more information on JavaScript strings settings, see File Types: Obfuscate all names in JavaScript strings that are found in JavaScript code and File Types: Obfuscate all JavaScript strings as JavaScript code.

Figure 4-2. Name occurrences in strings for "MouseEnter".

The name in strings list has the following columns:

  • File shows file name where string with name occurrence has been found. Check box designates whether to change this name occurrence in string to a new name.
  • Status shows current status for a name occurrence in strings. The following flags can be used:

    Status | Description
    NS (New in Strings) | See Starting the Analysis: The NS Status.
    AS (Ambiguities in Strings) | See Starting the Analysis: The AS Status.
  • Function shows function name inside that file in which string has been found. This field is empty if string is global variable.
  • String displays actual string content in which name occurrence has been found.

You can sort the name in strings list on any column by clicking on the column header. Click once for an ascending sort. Click a second time for a descending sort.

To group name occurrences in the name in strings list, choose Group By from the name in strings list context menu and then choose criteria you wish to use for grouping. Name occurrences in strings satisfying choosen criteria appear at the top of the name in strings list.

To navigate back to the name in a name list, choose Go To List from the name in strings list context menu.

To navigate from name occurrence in the name in strings list to its occurence in a file, select name occurrence from the name in strings list and choose Go To Source from the name in strings list context menu.

NOTE: You can completely control which name occurrences in strings will appear in the name in strings list by using Obfuscate all names inside JavaScript strings that are found in JavaScript code and Obfuscate all JavaScript strings as JavaScript code settings from the File Types dialog box or from the File Settings dialog box and by using <JasobObfsStr>, <JasobNoObfsStr>, <JasobObfsJSStr> and <JasobNoObfsJSStr> elements in your source files to designate regions in which JavaScript strings should be or shouldn't be analyzed and obfuscated. For more information, see File Types: Obfuscate all names in JavaScript strings that are found in JavaScript code and File Types: Obfuscate all JavaScript strings as JavaScript code. To change those settings for each individual opened file, see The File Settings.


Navigating to Names

Once name lists are populated with names, there are various ways how to navigate from a name in a name list to its occurrences in files (both source and obfuscated), and from its occurrences in files back to the name in a name list.

From Name List to Files

To navigate from name in a name list to its occurrences in files, select name (or names) from a name list and choose Go To Source from the name list context menu. Name(s) occurrences in files (both source and obfuscated) will became highlighted. If Find First from the name list context menu is checked, then first name occurrence in first file will be brought into view. Go To Source option from the name list context menu highlights both name occurrences in code and in strings. To highlight only name occurrences in code, choose Go To Source [Code] from the name list context menu. To highlight only name occurrences in strings, choose Go To Source [Strings].

Highlighting colors can be customized. For more information, see Fonts and Colors.

Figure 4-3. Highlighted name occurrences in files.

To view currently highlighted names, choose Highlighted Names... from the name list context menu, or from the file viewer context menu.

Figure 4-4. Currently highlighted names.

The highlighted names list has the following columns:

  • Name contains name as it appears in original files. Read only check box designates whether to change name to new name.
  • New Name contains name that will replace original name.
  • Code shows whether name is highlighted in code.
  • Strings shows whether name is highlighted in strings.

You can sort the highlighted names list on any column by clicking on the column header. Click once for an ascending sort. Click a second time for a descending sort.

To group highlighted names in the highlighted names list, choose Group By from the highlighted names list context menu and then choose criteria you wish to use for grouping. Highlighted names satisfying choosen criteria appear at the top of the highlighted names list.

When highlighting names, if Add To Highlighted Names from the name list context menu is checked, then names will be added to the existing highlighted names. Otherwise, existing highlighted names will be replaced. To remove highlights from all names, choose Remove Highlights from the file viewer context menu, or choose Remove All from the highlighted names list context menu. To remove highlights from specific names, select those names from the highlighted names list and choose Remove from the highlighted names list context menu.

Navigating Through Highlighted Names

To navigate through highlighted name occurrences in file viewer, right-click highlighted name occurrence and choose command from the file viewer context menu:

  • Next selects next occurrence of the right-clicked name.
  • Previous selects previous occurrence of the right-clicked name.
  • First > Current File selects first occurrence of the right-clicked name in the current file.
  • First > Global selects first occurrence of the right-clicked name among all files.
  • Last > Current File selects last occurrence of the right-clicked name in the current file.
  • Last > Global selects last occurrence of the right-clicked name among all files.

  • Next Any selects next occurrence of any highlighted name starting from the current caret position.
  • Previous Any selects previous occurrence of any highlighted name starting from the current caret position.
  • First Any > Current File selects first occurrence of any highlighted name in the current file.
  • First Any > Global selects first occurrence of any highlighted name among all files.
  • Last Any > Current File selects last occurrence of any highlighted name in the current file.
  • Last Any > Global selects last occurrence of any highlighted name among all files.

Figure 4-5. Selecting next occurrence of the highlighted name.

Navigating to the Function Definition

To navigate to the function definition, select name from the functions name list and choose Go To Definition from the name list context menu.

From Files to Name List

To navigate from name occurrence in the file viewer to that name in a name list, right-click name occurrence in the file viewer and choose Go To List from the file viewer context menu. If right-clicked name in the file viewer doesn't exist in name lists, name occurrence in the file viewer will not be selected and Go To List command will be disabled.

You may also select arbitrary text in the file viewer and choose Go To List from the file viewer context menu. If there is more than one name in the selected text, the Go To List dialog box appears with names that were selected in the file viewer. Select names that you wish to appear selected in name lists and click on the Go To List button. Change focus from one name list to another with Tab or Shift+Tab to see selected names in both name lists. First visible selected name in each name list is automatically brought into view.

Figure 4-6. Navigating to more than one name in name lists.

From Name in Strings List to Files

To navigate from name occurrence in the name in strings list to its occurence in a file, select name occurrence from the name in strings list and choose Go To Source from the name in strings list context menu.

From Files to Name in Strings List

To navigate from name occurrence in the file viewer to that name occurrence in the name in strings list, right-click name occurrence in the file viewer and choose Go To List In Strings from the file viewer context menu. If right-clicked name in the file viewer doesn't exist in name lists or is not inside a string, Go To List In Strings command will be disabled.


Obfuscating Files

After the analysis has finished, the obfuscation can be done. The obfuscation is a process of replacing long descriptive function and variable names with short meaningless names. You can choose which names you want to obfuscate. New names may be manually entered, or generated automatically. Also, prefix and/or suffix can be set that will be added to the generated new names. Usually there are many names in name lists, and you are only interested in a smaller subset of those names you wish to keep track of. There is a feature called Names Bag to help you with that. The names bag allows you to work on a smaller subset of names and to apply changes to names in name lists, or to update names in the names bag with data from name lists. This is important when you are obfuscating "public" names that are used throughout your application and you want to keep track of new names for those "public" names.

In this section

  • Marking Names for Obfuscation
  • New Names
  • Starting the Obfuscation
  • Obfuscating Dynamic Web Pages


Marking Names for Obfuscation

To mark name for obfuscation, check the name check box in a name list, or select names from a name list and choose Mark from the name list context menu. If you don't want to obfuscate a name, uncheck the name check box in a name list, or select names from a name list and choose Unmark from the name list context menu.

When you mark name for obfuscation, automatically all name occurrences in strings for that name are also marked for obfuscation. To mark or unmark each name occurrence in strings, select name from a name list and choose In Strings... from the name list context menu. The Name in Strings dialog box appears. Now, you can use the name in strings list to mark/unmark each name occurrence in strings. In order to mark/unmark each name occurence in strings, the name in a name list must be marked for obfuscation. To mark all name occurences in strings, select name from a name list and choose Change All In Strings > Yes from the name list context menu. To unmark all name occurences in strings, select name from a name list and choose Change All In Strings > No from the name list context menu.

Figure 5-1. Marking name for obfuscation.

Marking Names with Prefixes and/or Suffixes

You can automatically mark/unmark or select only names with specific prefixes and/or suffixes. This way you can use certain prefixes/suffixes with variables in your JavaScript code, and then by using this option in Jasob, you can automate operations on those names.

To mark/unmark or select only names with specific prefixes and/or suffixes, choose Obfuscate > Mark Names With Prefixes... from the main menu.

Figure 5-2. Marking names with prefixes and/or suffixes.

Fields on the Mark Names With Prefixes And Suffixes dialog box have the following meanings:

  • Prefixes contains space delimited prefixes a name has to begin with in order to be considered.
  • Suffixes contains space delimited suffixes a name has to end with in order to be considered.
  • Mark names designates whether to mark names that contain specified prefixes and/or suffixes.
  • Unmark names designates whether to unmark names that contain specified prefixes and/or suffixes.
  • Only select names designates whether to only select names that contain specified prefixes and/or suffixes.
  • Case sensitive comparison designates whether comparison of prefixes and/or suffixes is case sensitive.

Change focus from one name list to another with Tab or Shift+Tab to see selected names in both name lists. First visible selected name in each name list is automatically brought into view.

Marking Names with Regular Expression

You can automatically mark/unmark or select only names that match specified regular expression.

To mark/unmark or select only names with regular expression, choose Obfuscate > Mark Names With Regular Expression... from the main menu.

Figure 5-3. Marking names with regular expression.

Fields on the Mark Names With Regular Expression dialog box have the following meanings:

  • Regular expression contains regular expression.
  • Mark names designates whether to mark names that match specified regular expression.
  • Unmark names designates whether to unmark names that match specified regular expression.
  • Only select names designates whether to only select names that match specified regular expression.
  • Case sensitive comparison designates whether regular expression is by default case sensitive.

Change focus from one name list to another with Tab or Shift+Tab to see selected names in both name lists. First visible selected name in each name list is automatically brought into view.

Marking Names in Elements and/or Attributes

You can automatically mark/unmark or select only names that are found in certain elements and/or attributes.

To mark/unmark or select only names that are found in specified elements and/or attributes, choose Obfuscate > Mark Names In Elements... from the main menu.

Figure 5-4. Unmarking names that are found in certain elements and/or attributes.

Fields on the Mark Names In Elements And Attributes dialog box have the following meanings:

  • Elements contains space delimited elements that must contain a name in order for a name to be considered.
  • Attributes contains space delimited attributes that must contain a name in order for a name to be considered.
  • Mark names designates whether to mark names that are found in specified elements and/or attributes.
  • Unmark names designates whether to unmark names that that are found in specified elements and/or attributes.
  • Only select names designates whether to only select names that are found in specified elements and/or attributes.
  • Case sensitive comparison designates whether comparison of elements and/or attributes is case sensitive.

Elements and attributes can have namespace prefixes in their names. When you are specifying elements and attributes you can use namespace prefixes according to the following table:

Elements | Meaning
: | All elements with whatever prefix are considered.
prefix: | All elements with the specified prefix are considered.
:element | Specified element with whatever prefix is considered.
prefix:element | Specified element with its prefix is considered.
element | Specified element with no prefix is considered.
Attributes | Meaning
: | All attributes with whatever prefix are considered.
prefix: | All attributes with the specified prefix are considered.
:attribute | Specified attribute with whatever prefix is considered.
prefix:attribute | Specified attribute with its prefix is considered.
attribute | Specified attribute with no prefix is considered.

Change focus from one name list to another with Tab or Shift+Tab to see selected names in both name lists. First visible selected name in each name list is automatically brought into view.

Case insensitive names

When marking case insensitive names ((*) character (without parenthesis) is found at the end of the name in a name list) for obfuscation, Jasob automatically marks for obfuscation all such names that are equal by case insensitive comparison. Further, when new names are set or generated for such case insensitive names that are equal by case insensitive comparison, Jasob makes sure that new names for those names are also equal by case insensitive comparison. This must be done when dealing with case insensitive names (like HTML element ids or CSS class selectors) because otherwise obfuscation of such names could break the obfuscated code.


New Names

New names are names that will replace original names when obfuscating. New names may be manually entered or generated by the application. It is not allowed for a new name to be a system name. Also, it is not possible to set the new name that already exists in name lists. Such actions would lead to errors in the obfuscated JavaScript code. Because JavaScript is case sensitive, name comparison is also case sensitive.

Manually Entering New Names

To manually enter a new name, double-click name in a name list, or select name from a name list and choose New Name... from the name list context menu.

Figure 5-5. Entering new name.

Generating New Names

To automatically generate new names, select names from a name list and choose Generate New Name from the name list context menu.

You can also generate new names by choosing Obfuscate > Generate New Names from the main menu, in which case names from both name lists will be considered and new names will be generated for all marked names that have empty or invalid new name (regardless of whether a name is currently selected in a name list or not).

When generating new names, a name's total number of occurrences marked for obfuscation in source files is taken into account in order to reduce obfuscated file size as much as possible. Best results are achieved when you use Obfuscate > Generate New Names from the main menu because it takes into account names from both name lists.

Generated new names could sometimes be longer than the original names (especially when the original name has only 1 character). You can choose to use the original name for the new name in such cases. To keep original names in such cases, make sure Obfuscate > Keep Original Name If Shorter from the main menu is checked, otherwise uncheck this option.

Underscore character ('_') is not used when generating new names, so it can be used for names that have to differentiate from generated new names.

Clearing New Names

To clear new names, select names from a name list and choose Clear New Name from the name list context menu.

Prefix and Suffix

You can set prefix and/or suffix to be automatically added to the manually entered and/or generated new names. For more information, see General Options: New Name.

Case insensitive names

When marking case insensitive names ((*) character (without parenthesis) is found at the end of the name in a name list) for obfuscation, Jasob automatically marks for obfuscation all such names that are equal by case insensitive comparison. Further, when new names are set or generated for such case insensitive names that are equal by case insensitive comparison, Jasob makes sure that new names for those names are also equal by case insensitive comparison. This must be done when dealing with case insensitive names (like HTML element ids or CSS class selectors) because otherwise obfuscation of such names could break the obfuscated code.


Starting the Obfuscation

To start the obfuscation, choose Obfuscate > Obfuscate from the main menu, or click [image] on the toolbar.

Figure 5-6. Obfuscated files.

When obfuscation has finished, tab Obfuscated appears at the top of the file viewer. This means that the file viewer will display obfuscated file content when the Obfuscated tab is selected.

To navigate from name occurrence in the source (original) file content to that name occurrence in the obfuscated file content, right-click name occurrence in the source (original) file content and choose Go To Obfuscated from the file viewer context menu. If right-clicked name in the file viewer doesn't exist in name lists, Go To Obfuscated command will be disabled.

To navigate from name occurrence in the obfuscated file content to that name occurrence in the source (original) file content, right-click name occurrence in the obfuscated file content and choose Go To Source from the file viewer context menu. If right-clicked name in the file viewer doesn't exist in name lists, Go To Source command will be disabled.


Obfuscating Dynamic Web Pages

Dynamic Web pages are Web pages that are created dynamically (on-the-fly) on the server upon each request for a Web page. Some of the Web technologies for creating dynamic Web pages include ASP, PHP, ASP.NET... Typical dynamic Web page consists of a static HTML code including JavaScript and a dynamic programming code that is executed on the server each time Web page is requested by the Web browser. Term static means that HTML code including JavaScript is not executed on the server in any way, instead, it is returned to the browser as is. Dynamic programming code is determined by the Web technology used on the server and is executed each time a Web page is requested. Dynamic programming code generates HTML code including JavaScript which is added to the static HTML content, thus creating final HTML page that is returned to the browser.

Now, if you change JavaScript name in a static part of your Web page, and you are referring to that name in a dynamic part of your Web page (from the server side code), you have to keep track of the new name for that name. For example, if you have JavaScript function called Show in your static part of a Web page (or included .js file which is also static part of a dynamic Web page), and in the process of obfuscation name Show changed to h, you have to update your dynamic programming code to use h instead of Show when generating HTML code. There is a way how to elegantly do this with Jasob.

First, in dynamic programming code you have to use variables (or constants) for JavaScript names that might change. It's best to use variables (or constants) for all JavaScript functions, variables, properties, methods... that you are using in dynamic programming code because eventually all such JavaScript names might change to new names during the obfuscation. For example, for the start when there is no obfuscated JavaScript code yet, declare string variable sShow with the initial value of 'Show'. Now, wherever you use JavaScript function name 'Show' in your dynamic programming code (server side code) you should use variable sShow instead. When obfuscation is done and JavaScript function Show changes to h you only have to change the value of variable sShow from 'Show' to 'h' and your dynamic programming code will correctly output h for the changed function name. And because you use variable sShow in the programming code instead of directly using value 'h', your dynamic programming code will remain readable as it was before the obfuscation.

To help you with that, in Jasob you can select names from a name list or from the names bag list and choose Copy > {dynamic programming language} > {access modifier if applicable} from the name list context menu or from the names bag list context menu. Selected names and associated new names will be copied to the clipboard in the form of variable names and variable values for the choosen dynamic programming language. Variable name is created based on the name from a name list, and variable value is the associated new name for the name in a name list. For example, if there is selected name MouseEnter in a name list and its associated new name is k and Copy > C# > Public has been choosen from the name list context menu, the content copied to the clipboard would be public const string MouseEnter = "k"; which can be pasted directly into the C# class where constants for JavaScript names are declared. This way you can select names from a name list (or names bag), choose dynamic programming language, copy new variable values to the clipboard and paste it directly into your dynamic code which makes it ready to use obfuscated JavaScript names with almost a single mouse click! When creating variable/constant names from names in a name list, prefix and/or suffix can be added to the name as it appears in a name list. For more information, see General Options: Copy to Language.

When obfuscating dynamic Web pages, you can use the names bag populated with JavaScript names that you use in your dynamic programming code, so you can easily make necessary operations on those names. For more information, see Example: How to Obfuscate a Dynamic Web Site.

The following is the example of C# class with constants for JavaScript names. Prefix str was used when constant names were created from names in name lists:

/// <summary>
/// Names for DHTML functions and variables.
/// </summary>
public class DHTML
{
    public DHTML()
    {
    }

    public const string strMainMenu   = "c";
    public const string strMenuItem   = "d";
    public const string strAddItem    = "e";
    public const string strAddSubitem = "f";
    public const string strShow       = "g";

    public const string strMainMenuContainerID = "j";
}

Listing 5-1. The C# class for JavaScript names.


The Names Bag

When obfuscating files, there is often a need to work on a specific set of names than on all those names in name lists. Navigating to certain names using name lists can be inelegant and time consuming. Plus, verifying whether you have done all the things you wanted with certain names, among all other names in name lists, requires additional effort. There is a more elegant way to accomplish such tasks. The names bag provides support for working with a specific set of arbitrary names. You can then apply changes from names in the names bag to names in name lists, or update names in the names bag with data from names in name lists. The flexibility of the names bag allows for having more than one names bag file that you can use with the files you wish to obfuscate.

To show the names bag, choose Obfuscate > Names Bag... from the main menu, or click [image] on the toolbar.

Figure 6-1. The names bag.

The names bag list has the following columns:
  • Name contains original name. Check box designates whether to change this name to new name.
  • New Name contains name that will replace original name.
  • Change In Strings designates whether to change all name occurrences in strings. In order to modify this setting, name check box must be checked.

You can sort the names bag list on any column by clicking on the column header. Click once for an ascending sort. Click a second time for a descending sort.

To group names in the names bag list, choose Group By from the names bag list context menu and then choose criteria you wish to use for grouping. Names satisfying choosen criteria appear at the top of the names bag list.

You may add comments that will be useful when obfuscating. To show the Comments edit box, choose Show Comments from the names bag list context menu. To hide the Comments edit box, choose Hide Comments from the names bag list context menu.

Adding Names

To add a name to the names bag, choose Add... from the names bag list context menu.

Figure 6-2. Adding name to the names bag.

Fields on the Add Name dialog box have the same meanings as the names bag list columns. If Use Prefix/Suffix from the names bag list context menu is checked, then prefix and/or suffix are added to the new name. For more information, see General Options.

Editing Names

To edit a name, double-click name in the names bag list, or select name from the names bag list and choose Edit... from the names bag list context menu. If Use Prefix/Suffix from the names bag list context menu is checked, then prefix and/or suffix are added to the new name. For more information, see General Options.

Marking Names with Prefixes and/or Suffixes

To mark/unmark or select only names with specific prefixes and/or suffixes, choose Mark Names With Prefixes... from the names bag list context menu. For complete explanation of the fields on the Mark Names With Prefixes And Suffixes dialog box, see Marking Names for Obfuscation: Marking Names with Prefixes and/or Suffixes.

Copying Names from Name Lists

To copy names from a name list to the names bag list, select names from a name list and choose Copy To Names Bag from the name list context menu.

Removing Names

To remove names from the names bag list, select names from the names bag list you wish to remove, and choose Remove from the names bag list context menu.

Applying Changes to Name Lists

To apply changes from names in the names bag list to names in name lists, select names from the names bag list and choose Apply from the names bag list context menu. If you wish to apply changes from all names in the names bag list, choose Apply All from the names bag list context menu. Change focus from one name list to another with Tab or Shift+Tab to see affected (selected) names in both name lists. First visible selected name in each name list is automatically brought into view.

Updating Names from Name Lists

To update names in the names bag list with data from names in name lists, select names from the names bag list and choose Update From List from the names bag list context menu. Jasob keeps names bag in consistent state, meaning that single name or new name can appear only once. That is why you may receive warning messsages during the update. In order to remove the possibility of name clashes, you can clear new names for names that you wish to update data for prior to issuing the update command.

Navigating from the Names Bag to Name Lists

To navigate from names in the names bag list to names in name lists, select names from the names bag list and choose Go To List from the names bag list context menu. Change focus from one name list to another with Tab or Shift+Tab to see selected names in both name lists. First visible selected name in each name list is automatically brought into view.

Navigating from Name Lists to the Names Bag

To navigate from names in a name list to names in the names bag list, select names from a name list and choose Go To Names Bag from the name list context menu.

Selecting Names that are not in Name Lists

To select names from the names bag list that don't appear in name lists, choose Select Not In Lists from the names bag list context menu.

Clearing the Names Bag

To clear the names bag list and the comments edit box, choose New from the names bag list context menu.

Opening the Names Bag

To open the names bag from a file, choose Open... from the names bag list context menu.

Saving the Names Bag

To save the names bag to a file, choose Save or Save As... from the names bag list context menu. The saved names bag file has the .jsbb extension.


Saving Obfuscated Files

There are various ways how to save obfuscated files. You can save a single obfuscated file, all obfuscated files or an obfuscated Web site.

In this section

  • Saving a Single Obfuscated File
  • Saving All Obfuscated Files
  • Saving an Obfuscated Web Site
  • Closing Files


Saving a Single Obfuscated File

To save the selected obfuscated file, choose File > Save Obfuscated or File > Save Obfuscated As... from the main menu, or click [image] on the toolbar. Alternatively, you can choose Save Obfuscated or Save Obfuscated As... from the project files context menu.

Figure 7-1. Saving the obfuscated file.

The default file name for the obfuscated file is created from the original file name with the added suffix _Obfs. You can type any file name you wish in the Save As dialog box.

NOTE: To save settings for all files that make up the project and to save changes for names in name lists, see The Jasob Project.


Saving All Obfuscated Files

To save all obfuscated files, choose File > Save All Obfuscated from the main menu, or click [image] on the toolbar.

NOTE: To save settings for all files that make up the project and to save changes for names in name lists, see The Jasob Project.


Saving an Obfuscated Web Site

To save an obfuscated Web site, choose File > Save Obfuscated Web Site or File > Save Obfuscated Web Site As... from the main menu, or click [image] on the toolbar.

Figure 7-2. Saving the obfuscated Web site.

Select folder for obfuscated Web site and Jasob will save obfuscated files to the obfuscated Web site folder and copy all other files (unsupported file types) from the original Web site folder to the obfuscated Web site folder. Original Web site folder structure is preserved in the obfuscated Web site folder. In order to run the obfuscated Web site, you have to create virtual directory on the Web server for the obfuscated Web site folder.

If you are using Web technology that doesn't permit simply copying files from one Web site folder to another in order to move the Web site to a different location, you should first make a copy of the original Web site using tools that are provided by the particular Web technology prior to opening and obfuscating that Web site copy with Jasob. For more information, see Opening a Web Site. When you are saving that kind of obfuscated Web site, you have to choose the same folder from where you have opened the Web site. This way original files in the Web site copy will be replaced with obfuscated files.

NOTE: To save settings for all files that make up the Web site and to save changes for names in name lists, see The Web Site Settings.


Closing Files

To close the selected file, choose File > Close from the main menu, or choose Remove from the project files context menu.

To close all files, choose File > Close All Files from the main menu.

To close the project, choose File > Close Project from the main menu.

To close the Web site, choose File > Close Web Site from the main menu.


Options

You can specify settings for various Jasob features. For example, you can set prefix and/or suffix for new names, change fonts and colors, edit system names, specify rules for JavaScript and CSS code blocks in various sources... To customize Jasob features, choose Obfuscate > Options... from the main menu.

In this section

  • General Options
  • Fonts and Colors
  • System Names
  • The HTML
  • The ASP.NET
  • The JSP
  • The XML
  • The CFML


General Options

To specify settings for general options, select the General tab from the Options dialog box.

Figure 8-1. General options.

Fields on the General tab have the following meanings:

The New Name group box:

  • Prefix contains text that is added to the beginning of a new name.
  • Suffix contains text that is added to the end of a new name.
  • Functions designates whether prefix and suffix are added to new names that are in the functions name list.
  • Variables designates whether prefix and suffix are added to new names that are in the variables name list.
  • Generated new name designates whether prefix and suffix are added to generated new names.
  • Manually entered new name designates whether prefix and suffix are added to manually entered new names.

The Copy to Language group box:

  • Prefix contains text that is added to the beginning of a name when variable name is created.
  • Suffix contains text that is added to the end of a name when variable name is created.
  • Convert name to upper case designates whether a name is converted to upper case when variable name is created.
  • Convert name to lower case designates whether a name is converted to lower case when variable name is created.

For more information, see Obfuscating Dynamic Web Pages.

The Save group box:

  • Default encoding designates encoding that is used when saving files.
  • Always use default encoding designates whether default encoding is always used when saving files. If this option is unchecked, then encoding from loaded file is used when the file is saved.

Jasob internally uses Unicode character set. If a file should be saved with ANSI encoding and not all Unicode characters could be translated to ANSI characters, then UTF-8 without signature (BOM) encoding is used.


Fonts and Colors

To specify settings for fonts and colors, select the Fonts and Colors tab from the Options dialog box.

Figure 8-2. Fonts and colors.

Fields on the Fonts and Colors tab have the following meanings:

  • Settings for designates user interface element for which you can change font and colors.
  • Item designates item from a selected user interface element for which you can modify the foreground and background color. You can specify automatic (Windows default) colors from the item context menu for Text, Selected Text, Inactive Selected Text and Names Bag Comments Text items.
  • Color... opens the Color dialog box where you can choose color. Depending on which Color... button have you clicked, you can modify foreground or background color. The Color... button is disabled for automatic colors.
  • Font... opens the Font dialog box where you can choose font for the selected user interface element.
  • Use Defaults sets default font and colors for the selected user interface element.
  • Sample displays a sample of the font and color scheme for the user interface element and item selected.


System Names

System names are reserved JavaScript and CSS names that can't be changed. For more information, see Analyzing Files. To specify settings for system names, select the System Names tab from the Options dialog box.

Figure 8-3. System names.

The system names list has the following columns:

  • Group contains group to which a system name belongs. You can enter arbitrary groups. Groups are used to classify system names.
  • Name contains a system name.
  • Case Sensitive designates whether comparison of a system name is case sensitive.
  • Object designates whether system name is treated as an object name only. This setting is available only if comparison of a system name is case sensitive. If a system name is an object name, then all its properties and methods (names that follow after a dot (.) character) are treated as system names. For example, if oMyObject appears in system names list and has its Object column checked, then its property sMessageText in the following JavaScript code: var sText = oMyObject.sMessageText; would be automatically treated as a system name.

    IMPORTANT: You may use this option only if you are not using JavaScript with statement anywhere in your source code together with the system name in question, otherwise obfuscated JavaScript code may not work properly.
  • Property/Method designates whether system name is treated as a property or method of an object only. This setting is available only if comparison of a system name is case sensitive. If a system name is a property or method of an object, then it is treated as a system name only when it starts with a dot (.) character (it is used as a property or method of an object). For example, if nColorValue appears in system names list and has its Property/Method column checked, then it will be treated as a system name in the following JavaScript code: var nColor = oSomeObject.nColorValue; On the other hand, nColorValue will not be treated as a system name in the following JavaScript code: nColorValue = nSomeColor;

    IMPORTANT: You may use this option only if you are not using JavaScript with statement anywhere in your source code together with the system name in question, otherwise obfuscated JavaScript code may not work properly.

NOTE: If both Object and Property/Method columns are not checked, then it doesn't matter in which JavaScript context a system name in question is found, it is always treated as a system name, and it also doesn't matter whether you use JavaScript with statement together with the system name in question or not.

You can sort the system names list on any column by clicking on the column header. Click once for an ascending sort. Click a second time for a descending sort.

Adding System Names

To add a system name to the system names list, choose Add... from the system names list context menu.

Figure 8-4. Adding a system name.

Fields on the Add System Name dialog box have the same meanings as the system names list columns. You can enter an arbitrary system name group, or choose one from the existing groups.

Editing System Names

To edit a system name, double-click name in the system names list, or select name from the system names list and choose Edit... from the system names list context menu.

Removing System Names

To remove system names from the system names list, select names from the system names list you wish to remove, and choose Remove from the system names list context menu.

Opening System Names

To open system names from a file, choose Open... from the system names list context menu. You can add system names from the opened file to the existing system names by checking the Add to existing system names option on the Open dialog box.

Saving System Names

To save system names to a file, choose Save As... from the system names list context menu. The saved system names file has the .jsbn extension.

NOTE: When you click the OK button on the Options dialog box, system names are automatically saved to the file from which they were opened.


The HTML

HTML elements and attributes can contain JavaScript and CSS code. To specify rules for HTML elements and attributes that contain JavaScript and CSS code, select the HTML tab from the Options dialog box.

Figure 8-5. HTML elements and attributes that contain JavaScript and CSS code.

The HTML elements list has the following columns:

  • Elements contains space delimited elements that contain JavaScript or CSS code. When (~) character (without parenthesis) is found at the end of the element name, it designates that CSS content is found in that element value. When (*) character (without parenthesis) is found at the end of the element name, it designates that JavaScript names found in that element value are case insensitive. For more information, see Adding HTML Elements.
  • Attributes contains space delimited attribues that contain JavaScript or CSS code. If attributes are assigned values, then those attribute = value pairs represent rules for specified elements or attributes to contain JavaScript or CSS code. When (~) character (without parenthesis) is found at the end of the attribute name, it designates that CSS content is found in that attribute value. When (*) character (without parenthesis) is found at the end of the attribute name, it designates that JavaScript names found in that attribute value are case insensitive. For more information, see Adding HTML Elements.
  • JavaScript Prefix designates whether JavaScript prefix is mandatory for attributes to contain JavaScript code.

You can sort the HTML elements list on any column by clicking on the column header. Click once for an ascending sort. Click a second time for a descending sort.

The JavaScript prefix edit box contains space delimited JavaScript prefixes. If JavaScript prefix is enclosed in square brackets, comparison of such prefix is case insensitive.

NOTE: First entry in HTML elements list (Elements: script, Attributes: $clientSide="true") designates that Jasob will treat every client side <script> element, regardless of the specified attribute values, as if they contain JavaScript code. This is because Web browers treat client side <script> elements without language or type attributes specified as if they contain JavaScript code. If you have client side <script> elements in your code that don't contain JavaScript code (for example, they might contain VBScript code) then you should remove this first entry in HTML elements list (Elements: script, Attributes: $clientSide="true") and Jasob will then treat only those client side <script> elements as if they contain JavaScript code that have valid language or type attribute values specified for a JavaScript code.

Adding HTML Elements

To add HTML elements and attributes to the HTML elements list, choose Add... from the HTML elements list context menu.

Figure 8-6. Adding HTML elements and attributes.

Fields on the Add HTML Elements and Attributes dialog box have the following meanings:

Elements Attributes Meaning
Space delimited elements.
(Example: elem1 elem2 elem3) 		Space delimited attributes.
(Example: attr1 attr2 attr3) 		Every specified attribute, on every specified element, is considered to contain JavaScript or CSS code. Put (~) character (without parenthesis) at the end of the attribute name to designate that the attribute value contains CSS code. Put (*) character (without parenthesis) at the end of the attribute name to designate that JavaScript names found in that attribute value are case insensitive.
Space delimited elements.
(Example: elem1 elem2 elem3) 		Space delimited attributes with values.
(Example: attr1=value1 attr2="value2") 		Every specified element which has specified attributes with values that match specified attribute values, is considered to contain JavaScript or CSS code. Put (~) character (without parenthesis) at the end of the element name to designate that the element value contains CSS code. Put (*) character (without parenthesis) at the end of the element name to designate that JavaScript names found in that element value are case insensitive.

You can use special attribute $parentContent and set its value to JavaScript (like $parentContent="JavaScript") to designate that specified elements contain JavaScript/CSS code when they are placed inside JavaScript code, ie, when their parent element contains JavaScript code. You can also use special attribute $parentContent and set its value to CSS (like $parentContent="CSS") to designate that specified elements contain JavaScript/CSS code when they are placed inside CSS code, ie, when their parent element contains CSS code.

You can use special attribute $clientSide and set its value to true (like $clientSide="true") to designate that specified elements contain JavaScript/CSS code when they are client side elements. Also, you can use special attribute $serverSide and set its value to true (like $serverSide="true") to designate that specified elements contain JavaScript/CSS code when they are server side elements. If none of the $clientSide and $serverSide special attributes are specified, then specified elements are considered to contain JavaScript/CSS code regardless of whether they are client side or server side elements. For more information on how to specify rules for server side elements (all other elements are client side), see File Types: The Server Side Code and The File Settings.
Space delimited elements.
(Example: elem1 elem2 elem3) 		Space delimited attributes and space delimited attributes with values.
(Example: attr1 attr2 attr3="value3") 		Every specified attribute with no specified value, is considered to contain JavaScript or CSS code on every specified element where there are specified attributes with values that match specified attribute values. Put (~) character (without parenthesis) at the end of the attribute name with no specified value to designate that the attribute value contains CSS code. Put (*) character (without parenthesis) at the end of the attribute name with no specified value to designate that JavaScript names found in that attribute value are case insensitive.

You can use special attribute $parentContent and set its value to JavaScript (like $parentContent="JavaScript") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are placed inside JavaScript code, ie, when their parent element contains JavaScript code. You can also use special attribute $parentContent and set its value to CSS (like $parentContent="CSS") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are placed inside CSS code, ie, when their parent element contains CSS code.

You can use special attribute $clientSide and set its value to true (like $clientSide="true") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are client side elements. Also, you can use special attribute $serverSide and set its value to true (like $serverSide="true") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are server side elements. If none of the $clientSide and $serverSide special attributes are specified, then every specified attribute with no specified value on specified elements is considered to contain JavaScript/CSS code regardless of whether those specified elements are client side or server side elements. For more information on how to specify rules for server side elements (all other elements are client side), see File Types: The Server Side Code and The File Settings.

JavaScript prefix is mandatory designates whether JavaScript prefix is mandatory to appear at the beginning of the specified attribute values in order for those attributes to contain JavaScript code.

Comparison of specified HTML elements and attributes is case insensitive. If specified attribute value is enclosed in square brackets, the comparison of that value is case insensitive too. If attribute value is inside quotes and you want to use square brackets, put them inside quotes.

Editing HTML Elements

To edit HTML elements and attributes, double-click entry in the HTML elements list, or select entry from the HTML elements list and choose Edit... from the HTML elements list context menu.

Removing HTML Elements

To remove HTML elements and attributes from the HTML elements list, select entries from the HTML elements list you wish to remove, and choose Remove from the HTML elements list context menu.

Opening HTML Elements

To open HTML elements and attributes from a file, choose Open... from the HTML elements list context menu. You can add HTML elements and attributes from the opened file to the existing HTML elements and attributes by checking the Add to existing elements option on the Open dialog box.

Saving HTML Elements

To save HTML elements and attributes to a file, choose Save As... from the HTML elements list context menu. The saved HTML elements and attributes file has the .jsbh extension.

NOTE: When you click the OK button on the Options dialog box, HTML elements and attributes are automatically saved to the file from which they were opened.


The ASP.NET

Active Server Pages .NET (ASP.NET) elements and attributes can contain JavaScript and CSS code. To specify rules for ASP.NET elements and attributes that contain JavaScript and CSS code, select the ASP.NET tab from the Options dialog box.

Figure 8-7. ASP.NET elements and attributes that contain JavaScript and CSS code.

The ASP.NET elements list has the following columns:

  • Elements contains space delimited elements that contain JavaScript or CSS code. When (~) character (without parenthesis) is found at the end of the element name, it designates that CSS content is found in that element value. When (*) character (without parenthesis) is found at the end of the element name, it designates that JavaScript names found in that element value are case insensitive. For more information, see Adding ASP.NET Elements.
  • Attributes contains space delimited attribues that contain JavaScript or CSS code. If attributes are assigned values, then those attribute = value pairs represent rules for specified elements or attributes to contain JavaScript or CSS code. When (~) character (without parenthesis) is found at the end of the attribute name, it designates that CSS content is found in that attribute value. When (*) character (without parenthesis) is found at the end of the attribute name, it designates that JavaScript names found in that attribute value are case insensitive. For more information, see Adding ASP.NET Elements.
  • JavaScript Prefix designates whether JavaScript prefix is mandatory for attributes to contain JavaScript code.

You can sort the ASP.NET elements list on any column by clicking on the column header. Click once for an ascending sort. Click a second time for a descending sort.

Adding ASP.NET Elements

To add ASP.NET elements and attributes to the ASP.NET elements list, choose Add... from the ASP.NET elements list context menu.

Figure 8-8. Adding ASP.NET elements and attributes.

Fields on the Add ASP.NET Elements and Attributes dialog box have the following meanings:

Elements Attributes Meaning
Space delimited elements.
(Example: elem1 elem2 elem3) 		Space delimited attributes.
(Example: attr1 attr2 attr3) 		Every specified attribute, on every specified element, is considered to contain JavaScript or CSS code. Put (~) character (without parenthesis) at the end of the attribute name to designate that the attribute value contains CSS code. Put (*) character (without parenthesis) at the end of the attribute name to designate that JavaScript names found in that attribute value are case insensitive.
Space delimited elements.
(Example: elem1 elem2 elem3) 		Space delimited attributes with values.
(Example: attr1=value1 attr2="value2") 		Every specified element which has specified attributes with values that match specified attribute values, is considered to contain JavaScript or CSS code. Put (~) character (without parenthesis) at the end of the element name to designate that the element value contains CSS code. Put (*) character (without parenthesis) at the end of the element name to designate that JavaScript names found in that element value are case insensitive.

You can use special attribute $parentContent and set its value to JavaScript (like $parentContent="JavaScript") to designate that specified elements contain JavaScript/CSS code when they are placed inside JavaScript code, ie, when their parent element contains JavaScript code. You can also use special attribute $parentContent and set its value to CSS (like $parentContent="CSS") to designate that specified elements contain JavaScript/CSS code when they are placed inside CSS code, ie, when their parent element contains CSS code.

You can use special attribute $clientSide and set its value to true (like $clientSide="true") to designate that specified elements contain JavaScript/CSS code when they are client side elements. Also, you can use special attribute $serverSide and set its value to true (like $serverSide="true") to designate that specified elements contain JavaScript/CSS code when they are server side elements. If none of the $clientSide and $serverSide special attributes are specified, then specified elements are considered to contain JavaScript/CSS code regardless of whether they are client side or server side elements. For more information on how to specify rules for server side elements (all other elements are client side), see File Types: The Server Side Code and The File Settings.
Space delimited elements.
(Example: elem1 elem2 elem3) 		Space delimited attributes and space delimited attributes with values.
(Example: attr1 attr2 attr3="value3") 		Every specified attribute with no specified value, is considered to contain JavaScript or CSS code on every specified element where there are specified attributes with values that match specified attribute values. Put (~) character (without parenthesis) at the end of the attribute name with no specified value to designate that the attribute value contains CSS code. Put (*) character (without parenthesis) at the end of the attribute name with no specified value to designate that JavaScript names found in that attribute value are case insensitive.

You can use special attribute $parentContent and set its value to JavaScript (like $parentContent="JavaScript") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are placed inside JavaScript code, ie, when their parent element contains JavaScript code. You can also use special attribute $parentContent and set its value to CSS (like $parentContent="CSS") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are placed inside CSS code, ie, when their parent element contains CSS code.

You can use special attribute $clientSide and set its value to true (like $clientSide="true") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are client side elements. Also, you can use special attribute $serverSide and set its value to true (like $serverSide="true") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are server side elements. If none of the $clientSide and $serverSide special attributes are specified, then every specified attribute with no specified value on specified elements is considered to contain JavaScript/CSS code regardless of whether those specified elements are client side or server side elements. For more information on how to specify rules for server side elements (all other elements are client side), see File Types: The Server Side Code and The File Settings.

ASP.NET elements and attributes can have namespace prefixes in their names. When you are specifying ASP.NET elements and attributes you can use namespace prefixes according to the following table:

Elements | Meaning
: | All elements with whatever prefix are considered.
prefix: | All elements with the specified prefix are considered.
:element | Specified element with whatever prefix is considered.
prefix:element | Specified element with its prefix is considered.
element | Specified element with no prefix is considered.
Attributes | Meaning
: | All attributes with whatever prefix are considered.
prefix: | All attributes with the specified prefix are considered.
:attribute | Specified attribute with whatever prefix is considered.
prefix:attribute | Specified attribute with its prefix is considered.
attribute | Specified attribute with no prefix is considered.

JavaScript prefix is mandatory designates whether JavaScript prefix is mandatory to appear at the beginning of the specified attribute values in order for those attributes to contain JavaScript code.

Comparison of specified ASP.NET elements and attributes is case insensitive. If specified attribute value is enclosed in square brackets, the comparison of that value is case insensitive too. If attribute value is inside quotes and you want to use square brackets, put them inside quotes.

Editing ASP.NET Elements

To edit ASP.NET elements and attributes, double-click entry in the ASP.NET elements list, or select entry from the ASP.NET elements list and choose Edit... from the ASP.NET elements list context menu.

Removing ASP.NET Elements

To remove ASP.NET elements and attributes from the ASP.NET elements list, select entries from the ASP.NET elements list you wish to remove, and choose Remove from the ASP.NET elements list context menu.

Opening ASP.NET Elements

To open ASP.NET elements and attributes from a file, choose Open... from the ASP.NET elements list context menu. You can add ASP.NET elements and attributes from the opened file to the existing ASP.NET elements and attributes by checking the Add to existing elements option on the Open dialog box.

Saving ASP.NET Elements

To save ASP.NET elements and attributes to a file, choose Save As... from the ASP.NET elements list context menu. The saved ASP.NET elements and attributes file has the .jsbe extension.

NOTE: When you click the OK button on the Options dialog box, ASP.NET elements and attributes are automatically saved to the file from which they were opened.


The JSP

Java Server Pages (JSP) elements and attributes can contain JavaScript and CSS code. To specify rules for JSP elements and attributes that contain JavaScript and CSS code, select the JSP tab from the Options dialog box.

Figure 8-9. JSP elements and attributes that contain JavaScript and CSS code.

The JSP elements list has the following columns:

  • Elements contains space delimited elements that contain JavaScript or CSS code. When (~) character (without parenthesis) is found at the end of the element name, it designates that CSS content is found in that element value. When (*) character (without parenthesis) is found at the end of the element name, it designates that JavaScript names found in that element value are case insensitive. For more information, see Adding JSP Elements.
  • Attributes contains space delimited attribues that contain JavaScript or CSS code. If attributes are assigned values, then those attribute = value pairs represent rules for specified elements or attributes to contain JavaScript or CSS code. When (~) character (without parenthesis) is found at the end of the attribute name, it designates that CSS content is found in that attribute value. When (*) character (without parenthesis) is found at the end of the attribute name, it designates that JavaScript names found in that attribute value are case insensitive. For more information, see Adding JSP Elements.
  • JavaScript Prefix designates whether JavaScript prefix is mandatory for attributes to contain JavaScript code.

You can sort the JSP elements list on any column by clicking on the column header. Click once for an ascending sort. Click a second time for a descending sort.

Adding JSP Elements

To add JSP elements and attributes to the JSP elements list, choose Add... from the JSP elements list context menu.

Figure 8-10. Adding JSP elements and attributes.

Fields on the Add JSP Elements and Attributes dialog box have the following meanings:

Elements Attributes Meaning
Space delimited elements.
(Example: elem1 elem2 elem3) 		Space delimited attributes.
(Example: attr1 attr2 attr3) 		Every specified attribute, on every specified element, is considered to contain JavaScript or CSS code. Put (~) character (without parenthesis) at the end of the attribute name to designate that the attribute value contains CSS code. Put (*) character (without parenthesis) at the end of the attribute name to designate that JavaScript names found in that attribute value are case insensitive.
Space delimited elements.
(Example: elem1 elem2 elem3) 		Space delimited attributes with values.
(Example: attr1=value1 attr2="value2") 		Every specified element which has specified attributes with values that match specified attribute values, is considered to contain JavaScript or CSS code. Put (~) character (without parenthesis) at the end of the element name to designate that the element value contains CSS code. Put (*) character (without parenthesis) at the end of the element name to designate that JavaScript names found in that element value are case insensitive.

You can use special attribute $parentContent and set its value to JavaScript (like $parentContent="JavaScript") to designate that specified elements contain JavaScript/CSS code when they are placed inside JavaScript code, ie, when their parent element contains JavaScript code. You can also use special attribute $parentContent and set its value to CSS (like $parentContent="CSS") to designate that specified elements contain JavaScript/CSS code when they are placed inside CSS code, ie, when their parent element contains CSS code.

You can use special attribute $clientSide and set its value to true (like $clientSide="true") to designate that specified elements contain JavaScript/CSS code when they are client side elements. Also, you can use special attribute $serverSide and set its value to true (like $serverSide="true") to designate that specified elements contain JavaScript/CSS code when they are server side elements. If none of the $clientSide and $serverSide special attributes are specified, then specified elements are considered to contain JavaScript/CSS code regardless of whether they are client side or server side elements. For more information on how to specify rules for server side elements (all other elements are client side), see File Types: The Server Side Code and The File Settings.
Space delimited elements.
(Example: elem1 elem2 elem3) 		Space delimited attributes and space delimited attributes with values.
(Example: attr1 attr2 attr3="value3") 		Every specified attribute with no specified value, is considered to contain JavaScript or CSS code on every specified element where there are specified attributes with values that match specified attribute values. Put (~) character (without parenthesis) at the end of the attribute name with no specified value to designate that the attribute value contains CSS code. Put (*) character (without parenthesis) at the end of the attribute name with no specified value to designate that JavaScript names found in that attribute value are case insensitive.

You can use special attribute $parentContent and set its value to JavaScript (like $parentContent="JavaScript") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are placed inside JavaScript code, ie, when their parent element contains JavaScript code. You can also use special attribute $parentContent and set its value to CSS (like $parentContent="CSS") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are placed inside CSS code, ie, when their parent element contains CSS code.

You can use special attribute $clientSide and set its value to true (like $clientSide="true") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are client side elements. Also, you can use special attribute $serverSide and set its value to true (like $serverSide="true") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are server side elements. If none of the $clientSide and $serverSide special attributes are specified, then every specified attribute with no specified value on specified elements is considered to contain JavaScript/CSS code regardless of whether those specified elements are client side or server side elements. For more information on how to specify rules for server side elements (all other elements are client side), see File Types: The Server Side Code and The File Settings.

JSP elements and attributes can have namespace prefixes in their names. When you are specifying JSP elements and attributes you can use namespace prefixes according to the following table:

Elements | Meaning
: | All elements with whatever prefix are considered.
prefix: | All elements with the specified prefix are considered.
:element | Specified element with whatever prefix is considered.
prefix:element | Specified element with its prefix is considered.
element | Specified element with no prefix is considered.
Attributes | Meaning
: | All attributes with whatever prefix are considered.
prefix: | All attributes with the specified prefix are considered.
:attribute | Specified attribute with whatever prefix is considered.
prefix:attribute | Specified attribute with its prefix is considered.
attribute | Specified attribute with no prefix is considered.

JavaScript prefix is mandatory designates whether JavaScript prefix is mandatory to appear at the beginning of the specified attribute values in order for those attributes to contain JavaScript code.

Comparison of specified JSP elements and attributes is case sensitive. If specified attribute value is enclosed in square brackets, the comparison of that value is case insensitive. If attribute value is inside quotes and you want to use square brackets, put them inside quotes.

Editing JSP Elements

To edit JSP elements and attributes, double-click entry in the JSP elements list, or select entry from the JSP elements list and choose Edit... from the JSP elements list context menu.

Removing JSP Elements

To remove JSP elements and attributes from the JSP elements list, select entries from the JSP elements list you wish to remove, and choose Remove from the JSP elements list context menu.

Opening JSP Elements

To open JSP elements and attributes from a file, choose Open... from the JSP elements list context menu. You can add JSP elements and attributes from the opened file to the existing JSP elements and attributes by checking the Add to existing elements option on the Open dialog box.

Saving JSP Elements

To save JSP elements and attributes to a file, choose Save As... from the JSP elements list context menu. The saved JSP elements and attributes file has the .jsbe extension.

NOTE: When you click the OK button on the Options dialog box, JSP elements and attributes are automatically saved to the file from which they were opened.


The XML

Extensible Markup Language (XML) elements and attributes can contain JavaScript and CSS code. To specify rules for XML elements and attributes that contain JavaScript and CSS code, select the XML tab from the Options dialog box.

Figure 8-11. XML elements and attributes that contain JavaScript and CSS code.

The XML elements list has the following columns:

  • Elements contains space delimited elements that contain JavaScript or CSS code. When (~) character (without parenthesis) is found at the end of the element name, it designates that CSS content is found in that element value. When (*) character (without parenthesis) is found at the end of the element name, it designates that JavaScript names found in that element value are case insensitive. For more information, see Adding XML Elements.
  • Attributes contains space delimited attribues that contain JavaScript or CSS code. If attributes are assigned values, then those attribute = value pairs represent rules for specified elements or attributes to contain JavaScript or CSS code. When (~) character (without parenthesis) is found at the end of the attribute name, it designates that CSS content is found in that attribute value. When (*) character (without parenthesis) is found at the end of the attribute name, it designates that JavaScript names found in that attribute value are case insensitive. For more information, see Adding XML Elements.
  • JavaScript Prefix designates whether JavaScript prefix is mandatory for attributes to contain JavaScript code.

You can sort the XML elements list on any column by clicking on the column header. Click once for an ascending sort. Click a second time for a descending sort.

Adding XML Elements

To add XML elements and attributes to the XML elements list, choose Add... from the XML elements list context menu.

Figure 8-12. Adding XML elements and attributes.

Fields on the Add XML Elements and Attributes dialog box have the following meanings:

Elements Attributes Meaning
Space delimited elements.
(Example: elem1 elem2 elem3) 		Space delimited attributes.
(Example: attr1 attr2 attr3) 		Every specified attribute, on every specified element, is considered to contain JavaScript or CSS code. Put (~) character (without parenthesis) at the end of the attribute name to designate that the attribute value contains CSS code. Put (*) character (without parenthesis) at the end of the attribute name to designate that JavaScript names found in that attribute value are case insensitive.
Space delimited elements.
(Example: elem1 elem2 elem3) 		Space delimited attributes with values.
(Example: attr1=value1 attr2="value2") 		Every specified element which has specified attributes with values that match specified attribute values, is considered to contain JavaScript or CSS code. Put (~) character (without parenthesis) at the end of the element name to designate that the element value contains CSS code. Put (*) character (without parenthesis) at the end of the element name to designate that JavaScript names found in that element value are case insensitive.

You can use special attribute $parentContent and set its value to JavaScript (like $parentContent="JavaScript") to designate that specified elements contain JavaScript/CSS code when they are placed inside JavaScript code, ie, when their parent element contains JavaScript code. You can also use special attribute $parentContent and set its value to CSS (like $parentContent="CSS") to designate that specified elements contain JavaScript/CSS code when they are placed inside CSS code, ie, when their parent element contains CSS code.

You can use special attribute $clientSide and set its value to true (like $clientSide="true") to designate that specified elements contain JavaScript/CSS code when they are client side elements. Also, you can use special attribute $serverSide and set its value to true (like $serverSide="true") to designate that specified elements contain JavaScript/CSS code when they are server side elements. If none of the $clientSide and $serverSide special attributes are specified, then specified elements are considered to contain JavaScript/CSS code regardless of whether they are client side or server side elements. For more information on how to specify rules for server side elements (all other elements are client side), see File Types: The Server Side Code and The File Settings.
Space delimited elements.
(Example: elem1 elem2 elem3) 		Space delimited attributes and space delimited attributes with values.
(Example: attr1 attr2 attr3="value3") 		Every specified attribute with no specified value, is considered to contain JavaScript or CSS code on every specified element where there are specified attributes with values that match specified attribute values. Put (~) character (without parenthesis) at the end of the attribute name with no specified value to designate that the attribute value contains CSS code. Put (*) character (without parenthesis) at the end of the attribute name with no specified value to designate that JavaScript names found in that attribute value are case insensitive.

You can use special attribute $parentContent and set its value to JavaScript (like $parentContent="JavaScript") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are placed inside JavaScript code, ie, when their parent element contains JavaScript code. You can also use special attribute $parentContent and set its value to CSS (like $parentContent="CSS") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are placed inside CSS code, ie, when their parent element contains CSS code.

You can use special attribute $clientSide and set its value to true (like $clientSide="true") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are client side elements. Also, you can use special attribute $serverSide and set its value to true (like $serverSide="true") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are server side elements. If none of the $clientSide and $serverSide special attributes are specified, then every specified attribute with no specified value on specified elements is considered to contain JavaScript/CSS code regardless of whether those specified elements are client side or server side elements. For more information on how to specify rules for server side elements (all other elements are client side), see File Types: The Server Side Code and The File Settings.

XML elements and attributes can have namespace prefixes in their names. When you are specifying XML elements and attributes you can use namespace prefixes according to the following table:

Elements | Meaning
: | All elements with whatever prefix are considered.
prefix: | All elements with the specified prefix are considered.
:element | Specified element with whatever prefix is considered.
prefix:element | Specified element with its prefix is considered.
element | Specified element with no prefix is considered.
Attributes | Meaning
: | All attributes with whatever prefix are considered.
prefix: | All attributes with the specified prefix are considered.
:attribute | Specified attribute with whatever prefix is considered.
prefix:attribute | Specified attribute with its prefix is considered.
attribute | Specified attribute with no prefix is considered.

JavaScript prefix is mandatory designates whether JavaScript prefix is mandatory to appear at the beginning of the specified attribute values in order for those attributes to contain JavaScript code.

Comparison of specified XML elements and attributes is case sensitive. If specified attribute value is enclosed in square brackets, the comparison of that value is case insensitive. If attribute value is inside quotes and you want to use square brackets, put them inside quotes.

Editing XML Elements

To edit XML elements and attributes, double-click entry in the XML elements list, or select entry from the XML elements list and choose Edit... from the XML elements list context menu.

Removing XML Elements

To remove XML elements and attributes from the XML elements list, select entries from the XML elements list you wish to remove, and choose Remove from the XML elements list context menu.

Opening XML Elements

To open XML elements and attributes from a file, choose Open... from the XML elements list context menu. You can add XML elements and attributes from the opened file to the existing XML elements and attributes by checking the Add to existing elements option on the Open dialog box.

Saving XML Elements

To save XML elements and attributes to a file, choose Save As... from the XML elements list context menu. The saved XML elements and attributes file has the .jsbe extension.

NOTE: When you click the OK button on the Options dialog box, XML elements and attributes are automatically saved to the file from which they were opened.


The CFML

ColdFusion Markup Language (CFML) elements and attributes can contain JavaScript and CSS code. Beside rules for CFML elements and attributes that contain JavaScript and CSS code, each CFML element that requires closing tag or contains expression must also be specified. To specify CFML elements, select the CFML tab from the Options dialog box.

Figure 8-13. CFML elements and attributes.

The CFML elements list has the following columns:

  • Elements contains space delimited elements. If elements contain JavaScript or CSS code, then when (~) character (without parenthesis) is found at the end of the element name, it designates that CSS content is found in that element value and when (*) character (without parenthesis) is found at the end of the element name, it designates that JavaScript names found in that element value are case insensitive. For more information, see Adding CFML Elements.
  • End Tag designates whether specified elements require an end tag.
  • Expression designates whether specified elements contain expression in the start tag.
  • JS/CSS designates whether specified elements contain JavaScript or CSS code in element content or in specified attributes.
  • Attributes contains space delimited attribues that contain JavaScript or CSS code. If attributes are assigned values, then those attribute = value pairs represent rules for specified elements or attributes to contain JavaScript or CSS code. When (~) character (without parenthesis) is found at the end of the attribute name, it designates that CSS content is found in that attribute value. When (*) character (without parenthesis) is found at the end of the attribute name, it designates that JavaScript names found in that attribute value are case insensitive. For more information, see Adding CFML Elements.
  • JavaScript Prefix designates whether JavaScript prefix is mandatory for attributes to contain JavaScript code.

You can sort the CFML elements list on any column by clicking on the column header. Click once for an ascending sort. Click a second time for a descending sort.

Adding CFML Elements

To add CFML elements and attributes to the CFML elements list, choose Add... from the CFML elements list context menu.

Figure 8-14. Adding CFML elements and attributes.

Fields on the Add CFML Elements and Attributes dialog box have the following meanings:

Elements Attributes Meaning
Space delimited elements.
(Example: elem1 elem2 elem3) 		Space delimited attributes.
(Example: attr1 attr2 attr3) 		Every specified attribute, on every specified element, is considered to contain JavaScript or CSS code. Put (~) character (without parenthesis) at the end of the attribute name to designate that the attribute value contains CSS code. Put (*) character (without parenthesis) at the end of the attribute name to designate that JavaScript names found in that attribute value are case insensitive.
Space delimited elements.
(Example: elem1 elem2 elem3) 		Space delimited attributes with values.
(Example: attr1=value1 attr2="value2") 		Every specified element which has specified attributes with values that match specified attribute values, is considered to contain JavaScript or CSS code. Put (~) character (without parenthesis) at the end of the element name to designate that the element value contains CSS code. Put (*) character (without parenthesis) at the end of the element name to designate that JavaScript names found in that element value are case insensitive.

You can use special attribute $parentContent and set its value to JavaScript (like $parentContent="JavaScript") to designate that specified elements contain JavaScript/CSS code when they are placed inside JavaScript code, ie, when their parent element contains JavaScript code. You can also use special attribute $parentContent and set its value to CSS (like $parentContent="CSS") to designate that specified elements contain JavaScript/CSS code when they are placed inside CSS code, ie, when their parent element contains CSS code.

You can use special attribute $clientSide and set its value to true (like $clientSide="true") to designate that specified elements contain JavaScript/CSS code when they are client side elements. Also, you can use special attribute $serverSide and set its value to true (like $serverSide="true") to designate that specified elements contain JavaScript/CSS code when they are server side elements. If none of the $clientSide and $serverSide special attributes are specified, then specified elements are considered to contain JavaScript/CSS code regardless of whether they are client side or server side elements. For more information on how to specify rules for server side elements (all other elements are client side), see File Types: The Server Side Code and The File Settings.
Space delimited elements.
(Example: elem1 elem2 elem3) 		Space delimited attributes and space delimited attributes with values.
(Example: attr1 attr2 attr3="value3") 		Every specified attribute with no specified value, is considered to contain JavaScript or CSS code on every specified element where there are specified attributes with values that match specified attribute values. Put (~) character (without parenthesis) at the end of the attribute name with no specified value to designate that the attribute value contains CSS code. Put (*) character (without parenthesis) at the end of the attribute name with no specified value to designate that JavaScript names found in that attribute value are case insensitive.

You can use special attribute $parentContent and set its value to JavaScript (like $parentContent="JavaScript") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are placed inside JavaScript code, ie, when their parent element contains JavaScript code. You can also use special attribute $parentContent and set its value to CSS (like $parentContent="CSS") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are placed inside CSS code, ie, when their parent element contains CSS code.

You can use special attribute $clientSide and set its value to true (like $clientSide="true") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are client side elements. Also, you can use special attribute $serverSide and set its value to true (like $serverSide="true") to designate that every specified attribute with no specified value on specified elements contains JavaScript/CSS code when those specified elements are server side elements. If none of the $clientSide and $serverSide special attributes are specified, then every specified attribute with no specified value on specified elements is considered to contain JavaScript/CSS code regardless of whether those specified elements are client side or server side elements. For more information on how to specify rules for server side elements (all other elements are client side), see File Types: The Server Side Code and The File Settings.

End tag is required designates whether end tag is required for specified elements.

Expression in start tag designates whether start tag of specified elements contains ColdFusion expression.

Contains JavaScript/CSS designates whether specified elements contain JavaScript or CSS code. Where that JavaScript/CSS code is found (element content or attributes) is determined by the content of the Attributes edit box.

JavaScript prefix is mandatory designates whether JavaScript prefix is mandatory to appear at the beginning of the specified attribute values in order for those attributes to contain JavaScript code.

Comparison of specified CFML elements and attributes is case insensitive. If specified attribute value is enclosed in square brackets, the comparison of that value is case insensitive too. If attribute value is inside quotes and you want to use square brackets, put them inside quotes.

Editing CFML Elements

To edit CFML elements and attributes, double-click entry in the CFML elements list, or select entry from the CFML elements list and choose Edit... from the CFML elements list context menu.

Removing CFML Elements

To remove CFML elements and attributes from the CFML elements list, select entries from the CFML elements list you wish to remove, and choose Remove from the CFML elements list context menu.

Opening CFML Elements

To open CFML elements and attributes from a file, choose Open... from the CFML elements list context menu. You can add CFML elements and attributes from the opened file to the existing CFML elements and attributes by checking the Add to existing elements option on the Open dialog box.

Saving CFML Elements

To save CFML elements and attributes to a file, choose Save As... from the CFML elements list context menu. The saved CFML elements and attributes file has the .jsbc extension.

NOTE: When you click the OK button on the Options dialog box, CFML elements and attributes are automatically saved to the file from which they were opened.


File Types

There are many file types that can contain JavaScript and CSS code. To specify settings on how Jasob handles certain file types, choose Obfuscate > File Types... from the main menu.

NOTE: Settings defined with File Types dialog (.jsbf files) are initial settings that are used when a file is first opened. To change settings for a file after it has been opened or saved with the Jasob project or Web site settings, right-click the file in the project files list and choose Settings... from the project files context menu. For more information, see The File Settings. After you have made the changes, save your project or Web site settings.

Figure 9-1. File types settings.

File types are grouped into file filters. Each file filter can contain arbitrary number of file extensions that are relevant to that file filter. Once file extension is defined for one file filter, the same file extension can't be used with any other file filter.

Filter description field contains filter description (without associated file extensions).

File extensions field contains semicolon (;) delimited file extensions that are associated with the file filter. File extensions can be specified with or without (*.) prefix.

The Server Side Code

Server side Web technologies (like ASP.NET or Java Server Pages) combine server side code with HTML and JavaScript code. Different technologies use different means to designate server side code on the Web page. Server side code is executed on the Web server each time a Web page is requested. When obfuscating files, Jasob ignores server side code unless it is specified that some server side elements and/or attributes contain JavaScript code. For more information on how to specify rules for elements and/or attributes that contain JavaScript code, see Options section and then choose desired Web technology. For complete discussion on how to obfuscate Web pages that contain server side code, see Obfuscating Dynamic Web Pages.

To specify settings for server side code, select the Server Side Code tab from the File Types dialog box. Fields on the Server Side Code tab have the following meanings:

  • Inside <% ... %> designates whether server side code is placed inside <% and %> markers.
  • Inside <!--# ... --> designates whether server side code is placed inside <!--# and --> markers.
  • Inside {$ ... } designates whether server side code is placed inside {$ and } markers.
  • Inside {{ ... }} designates whether server side code is placed inside {{ and }} markers.
  • Inside <? ... ?> designates whether server side code is placed inside <? and ?> markers.
  • Inside <? ... !> designates whether server side code is placed inside <? and !> markers.
  • Inside <: ... :> designates whether server side code is placed inside <: and :> markers.
  • Inside <... ...="%= ... %"> designates whether server side code is placed inside %= and % markers that are placed inside element's attribute value.
  • Use CFML elements designates whether to use CFML elements as server side elements. For more information on how to specify CFML elements, see The CFML.
  • Inside # ... # designates whether server side code is placed inside # and # markers when those markers are found inside CFML elements content.
  • Inside <script runat="server" ... > elements designates whether server side code is placed inside <script> elements that have their runat attribute set to server. The comparison is not case sensitive. Possible <!-- marker found in the content of those elements is not treated as the beginning of a comment.
  • Inside <script language=" ... " | type="text/ ... " ... > elements designates whether server side code is placed inside <script> elements that have either language attribute set to the specified scripting language or type attribute set to the specified scripting language (in a form of "text/ScriptingLanguage"). Use the Script Languages edit box to specify space delimited scripting languages. The comparison is not case sensitive. Possible <!-- marker found in the content of those elements is not treated as the beginning of a comment.
  • Inside <... runat="server" ... > elements designates whether elements that have their runat attribute set to server are treated as server side elements. The comparison is not case sensitive.
  • Inside custom elements allows you to specify custom server side elements. Use the Elements That Start With edit box to specify space delimited prefixes of the server side elements. Use the Elements edit box to specify space delimited server side elements. Here you can use element's namespace prefixes according to this table. Put (*) character (without parenthesis) at the end of the custom element name to designate that the element contains server side scripting code. If there is (*) character (without parenthesis) at the end of the custom element name, then possible <!-- marker found in the content of those elements is not treated as the beginning of a comment.
  • Element names and attributes are case sensitive designates whether comparison of server side elements and attributes is case sensitive.

The Client Side JavaScript and CSS Code

The client side JavaScript and CSS code can be placed inside elements and/or inside attributes. Also, the whole file can contain JavaScript/CSS code. It is important that all places where there is JavaScript/CSS code get analyzed in order for obfuscated code to work correctly.

Figure 9-2. The client side JavaScript and CSS code settings.

To specify settings for client side JavaScript and CSS code, select the Client Side JavaScript and CSS Code tab from the File Types dialog box. Fields on the Client Side JavaScript and CSS Code tab have the following meanings:

  • Whole file is JavaScript code designates whether the whole file contains JavaScript code.
  • Whole file is CSS code designates whether the whole file contains CSS code.
  • In HTML elements designates whether JavaScript/CSS code is placed inside HTML elements and/or attributes. For more information on how to specify HTML elements and attributes, see The HTML.
  • In ASP.NET elements designates whether JavaScript/CSS code is placed inside ASP.NET elements and/or attributes. For more information on how to specify ASP.NET elements and attributes, see The ASP.NET.
  • In JSP elements designates whether JavaScript/CSS code is placed inside JSP elements and/or attributes. For more information on how to specify JSP elements and attributes, see The JSP.
  • In XML elements designates whether JavaScript code is placed inside XML/CSS elements and/or attributes. For more information on how to specify XML elements and attributes, see The XML.
  • In CFML elements designates whether JavaScript/CSS code is placed inside CFML elements and/or attributes. For more information on how to specify CFML elements and attributes, see The CFML.
  • Custom elements file allows you to specify a custom elements file which contains rules for elements and attributes that contain JavaScript/CSS code. Click the Browse button to specify a custom elements file. To create a custom elements file, see Options section and then choose desired Web technology. A custom elements file can have one of the following file extensions: .jsbh, .jsbe or .jsbc. To specify whether comparison of elements and attributes from the custom elements file is case sensitive, use Element names and attributes are case sensitive option.
  • Handle CDATA sections designates whether <![CDATA[ and ]]> markers are ignored when the content of the CDATA section is placed inside JavaScript/CSS code. The CDATA section content will be analyzed and obfuscated.
  • Don't obfuscate JavaScript and CSS code inside <JasobNoObfs> elements designates whether to exclude JavaScript/CSS code that is placed inside <JasobNoObfs> and </JasobNoObfs> elements from the analysis and obfuscation. If you wish to also remove that code completely from the obfuscated file, use remove attribute with <JasobNoObfs> element and set its value to true, like <JasobNoObfs remove="true">. You can place <JasobNoObfs> elements anywhere you want inside your source files. However, if you put them inside JavaScript code, you should put them inside JavaScript comments, like:

    // <JasobNoObfs>
...
... JavaScript code that is excluded from the analysis and obfuscation
...
// </JasobNoObfs>

// <JasobNoObfs remove="true">
...
... JavaScript code that is removed from the obfuscated file
...
// </JasobNoObfs>
  • Obfuscate all names in JavaScript strings that are found in JavaScript code designates whether to analyze and obfuscate all strings that are found in JavaScript code in a way to look only for a names in those strings that are also found in JavaScript code. You can also use <JasobObfsStr> and <JasobNoObfsStr> elements in your source files to designate regions that are exceptions to Obfuscate all names in JavaScript strings that are found in JavaScript code setting.

    When Obfuscate all names in JavaScript strings that are found in JavaScript code is checked, you can use <JasobNoObfsStr> and </JasobNoObfsStr> elements to designate regions in your source files in which JavaScript strings will be excluded from the analysis and obfuscation as described for Obfuscate all names in JavaScript strings that are found in JavaScript code option. Strings outside of those regions will be analyzed and obfuscated according to Obfuscate all names in JavaScript strings that are found in JavaScript code setting.

    When Obfuscate all names in JavaScript strings that are found in JavaScript code is unchecked, you can use <JasobObfsStr> and </JasobObfsStr> elements to designate regions in your source files in which JavaScript strings will be analyzed and obfuscated as described for Obfuscate all names in JavaScript strings that are found in JavaScript code option. Strings outside of those regions will be excluded from the analysis and obfuscation according to Obfuscate all names in JavaScript strings that are found in JavaScript code setting.

    You can place <JasobObfsStr> and <JasobNoObfsStr> elements anywhere you want inside your source files. However, if you put them inside JavaScript code, you should put them inside JavaScript comments, like:

    // <JasobObfsStr>
...
... JavaScript code in which strings are analyzed and obfuscated
...
// </JasobObfsStr>
  • Obfuscate all JavaScript strings as JavaScript code designates whether to analyze and obfuscate all strings that are found in JavaScript code as if they contain JavaScript code. You can also use <JasobObfsJSStr> and <JasobNoObfsJSStr> elements in your source files to designate regions that are exceptions to Obfuscate all JavaScript strings as JavaScript code setting.

    When Obfuscate all JavaScript strings as JavaScript code is checked, you can use <JasobNoObfsJSStr> and </JasobNoObfsJSStr> elements to designate regions in your source files in which JavaScript strings will be excluded from the analysis and obfuscation as described for Obfuscate all JavaScript strings as JavaScript code option. Strings outside of those regions will be analyzed and obfuscated according to Obfuscate all JavaScript strings as JavaScript code setting.

    When Obfuscate all JavaScript strings as JavaScript code is unchecked, you can use <JasobObfsJSStr> and </JasobObfsJSStr> elements to designate regions in your source files in which JavaScript strings will be analyzed and obfuscated as described for Obfuscate all JavaScript strings as JavaScript code option. Strings outside of those regions will be excluded from the analysis and obfuscation according to Obfuscate all JavaScript strings as JavaScript code setting.

    You can place <JasobObfsJSStr> and <JasobNoObfsJSStr> elements anywhere you want inside your source files. However, if you put them inside JavaScript code, you should put them inside JavaScript comments, like:

    // <JasobObfsJSStr>
...
... JavaScript code in which strings are analyzed and obfuscated as if they contain JavaScript code
...
// </JasobObfsJSStr>
  • Escape random characters in all JavaScript strings when saving designates whether to replace specified amount of random characters in all JavaScript strings with their escape sequences. Use the associated edit box to specify the actuall amount (percentage) of random characters in JavaScript strings that should be replaced with appropriate escape sequences. Valid values for this amount are integer values in range 0-100. Characters are replaced with their escape sequences in the saved obfuscated file (escape sequences will not appear in The File Viewer ), however, additional characters used for escape sequences are included in the statistics for the project file after the obfuscation has finished. You can also use <JasobEscapeStr amount="..."> elements in your source files to designate regions that are exceptions to Escape random characters in all JavaScript strings when saving setting.

    You can place <JasobEscapeStr amount="..."> elements anywhere you want inside your source files. However, if you put them inside JavaScript code, you should put them inside JavaScript comments, like:

    // <JasobEscapeStr amount="30%">
...
... JavaScript code in which random characters in strings are replaced with their escape sequences
...
// </JasobEscapeStr>
  • Remove white space in JavaScript code designates whether to remove unnecessary white space characters from the obfuscated JavaScript code.
  • Remove comments in JavaScript code designates whether to remove comments from the obfuscated JavaScript code. Please note that Internet Explorer supports conditional JavaScript compilation and that such code is placed inside JavaScript comments when a start comment delimiter is followed by @ character, like /*@...@*/ or //@... Those types of comments will not be removed and the content inside those comments will be handled as a conditional compilation code.
  • Convert CSS color names to hex values designates whether to replace CSS color names with their hexadecimal color values in the obfuscated CSS code.
  • Keep original CSS color name if shorter designates whether to keep CSS color name when its associated hexadecimal color value contains more characters than the original CSS color name.
  • Remove white space in CSS code designates whether to remove unnecessary white space characters from the obfuscated CSS code.
  • Remove comments in CSS code designates whether to remove comments from the obfuscated CSS code.

The Other Settings

There are also other Jasob features that can improve the overall obfuscation experience. For example, you can choose to remove unnecessary white space characters and comments from the non-JavaScript/CSS code.

Figure 9-3. The other settings.

To specify other settings, select the Other tab from the File Types dialog box. Fields on the Other tab have the following meanings:

  • Remove white space in non-JavaScript/CSS code designates whether to remove unnecessary white space characters from the obfuscated non-JavaScript/CSS code. Server side code is not affected by this setting. When Remove white space in non-JavaScript/CSS code is checked, you can use the Except in Elements edit box to specify space delimited elements that are exception to this setting (no white space characters are removed from those elements). You can also use namespace prefixes with specified exception elements according to this table and specify whether comparison of those elements is case sensitive by using Element names are case sensitive option.
  • Remove <!-- ... --> comments in non-JavaScript/CSS code designates whether to remove comments placed inside <!-- and --> markers from the obfuscated non-JavaScript/CSS code. Server side code is not affected by this setting. Please note that Internet Explorer supports conditional comments and that such code is placed inside <!-- and --> comment delimiters when a start comment delimiter is followed by [if characters, like <!--[if...]>...<![endif]-->. Those types of comments will not be removed.
  • Do not obfuscate non-JavaScript/CSS code inside <JasobNoObfs> elements designates whether to exclude non-JavaScript/CSS code that is placed inside <JasobNoObfs> and </JasobNoObfs> elements from the analysis and obfuscation. If you wish to also remove that code completely from the obfuscated file, use remove attribute with <JasobNoObfs> element and set its value to true, like <JasobNoObfs remove="true">. You can place <JasobNoObfs> elements anywhere you want inside your source files. However, if you put them inside JavaScript code, you should put them inside JavaScript comments, like:

    // <JasobNoObfs>
...
... JavaScript code that is excluded from the analysis and obfuscation
...
// </JasobNoObfs>

// <JasobNoObfs remove="true">
...
... JavaScript code that is removed from the obfuscated file
...
// </JasobNoObfs>
  • Limit obfuscated code line length designates whether to limit maximum number of characters in each obfuscated code line. Use the Maximum Line Length edit box to specify maximum number of characters each obfuscated code line can contain.

NOTE: All settings can be customized for each individual opened file. To change individual file settings, right-click the file in the project files list and choose Settings... from the project files context menu. For more information, see The File Settings.

Adding a New File Filter

To add a new file filter, click the New... button on the File Types dialog box.

Figure 9-3. Adding a new file filter.

Fields on the New Filter dialog box have the following meanings:

  • Filter description contains filter description without associated file extensions. Filter descriptions must be unique.
  • Filter template designates initial settings for the new file filter.

Removing File Filters

To remove a file filter, select the file filter from the Filter Description combo box and click the Remove button on the File Types dialog box.

Opening File Filters

To open file filters (file types) from a file, click the Open... button on the File Types dialog box.

Saving File Filters

To save file filters to a file, click the Save As... button on the File Types dialog box. The saved file filters (file types) file has the .jsbf extension.

NOTE: When you click the OK button on the File Types dialog box, file types settings are automatically saved to the file from which they were opened.


Jasob Elements for Source Files

There are number of Jasob elements that you can use in your source files to give certain instructions on how designated regions in your source code should be obfuscated. You can place Jasob elements anywhere you want inside source files. However, if you put them inside JavaScript code, you should put them inside JavaScript comments.

Jasob Elements | Description
<JasobNoObfs> ... </JasobNoObfs> <JasobNoObfs remove="true"> ... </JasobNoObfs> | Designates region in which JavaScript/CSS and/or non-JavaScript/CSS code is excluded from the analysis and obfuscation. If you wish to also remove that code completely from the obfuscated file, use remove attribute and set its value to true. For more information, see File Types: Don't obfuscate JavaScript and CSS code inside <JasobNoObfs> elements and File Types: Do not obfuscate non-JavaScript/CSS code inside <JasobNoObfs> elements.
<JasobObfsStr> ... </JasobObfsStr> | Designates region in which JavaScript strings are analyzed and obfuscated in a way to look only for a names in those strings that are also found in JavaScript code. For more information, see File Types: Obfuscate all names in JavaScript strings that are found in JavaScript code.
<JasobNoObfsStr> ... </JasobNoObfsStr> | Designates region in which JavaScript strings are not analyzed and obfuscated in a way to look only for a names in those strings that are also found in JavaScript code. For more information, see File Types: Obfuscate all names in JavaScript strings that are found in JavaScript code.
<JasobObfsJSStr> ... </JasobObfsJSStr> | Designates region in which JavaScript strings are analyzed and obfuscated as if they contain JavaScript code. For more information, see File Types: Obfuscate all JavaScript strings as JavaScript code.
<JasobNoObfsJSStr> ... </JasobNoObfsJSStr> | Designates region in which JavaScript strings are not analyzed and obfuscated as if they contain JavaScript code. For more information, see File Types: Obfuscate all JavaScript strings as JavaScript code.
<JasobEscapeStr amount="..."> ... </JasobEscapeStr> | Designates region in which specified amount (percentage) of random characters in JavaScript strings will be replaced with their escape sequences. Valid values for amout attribute are integer values in range 0-100. For more information, see File Types: Escape random characters in all JavaScript strings when saving.


Examples

There are three examples included of how to use Jasob for common obfuscation tasks.

In this section

  • How to obfuscate a static Web site.
  • How to obfuscate a dynamic Web site.
  • How to obfuscate a DHTML component.


Example: How to Obfuscate a Static Web Site

A static Web site comprises of Web pages that don't change upon each request for a Web page. That means when the Web browser requests a static Web page from the server, the Web page is returned to the browser as is. There is no processing of the Web page on the server.

An example of a static Web site is located in the Examples\MenuDemo folder inside the Jasob installation folder. To start the example Web site, create virtual directory on the Web server for the Web site folder and open the Menu.html file in the Web browser.

Figure 11-1. The static MenuDemo Web site.

To obfuscate the MenuDemo Web site

  1. Open a Web site with Jasob.

    Choose File > Open Web Site... from the main menu and select the MenuDemo Web site folder.
    Web site files of a supported file type appear in the project files list.

  2. Analyze the Web site.

    Choose Obfuscate > Analyze from the main menu.
    JavaScript names that can be changed appear in name lists.

  3. Generate new names.

    1. Select all names from the functions name list and choose Mark from the functions name list context menu.
    2. Select all names from the variables name list and choose Mark from the variables name list context menu.
    3. Choose Obfuscate > Generate New Names from the main menu.

    New names appear in name lists.

  4. Obfuscate the Web site.

    Choose Obfuscate > Obfuscate from the main menu.
    Tab Obfuscated appears at the top of the file viewer. By selecting the Obfuscated tab you can see obfuscated files content.

  5. Save the obfuscated Web site.

    Choose File > Save Obfuscated Web Site or File > Save Obfuscated Web Site As... from the main menu and select folder where you wish to save the obfuscated Web site.

  6. Test the obfuscated Web site.

    To start the obfuscated Web site, create virtual directory on the Web server for the obfuscated Web site folder and open the Menu.html file in the Web browser.

Figure 11-2. The obfuscated MenuDemo Web site.


Example: How to Obfuscate a Dynamic Web Site

A dynamic Web site comprises of Web pages that are created dynamically (on-the-fly) on the server upon each request for a Web page. Typical dynamic Web page consists of a static HTML code including JavaScript and a dynamic programming code that is executed on the server each time a Web page is requested by the Web browser.

An example of a dynamic Web site is located in the Examples\MenuDemoASPNET folder inside the Jasob installation folder. This is the ASP.NET Web application which can't be moved to a different location by simply copying files from one folder to another. Because of that, you should first create an ASP.NET Web application (Visual C# Project) by using Microsoft Visual Studio .NET. Give the created ASP.NET Web application a name MenuDemoASPNET. Delete the automatically created file WebForm1.aspx from the created ASP.NET Web application project and copy the following files and folders from the supplied MenuDemoASPNET example folder to the created ASP.NET Web application folder:

  • script\
  • style\
  • obfuscation\
  • CreateMenu.aspx
  • CreateMenu.aspx.cs
  • DHTML.cs
  • Menu.html

Include the following files in the ASP.NET Web application project:

  • CreateMenu.aspx
  • DHTML.cs
  • Menu.html

Rebuild the project. Right-click the Menu.html file in the Solution Explorer and choose Set As Start Page from the context menu. Run the created ASP.NET Web application.

Figure 11-3. The dynamic MenuDemoASPNET Web site.

To obfuscate the MenuDemoASPNET Web site

  1. Make a copy of the Web site.

    Open the Web site project with Microsoft Visual Studio .NET and make a copy of that project by using the Project > Copy Project... command from the Microsoft Visual Studio .NET main menu. Give the project copy a name MenuDemoASPNET_Obfs, and select the Copy: All files in the source project folder option.

  2. Open the MenuDemoASPNET_Obfs Web site with Jasob.

    Choose File > Open Web Site... from the main menu and select the MenuDemoASPNET_Obfs Web site folder.
    Web site files of a supported file type appear in the project files list.

  3. Analyze the Web site.

    Choose Obfuscate > Analyze from the main menu.
    JavaScript names that can be changed appear in name lists.

  4. Generate new names.

    1. Select all names from the functions name list and choose Mark from the functions name list context menu.
    2. Select all names from the variables name list and choose Mark from the variables name list context menu.
    3. Choose Obfuscate > Generate New Names from the main menu.

    New names appear in name lists.

  5. Obfuscate the Web site.

    Choose Obfuscate > Obfuscate from the main menu.
    Tab Obfuscated appears at the top of the file viewer. By selecting the Obfuscated tab you can see obfuscated files content.

  6. Save the obfuscated Web site.

    Choose File > Save Obfuscated Web Site or File > Save Obfuscated Web Site As... from the main menu and select the same folder from where you have opened the MenuDemoASPNET_Obfs Web site. This way original files in the MenuDemoASPNET_Obfs Web site folder will be replaced with obfuscated files.

  7. Update JavaScript names in the server-side programming code with new names.

    Programming code that runs on the server uses JavaScript names to dynamically generate JavaScript code that is part of the generated Web page. File DHTML.cs contains DHTML class whose member variables hold current new names for JavaScript names that are used by the Web site project. To update DHTML class member variables with current new names do the following:

    1. Choose Obfuscate > Names Bag... from the main menu to show the names bag. Make sure the names bag is empty.
    2. Enter the original "public" names from the DHTML class into the names bag, or load the names bag from the MenuDemoPublicNames.jsbb file that is located in the obfuscation folder inside the MenuDemoASPNET_Obfs Web site folder.
    3. Select all names from the names bag list and choose Update From List from the names bag list context menu. Names in the names bag list are updated with data from names in name lists. (If the message box appears, you may click any button except the Cancel button.)
    4. Select all names from the names bag list and choose Copy > C# > Public from the names bag list context menu. Selected names and associated new names are copied to the clipboard in the form of variable names and variable values for the C# programming language.
    5. Open the obfuscated Web site project (MenuDemoASPNET_Obfs) with Microsoft Visual Studio .NET and paste content from the clipboard into the DHTML class, thus replacing the old DHTML class member variable values with current new names.

  8. Test the obfuscated Web site.

    Rebuild the obfuscated Web site project. Right-click the Menu.html file in the Microsoft Visual Studio .NET Solution Explorer and choose Set As Start Page from the context menu. Run the MenuDemoASPNET_Obfs Web application.

NOTE: For security reasons, the names bag file MenuDemoPublicNames.jsbb should be placed outside of the Web site folder in order to avoid the possibility of unauthorized access to this file.

Figure 11-4. The obfuscated MenuDemoASPNET Web site.


Example: How to Obfuscate a DHTML Component

A DHTML component comprises of one or more .js files that contain JavaScript code for the component. DHTML components are used to add functionality to Web pages. Typical examples of DHTML components are menus, grids, text editors...

An example of a DHTML component is located in the Examples\MenuDHTMLComponent folder inside the Jasob installation folder.

To obfuscate the DHTML Menu component

  1. Open the DHTML Menu component with Jasob.

    Choose File > Open... from the main menu and select the Examples\MenuDHTMLComponent\Menu.js file.
    File Menu.js appears in the project files list.

  2. Analyze files.

    Choose Obfuscate > Analyze from the main menu.
    JavaScript names that can be changed appear in name lists.

  3. Generate new names.

    In the Menu.js file, all functions and global variables have the ME_ prefix. This is to differentiate functions and global variables in the Menu.js file from the other functions and global variables where Menu.js might be used. So, when generating new names, you should keep this prefix.

    1. To set the prefix for new names, choose Obfuscate > Options... from the main menu and select the General tab from the Options dialog box. Inside the New Name group box, enter the ME_ in the Prefix edit box and make sure the following check boxes are checked: Scope > Functions, Scope > Variables and Origin > Generated New Names. Click the OK button to save the changes.
    2. Click the Name column header in the functions name list to sort entries on the Name column. Select all names from the functions name list and choose Mark from the functions name list context menu.
    3. Click the Name column header in the variables name list to sort entries on the Name column. Select names that have the ME_ prefix from the variables name list and choose Mark from the variables name list context menu.
    4. Choose Obfuscate > Generate New Names from the main menu.

    Names that don't have the ME_ prefix are local variables, properties or methods. You don't have to add the ME_ prefix to new names for those names.

    1. To remove the prefix for new names, choose Obfuscate > Options... from the main menu and select the General tab from the Options dialog box. Inside the New Name group box, uncheck the Origin > Generated New Names group box. Click the OK button to save the changes.
    2. Because entries in the variables name list are sorted on the Name column, select all names that appear above those names with the ME_ prefix and choose Mark from the variables name list context menu.
    3. Because entries in the variables name list are sorted on the Name column, select all names that appear below those names with the ME_ prefix and choose Mark from the variables name list context menu.
    4. Choose Obfuscate > Generate New Names from the main menu.

    NOTE: You can automatically mark/unmark or select only names with specific prefixes and/or suffixes by choosing Obfuscate > Mark Names With Prefixes... from the main menu. For more information, see Marking Names for Obfuscation: Marking Names with Prefixes and/or Suffixes. To simplify navigation to global names in name lists, you can group names with G (Global) status by choosing Group By > Status > Global from the name list context menu (global names will appear at the top of the name list).

    To utilize the DHTML Menu component on the Web page, you would need the following names:

    • ME_MainMenu
    • ME_ContextMenu
    • ME_MenuItem
    • AddItem
    • AddSubitem
    • Show

    These are so-called "public" names because they are used to create and show DHTML menus on the Web page. ME_MainMenu, ME_ContextMenu and ME_MenuItem are constructors that are used to create the main menu, the context menu and the menu item, respectively. AddItem, AddSubitem and Show
    4. are methods that are used to add items to the menu, add subitems to the item and to show the created menu, respectively. You have to keep track of new names for those "public" names, as described in Example: How to Obfuscate a Dynamic Web Site (Step 7). Or, you can choose not to obfuscate "public" names.

  4. Obfuscate files.

    Choose Obfuscate > Obfuscate from the main menu.
    Tab Obfuscated appears at the top of the file viewer. By selecting the Obfuscated tab you can see obfuscated files content.

  5. Save obfuscated files.

    Select the Menu.js file from the project files list and choose File > Save Obfuscated or File > Save Obfuscated As... from the main menu.

  6. Test the obfuscated DHTML Menu component.

    To test the obfuscated DHTML Menu component, write a simple HTML page that will use the obfuscated component. Or you can make a copy of the Menu.html file from the Examples\MenuDemo Web site and include the obfuscated DHTML Menu component instead of the original Menu.js file. Of course, you have to update "public" names for the DHTML Menu component in Menu.html file with new names that were generated in the process of obfuscation.

Figure 11-5. The obfuscated DHTML Menu component.

Figure 11-6. Public names for the DHTML Menu component.


Command-Line Parameters

Jasob command-line parameters enable you to automate the JavaScript obfuscation. To start obfuscation from the command-line, parameter /src: must be specified. With /src: parameter you can either specify Web site folder (or any other folder) or Jasob project (.jsbp file) you wish to obfuscate. If a parameter contains spaces (such as long file names) you have to enclose that parameter in double quotation marks ("parameter with spaces" or /src:"c:\inetpub\wwwroot\Web site folder") on some environments, like when working with Windows Command Prompt. Jasob (jasob.exe) can be accessed from the Jasob installation folder. You can use /log: parameter to specify the file where you wish to save the obfuscation log. The obfuscation log contains obfuscation progress messages and possible error messages.

To start Jasob from the command-line and wait until it ends, use start command with /wait parameter like:

start /wait "" "C:\Program Files\Genesis Mobile\Jasob 4.2\jasob.exe" jasob-command-line-parameters

* It is assumed that Jasob has been installed to the C:\Program Files\Genesis Mobile\Jasob 4.2 folder. If not, you should replace this with your Jasob installation folder.

Please note two double quotation marks after /wait parameter. This is necessary because start command itself expects title to display in the window title as a parameter inside double quotation marks. So, to avoid misinterpreting Jasob file name (which you have to put inside double quotation marks as well because of possible space characters) as the window title, put that title inside double quotation marks immediately after /wait parameter (it could also be empty string, but two double quotation marks must be specified).

The command-line obfuscation is performed in the following steps:

  1. After source for obfuscation has been specified with /src: parameter, source files are loaded and name lists are populated with names.
  2. If /markprefixes: and/or /marksuffixes: parameters are used, then names with specified prefixes and suffixes in name lists are marked for obfuscation.
  3. If /markregexp: parameter is used, then names that match specified regular expression in name lists are marked for obfuscation.
  4. If /markelements: and/or /markattributes: parameters are used, then names found inside specified elements and attributes in name lists are marked for obfuscation.
  5. If /markfunctions parameter is used, then all names in the functions name list are marked for obfuscation.
  6. If /markvariables parameter is used, then all names in the variables name list are marked for obfuscation.
  7. If none of the /markprefixes: or /marksuffixes: or /markregexp: or /markelements: or /markattributes: or /markfunctions or /markvariables parameters are used and no /nomarkall is specified, then all names in name lists are marked for obfuscation.
  8. If no /nonamechanges parameter is specified, name changes from the specified project (/src: parameter) or Web site settings (/wss: parameter) are applied to the names in name lists.

    As a result of the changes that you have made to the source files that you wish to re-obfuscate, it is possible that there will be some new names within name lists that didn't exist last time when you were obfuscating source files (last time when you saved the project or Web site settings). Whether or not those new names will be marked for obfuscation depends on whether they are marked for obfuscation in step (2), step (3), step (4), step (5), step (6), step (8), step (9), step (10), step (11), step (12) or step (13).
  9. If /nb: parameter is used, specified names bag file is opened. If /nbset parameter is used, opened names bag is applied to the names in name lists.
  10. If /unmarkprefixes: and/or /unmarksuffixes: parameters are used, then names with specified prefixes and suffixes in name lists are unmarked for obfuscation.
  11. If /unmarkregexp: parameter is used, then names that match specified regular expression in name lists are unmarked for obfuscation.
  12. If /unmarkelements: and/or /unmarkattributes: parameters are used, then names found inside specified elements and attributes in name lists are unmarked for obfuscation.
  13. If /unmarkfunctions parameter is used, then all names in the functions name list are unmarked for obfuscation.
  14. If /unmarkvariables parameter is used, then all names in the variables name list are unmarked for obfuscation.
  15. If /unmarkglobal parameter is used, then all names with G (Global) status in name lists are unmarked for obfuscation.
  16. If there are any names in name lists that are marked for obfuscation but have empty new name, new names are generated for those names.
  17. If names bag is opened and /nbget parameter is used, names in the names bag are updated with data from names in name lists.
  18. If project is used and /saveproject parameter is specified, changes to the project are saved.
  19. If Web site settings is used and /savewss parameter is specified, changes to the Web site settings are saved.
  20. If names bag is opened and /nbget parameter is used, changes to the names bag are saved.
  21. The obfuscation of the source files takes place and obfuscated files are saved as it is explained for /destfolder: and /destsuff: parameters.

After the command-line obfuscation has finished, you can examine ERRORLEVEL variable for possible errors. For more information about the possible errors, see the log file (use /log: parameter to specify the obfuscation log file name). If more than one error occurred during the obfuscation process, ERRORLEVEL is set to the highest error value encountered.

ERRORLEVEL | Description
0 | Success, there were no errors.
1 | Error, some command-line parameters have invalid values or there was unknown command-line parameter specified.
2 | Error, during the process of applying/updating names from project or Web site settings or names bag to/from name lists there were some name ambiguities encountered.
3 | Error, when opening Jasob system file(s) there was some invalid data in the file content.
4 | Error, general file open/save error.
5 | Error, other error/exception has occurred.

NOTE: Some developers prefer to merge separate .js files into a single .js file. You can use Jasob to merge any number of specified files of any file type into a single file by using /merge parameter. When using /merge parameter, no other parameters may be used except /log: parameter. Files to be merged must follow after the /merge parameter. The last file specified is considered to be the combined file name. If a file name contains spaces you have to enclose that file name in double quotation marks on some environments, like when working with Windows Command Prompt. For example, to merge file A.js and file B.js into combined.js file, the following command-line parameters can be used:

/merge "file A.js" "file B.js" combined.js

When creating the combined file, Jasob takes into account file encodings and inserts line break (CRLF) characters at the end of each separate file.

The following Jasob command-line parameters can be used:

Parameter | Description
/src:<Source> | Use /src: parameter to specify the source you wish to obfuscate. <Source> may be either a Web site folder or Jasob project (.jsbp file). If you are obfuscating a Web site, use /destfolder: parameter to specify folder where obfuscated Web site will be saved. If you wish to obfuscate individual files, put them into separate folder and then specify that folder with /src: parameter (just like the Web site). Use /destfolder: parameter to specify folder where obfuscated individual files will be saved.
/noexclhf | When obfuscating a Web site, hidden folders are excluded from the analysis and the obfuscation. Specify /noexclhf parameter if you wish to include hidden folders into the Web site obfuscation.
/wss:<WSS> | If you are obfuscating a Web site, use /wss: parameter to specify the Web site settings file you wish to apply to the opened Web site. <WSS> contains the Web site settings file name (.jsbw file).
/destfolder:<Dest> | If you are obfuscating a Web site, use /destfolder: parameter to specify folder for the obfuscated Web site. <Dest> contains folder where obfuscated Web site is saved. CAUTION: If <Dest> is the same as <Source> then obfuscated Web site will replace the original Web site.
/destsuff:<FileSuffix> | If you are obfuscating a Jasob project, use /destsuff: parameter to specify suffix that will be used when creating obfuscated file names for the project files. The obfuscated file names are created from the original file names with the added suffix. <FileSuffix> contains suffix that is used when creating obfuscated file names. If /destsuff: parameter is specified, obfuscated file names are created from the original file names with the added suffix for all project files, regardless of whether there is information inside the project about their associated obfuscated file names or not. If no /destsuff: parameter is specified, information inside the project for the project files obfuscated file names is used. CAUTION: If you specify /destsuff: with no (empty) <FileSuffix> then obfuscated file names will be the same as the original file names and will thereby replace original files.
/defdestsuff:<DefFileSuffix> | If you are obfuscating a Jasob project where there may be project files for which there is no information inside the project about their associated obfuscated file names, use /defdestsuff: parameter to specify suffix that will be used when creating obfuscated file names for such files. The obfuscated file names are created from the original file names with the added suffix. <DefFileSuffix> contains suffix that is used when creating obfuscated file names. If no /defdestsuff: parameter is specified, for such files Jasob default suffix is used (_Obfs). CAUTION: If you specify /defdestsuff: with no (empty) <DefFileSuffix> then obfuscated file names for such files will be the same as the original file names and will thereby replace original files.
/markprefixes:<MarkPrefixes> | Use /markprefixes: parameter to mark names with specified prefixes for obfuscation. <MarkPrefixes> contains space separated prefixes that names must have in order to be marked for obfuscation. Parameters /markprefixes: and /marksuffixes: are both applied when filtering names that will be marked for obfuscation.
/marksuffixes:<MarkSuffixes> | Use /marksuffixes: parameter to mark names with specified suffixes for obfuscation. <MarkSuffixes> contains space separated suffixes that names must have in order to be marked for obfuscation. Parameters /markprefixes: and /marksuffixes: are both applied when filtering names that will be marked for obfuscation.
/markprefsuffcs | Specify /markprefsuffcs parameter to specify that the comparison of <MarkPrefixes> and <MarkSuffixes> is case sensitive. Otherwise, the comparison is not case sensitive.
/markregexp:<MarkRegularExpression> | Use /markregexp: parameter to mark names that match specified regular expression for obfuscation. <MarkRegularExpression> contains regular expression.
/markregexpcs | Specify /markregexpcs parameter to specify that the <MarkRegularExpression> is case sensitive by default. Otherwise, the comparison is not case sensitive by default.
/markelements:<MarkElements> | Use /markelements: parameter to mark names that are found inside specified elements for obfuscation. <MarkElements> contains space separated elements in which names must be found in order to be marked for obfuscation. Parameters /markelements: and /markattributes: are both applied when filtering names that will be marked for obfuscation.
/markattributes:<MarkAttributes> | Use /markattributes: parameter to mark names that are found inside specified attributes for obfuscation. <MarkAttributes> contains space separated attributes in which names must be found in order to be marked for obfuscation. Parameters /markelements: and /markattributes: are both applied when filtering names that will be marked for obfuscation.
/markelemattrcs | Specify /markelemattrcs parameter to specify that the comparison of <MarkElements> and <MarkAttributes> is case sensitive. Otherwise, the comparison is not case sensitive.
/markfunctions | Use /markfunctions parameter to mark all names in the functions name list for obfuscation.
/markvariables | Use /markvariables parameter to mark all names in the variables name list for obfuscation.
/unmarkprefixes:<UnmarkPrefixes> | Use /unmarkprefixes: parameter to unmark names with specified prefixes for obfuscation. <UnmarkPrefixes> contains space separated prefixes that names must have in order to be unmarked for obfuscation. Parameters /unmarkprefixes: and /unmarksuffixes: are both applied when filtering names that will be unmarked for obfuscation.
/unmarksuffixes:<UnmarkSuffixes> | Use /unmarksuffixes: parameter to unmark names with specified suffixes for obfuscation. <UnmarkSuffixes> contains space separated suffixes that names must have in order to be unmarked for obfuscation. Parameters /unmarkprefixes: and /unmarksuffixes: are both applied when filtering names that will be unmarked for obfuscation.
/unmarkprefsuffcs | Specify /unmarkprefsuffcs parameter to specify that the comparison of <UnmarkPrefixes> and <UnmarkSuffixes> is case sensitive. Otherwise, the comparison is not case sensitive.
/unmarkregexp:<UnmarkRegularExpression> | Use /unmarkregexp: parameter to unmark names that match specified regular expression for obfuscation. <UnmarkRegularExpression> contains regular expression.
/unmarkregexpcs | Specify /unmarkregexpcs parameter to specify that the <UnmarkRegularExpression> is case sensitive by default. Otherwise, the comparison is not case sensitive by default.
/unmarkelements:<UnmarkElements> | Use /unmarkelements: parameter to unmark names that are found inside specified elements for obfuscation. <UnmarkElements> contains space separated elements in which names must be found in order to be unmarked for obfuscation. Parameters /unmarkelements: and /unmarkattributes: are both applied when filtering names that will be unmarked for obfuscation.
/unmarkattributes:<UnmarkAttributes> | Use /unmarkattributes: parameter to unmark names that are found inside specified attributes for obfuscation. <UnmarkAttributes> contains space separated attributes in which names must be found in order to be unmarked for obfuscation. Parameters /unmarkelements: and /unmarkattributes: are both applied when filtering names that will be unmarked for obfuscation.
/unmarkelemattrcs | Specify /unmarkelemattrcs parameter to specify that the comparison of <UnmarkElements> and <UnmarkAttributes> is case sensitive. Otherwise, the comparison is not case sensitive.
/unmarkfunctions | Use /unmarkfunctions parameter to unmark all names in the functions name list for obfuscation.
/unmarkvariables | Use /unmarkvariables parameter to unmark all names in the variables name list for obfuscation.
/unmarkglobal | Use /unmarkglobal parameter to unmark names with G (Global) status for obfuscation. For more information on G status, see Starting the Analysis: The G Status.
/nomarkall | Specify /nomarkall parameter if you don't wish to initially mark all names for obfuscation.
/nonamechanges | Changes for names in name lists (marked/unmarked, new name, change in strings) were saved when you last saved your project or Web site settings. If you are using Jasob project or Web site settings, specify /nonamechanges parameter when you don't wish to apply name changes from the project or Web site settings to the names in name lists.
/nokeeporignis | When generating new names, original names that are shorter than the generated new names for those names are kept instead of the generated new names. Specify /nokeeporignis parameter if you don't wish to keep original names and wish to use generated new names in such cases.
/nb:<NamesBag> | Use /nb: parameter to specify the names bag you wish to use in the process of obfuscation. <NamesBag> contains names bag file name (.jsbb file).
/nbget | Specify /nbget parameter to update names in the names bag with data from names in name lists.
/nbset | Specify /nbset parameter to apply data from names in the names bag to names in name lists.
/nnprefix:<Prefix> | Use /nnprefix: parameter to specify prefix that is added to generated new names. <Prefix> contains text that is added to the beginning of a generated new name. <Prefix> must be valid JavaScript variable or function name. If no /nnprefix: parameter is specified, prefix defined in Jasob options is used. Specify /nnprefix: with no (empty) <Prefix> to generate new names with no prefix regardless of the current settings in Jasob options.
/nnsuffix:<Suffix> | Use /nnsuffix: parameter to specify suffix that is added to generated new names. <Suffix> contains text that is added to the end of a generated new name. <Suffix> must be valid JavaScript variable or function name. If no /nnsuffix: parameter is specified, suffix defined in Jasob options is used. Specify /nnsuffix: with no (empty) <Suffix> to generate new names with no suffix regardless of the current settings in Jasob options.
/exitoninn | Specify /exitoninn parameter if you wish to exit obfuscation in case when there are names in name lists with INN (Invalid New Name) status. If /exitoninn parameter is specified and names in name lists with INN status are found, ERRORLEVEL variable is set to 2 (or it will be of higher value if some other error with value higher than 2 occurred before). To see which names have INN status, specify also /log: parameter and then read the obfuscation log. For more information on INN status, see Starting the Analysis: The INN Status.
/exitonas | Specify /exitonas parameter if you wish to exit obfuscation in case when there are names in name lists with AS (Ambiguities in Strings) status. If /exitonas parameter is specified and names in name lists with AS status are found, ERRORLEVEL variable is set to 2 (or it will be of higher value if some other error with value higher than 2 occurred before). To see which names have AS status, specify also /log: parameter and then read the obfuscation log. For more information on AS status, see Starting the Analysis: The AS Status.
/exitonerror | Specify /exitonerror parameter if you wish to exit obfuscation in case when ERRORLEVEL variable has value other than 0 (which designates that some errors occurred). To see details about errors that have occurred, specify also /log: parameter and then read the obfuscation log.
/saveproject | If you are using Jasob project, specify /saveproject parameter to save changes to the project.
/savewss | If you are using Web site settings, specify /savewss parameter to save changes to the Web site settings.
/filetypes:<FileTypesFile> | Use /filetypes: parameter to specify the file types file you wish to use in the process of obfuscation. <FileTypesFile> contains the file types file name (.jsbf file). If no /filetypes: parameter is specified, file types defined in Jasob are used.
/sysnames:<SysFile> | Use /sysnames: parameter to specify the system names file you wish to use in the process of obfuscation. <SysFile> contains the system names file name (.jsbn file). If no /sysnames: parameter is specified, system names defined in Jasob options are used.
/htmlelems:<HtmlFile> | Use /htmlelems: parameter to specify the HTML elements file you wish to use in the process of obfuscation. <HtmlFile> contains the HTML elements file name (.jsbh file). If no /htmlelems: parameter is specified, HTML elements defined in Jasob options are used.
/aspnetelems:<AspNetFile> | Use /aspnetelems: parameter to specify the ASP.NET elements file you wish to use in the process of obfuscation. <AspNetFile> contains the ASP.NET elements file name (.jsbe file). If no /aspnetelems: parameter is specified, ASP.NET elements defined in Jasob options are used.
/jspelems:<JspFile> | Use /jspelems: parameter to specify the JSP elements file you wish to use in the process of obfuscation. <JspFile> contains the JSP elements file name (.jsbe file). If no /jspelems: parameter is specified, JSP elements defined in Jasob options are used.
/xmlelems:<XmlFile> | Use /xmlelems: parameter to specify the XML elements file you wish to use in the process of obfuscation. <XmlFile> contains the XML elements file name (.jsbe file). If no /xmlelems: parameter is specified, XML elements defined in Jasob options are used.
/cfmlelems:<CfmlFile> | Use /cfmlelems: parameter to specify the CFML elements file you wish to use in the process of obfuscation. <CfmlFile> contains the CFML elements file name (.jsbc file). If no /cfmlelems: parameter is specified, CFML elements defined in Jasob options are used.
/nosp | Specify /nosp parameter to prevent the progress dialog from showing up.
/log:<LogFile> | Use /log: parameter to specify the file where you wish to save the obfuscation log. <LogFile> contains the obfuscation log file name. You may use arbitrary log file name. The log content is saved in plain text format using the UTF-8 encoding. Even if obfuscation log is empty, file specified with <LogFile> is created. Log file creation signals that the obfuscation process has finished.
/merge | Use /merge parameter to merge any number of specified files of any file type into a single file. When using /merge parameter, no other parameters may be used except /log: parameter. Files to be merged must follow after the /merge parameter. The last file specified is considered to be the combined file name. If a file name contains spaces you have to enclose that file name in double quotation marks on some environments, like when working with Windows Command Prompt. For example, to merge file A.js and file B.js into combined.js file, the following command-line parameters can be used: /merge "file A.js" "file B.js" combined.js When creating the combined file, Jasob takes into account file encodings and inserts line break (CRLF) characters at the end of each separate file.
/cpuusage:<CPUUsage> | Use /cpuusage: parameter to specify CPU usage you wish to use. <CPUUsage> can contain one of the following values (value in bold typeface only): 0 - 100% CPU usage 2 - 20% CPU usage 3 - 30% CPU usage 4 - 40% CPU usage 5 - 50% CPU usage 6 - 60% CPU usage 7 - 70% CPU usage 8 - 80% CPU usage 9 - 90% CPU usage

Examples

  • start /wait "" jasob.exe /src:"c:\inetput\wwwroot\MenuDemo" /destfolder:"c:\inetpub\wwwroot\MenuDemo_Obfs"

    Obfuscating Web site that is located in c:\inetput\wwwroot\MenuDemo folder and saving the obfuscated Web site to the c:\inetpub\wwwroot\MenuDemo_Obfs folder.

  • start /wait "" jasob.exe /src:c:\inetput\wwwroot\MenuDemo /destfolder:c:\inetpub\wwwroot\MenuDemo_Obfs /nomarkall

    Obfuscating Web site that is located in c:\inetput\wwwroot\MenuDemo folder without marking names for obfuscation. The obfuscated Web site is saved to the c:\inetpub\wwwroot\MenuDemo_Obfs folder.

  • start /wait "" jasob.exe /src:"c:\inetput\wwwroot\MenuDemo" /destfolder:c:\inetpub\wwwroot\MenuDemo_Obfs /nomarkall /nosp

    Obfuscating Web site that is located in c:\inetput\wwwroot\MenuDemo folder without marking names for obfuscation and without showing the progress dialog. The obfuscated Web site is saved to the c:\inetpub\wwwroot\MenuDemo_Obfs folder.


Troubleshooting and Tips

When you wish to debug or locate the possible error in the obfuscated file, it is recommended that you don't remove unnecessary white space characters from the obfuscated JavaScript code. To prevent Jasob from removing unnecessary white space characters from the obfuscated JavaScript code, right-click the file in the project files list and choose Settings... from the project files context menu. Select the Client Side JavaScript and CSS Code tab from the File Settings dialog box and make sure option Remove white space in JavaScript code is unchecked. You can also choose not to remove JavaScript comments from the obfuscated file by unchecking the Remove comments in JavaScript code option. Further, when debugging, you can also choose not to change any names to new names which may help to find the error in the obfuscated code. Once you have solved the issue, make sure that both Remove white space in JavaScript code and Remove comments in JavaScript code options are checked in order to increase the protection level of the obfuscated code, and again change names to new names that you wish to obfuscate.

If you are experiencing problems running obfuscated files in the Web browser, use Jasob file viewer to navigate to the location where Web browser reports error and consider the following:

  • There are names that can't be changed in the process of obfuscation. Those are names that are used internally by the Web browser and they are called system names. If you have accidentally obfuscated a system name, add that name to the system names (choose Obfuscate > Options... from the main menu) and obfuscate your files again.
    • If you are using external objects (ActiveX) on your Web pages then you should add properties, methods and events of those external objects to the system names. Obfuscating those names will lead to errors because those names are defined inside external objects itself and can't be changed.

  • Jasob automatically inserts semicolon character (;) into the obfuscated JavaScript code where it is needed. Despite this, if your Web browser reports error of missing semicolon character, you can solve the problem by inserting semicolon character into the original JavaScript code where it is required.

  • When you are obfuscating JavaScript/CSS code it is important that you obfuscate every block of JavaScript/CSS code. Use the file viewer and check rules for JavaScript/CSS code blocks (choose Obfuscate > Options... from the main menu) for file types that you are obfuscating. Every block of JavaScript/CSS code in your files must be included in the analysis and the obfuscation.

There are Web technologies (like JSP or ASP.NET) that make use of server side elements which contain JavaScript/CSS code. It is very important that you define those elements and/or attributes in Jasob so this JavaScript/CSS code gets analyzed and obfuscated. For more information on how to specify those elements, see Options section and then choose desired Web technology. Note the special attribute $parentContent="JavaScript" and $parentContent="CSS" that can be used when defining those elements and/or attributes. It designates that specified elements and/or attributes contain JavaScript/CSS code when they are placed inside JavaScript or CSS code, respectively, ie, when their parent element contains JavaScript or CSS code, respectively.

If you are experiencing problems with obfuscated files after you have changed names to new names, but when you don't change any name to new name everything works fine, then there is a problem with certain names(s) that shouldn't be changed to new name(s). If you can't locate which name(s) are causing problems, then you can change names to new names in blocks of 10 or 20 names at the same time and after each iteration you should test the obfuscated code. Eventually you will reach block of 10 or 20 names (which you have obfuscated in the last iteration) where there is a name (or names) that are causing problems. After you have located name(s) that are causing problems you should be able to see reasons for the issues you are having and decide whether or not to obfuscate such name(s) (or their occurrences in strings) or to make some changes to your source code to solve the problem.

When you don't wish to obfuscate some portion of JavaScript/CSS code, or some comments (like copyright notice or conditional compilation statements which are also placed inside JavaScript comments) or whatever part of your file, use Don't obfuscate JavaScript and CSS code inside <JasobNoObfs> elements setting from the File Types dialog box or from the File Settings dialog box and use <JasobNoObfs> elements in your source files to designate such regions. For more information on how to properly use <JasobNoObfs> elements in your source files, see File Types: Don't obfuscate JavaScript and CSS code inside <JasobNoObfs> elements and File Types: Do not obfuscate non-JavaScript/CSS code inside <JasobNoObfs> elements.

Regular expressions can be placed inside / and / characters, like /^(Chapter|Section) [1-9][0-9]{0,1}$/gm. There is a limitation in Jasob that if there is </ combination of characters in JavaScript string, then / character in this combination won't be treated as the beginning of a regular expression. This is because JavaScript strings often contain HTML elements where </ is used to designate a closing tag (like </div>). If you have such regular expressions inside JavaScript strings, like var strStringCode = "if (strSub < /Chapter [^1-5]/gm.exec(strText)) alert(strMessage);"; just make sure that there is at least 1 blank character (space) between < and / characters and then character / will be treated as the beginning of a regular expression.

When obfuscating CSS code, there is a limitation in Jasob that doesn't allow characters { } [ ] to be used anywhere else in CSS code except as defined by CSS itself. For example, the following CSS code works well after obfuscation: .style1 {background:beige url(sphere.jpg) no-repeat top center} while the following CSS code may not work properly after obfuscation: .style1 {background:beige url(sphere{1}.jpg) no-repeat top center} (please note { and } characters in the specified picture URL that may cause problems with the obfuscated CSS code).

To save file settings and changes for names in name lists, see The Jasob Project, The Web Site Settings and The Names Bag.

NOTE: To enable detailed error messages in Internet Explorer (showing line and character numbers where error appears), make sure that options "Disable script debugging" and "Display a notification about every script error" are both checked. Choose Tools > Internet Options... > Advanced tab to get to those options.

If this doesn't help, please contact us at support@jasob.com.


Frequently Asked Questions

Q. | It is not possible to change settings from the File Types dialog (Obfuscate > File Types... command from the main menu) when I already have some source files opened or a project saved. Why not? I mean, you can change it, but it does not have kind of effect!
A. | Settings on the File Types dialog (Obfuscate > File Types... command from the main menu) are used only when a source file is initially opened with Jasob. After that, those initial settings become individual for each opened file and are saved with the Jasob project (or Web site settings). To change settings for a file which has already been opened in Jasob, right-click a file in the project files list and choose Settings... from the context menu. The File Settings dialog will appear allowing you to change file settings. This way you can have totally different settings even for the files of the same file type, which is required in some cases. If you have a Jasob project (or Web site settings) and wish to change settings for certain files, open that project (or apply Web site settings) and then right-click files you wish to change settings for in the project files list and choose Settings... from the context menu. After you have made the changes, save your Jasob project (or Web site settings) again.
Q. | Is there a way to obfuscate files without removing white space characters to be able to find possible errors in a debugger?
A. | Yes, you can choose whether you wish to not remove white space characters from JavaScript, CSS and non-JavaScript/CSS code (like HTML for example) for the desired file. To not remove white space characters from the obfuscated code, right-click file in the project files list and choose Settings... from the context menu. The File Settings dialog will appear where on the Client Side JavaScript and CSS Code tab you will see Remove white space in JavaScript code and Remove white space in CSS code options where you should uncheck the appropriate option. On the same dialog, but on the Other tab there is Remove white space in non-JavaScript/CSS code option which you should uncheck if you wish to not remove white space characters from the non-JavaScript/CSS code (like HTML for example).
Q. | I am trying to use Jasob, however the approach is a bit more of a component development where all of the global variables should not be changed and all function parameter names and local variables should be obfuscated. Is it possible to do such a thing?
A. | If you are using Jasob GUI, then after you have analyzed the files look at the Status column in name lists. It contains various information for each name. The G (Global) status flag designates whether a name is global. The G status flag is set automatically when there is at least one name occurrence found outside of any function. So, global names (variables, functions...) have G status flag, all other names are local. You can group names in a name list by G (Global) status flag by choosing Group By > Status > Global from the name list context menu and then quickly mark or unmark for obfuscation names in each group. For more information on available status flags, see Starting the Analysis: The Status Column. When working with Jasob command-line, you can unmark for obfuscation global names by specifying the /unmarkglobal command-line parameter. For more information on command-line obfuscation, see Command-Line Parameters. Also make sure you have checked Example: How to Obfuscate a DHTML Component.
Q. I am using the trial version and am seriously considering buying Jasob until I came across this. Part of my JavaScript code looks like the following:

var adTitle = "[adTitle]";
var adTarget = "[adTarget]";
var leftImg = "[leftImg]";
var rightImg = "[rightImg]";
var nextPage = "hello.aspx";

Yes I want to obfuscate those variables and generate new names. The problem is that after obfuscation the obfuscated code looks like this:

var aZ="[aZ]";var ba="[ba]";var aN="[aN]";var aR="[aR]";var bf="bf.aspx";

which is dead wrong! It should look like:

var aZ="[adTitle]";var ba="[adTarget]";var aN="[leftImg]";var aR="[rightImg]";var bf="hello.aspx";

Am I using the software wrongly?
A. With Jasob you can control how you wish to obfuscate JavaScript strings. There are few options:

1. You can completely turn off string obfuscation for a certain file by right-clicking that file in the project files list and by choosing Settings... > Client Side JavaScript and CSS Code tab from the context menu and then make sure both Obfuscate all names in JavaScript strings that are found in JavaScript code and Obfuscate all JavaScript strings as JavaScript code options are unchecked. For more information on string obfuscation options, see File Types: The Client Side JavaScript and CSS Code.

2. When you want to obfuscate strings inside the same file differently, you should use <Jasob... > elements in your source files to designate regions where strings should or shouldn't be obfuscated. For example, to solve your problem you can insert <JasobNoObfsStr> element in your source code to prevent Jasob from obfuscating strings in that region, like this:

// <JasobNoObfsStr>
var adTitle = "[adTitle]";
var adTarget = "[adTarget]";
var leftImg = "[leftImg]";
var rightImg = "[rightImg]";
var nextPage = "hello.aspx";
// </JasobNoObfsStr>

This way, only variables will be obfuscated in the specified region while strings will stay as they were in the original code. For more information on string obfuscation options and other <Jasob... > elements used with string obfuscation, see File Types: The Client Side JavaScript and CSS Code.

3. You can mark or unmark for obfuscation each individual name occurrence in a string by right-clicking name in a name list and by choosing In Strings... from the name list context menu. A dialog will appear showing occurrences in strings for the selected name where you will be able to mark or unmark some (or all) of them for obfuscation.
Q. | I'm having problems getting it to work as I expect it to. If the obfuscation process is changing the values of ID attributes in HTML documents, it should also make the same changes to all related document.getElementById("elementID") references in the associated .js files. And yet I can never get Jasob to do this. What settings do I have to make in Jasob in order to change both the values of the ID attributes in the HTML files and the values of the document.getElementById("elementID") references in the .js files?
A. | Jasob should obfuscate values of ID attributes in the associated .js files too, just make sure JavaScript string obfuscation is turned on in Jasob. Please see answer to the previous question that deals with string obfuscation options available in Jasob, except in your case you should use those options to turn string obfuscation on. For example, to designate region in your source code where strings should be obfuscated you would use <JasobObfsStr> element instead of <JasobNoObfsStr> element which turns string obfuscation off for the designated region. For more information on string obfuscation options and other <Jasob... > elements used with string obfuscation, see File Types: The Client Side JavaScript and CSS Code.
Q. | Just wondering if Jasob supports escaping string characters to hexadecimal values? Can’t seem to find that option...
A. Yes, Jasob supports escaping string characters to hexadecimal values. You can actually specify for which strings inside a file you want Jasob to escape characters to hex values and the amount (percentage) of the string characters that should be escaped to hex values. For example, if you want to escape certain amount (percentage) of string characters to hex values for all strings inside a file you can right-click file in the project files list and choose Settings... > Client Side JavaScript and CSS Code tab from the context menu and make sure option Escape random characters in all JavaScript strings when saving is checked. Into the edit box to the right of this option enter the percentage of random string characters that should be escaped to hex values. If you want to escape all string characters to hex values, enter 100 into that edit box. However, most of the time you probably don't want to have the same settings for all strings in a file. In this case, you can use <JasobEscapeStr amount="..."> elements in your source files to designate regions in which string characters should be escaped to hex values by specifying different amount of random string characters that should actually be escaped. For example, to escape 50% of string characters to hex values inside the designated region in a file, the following code can be used:

// <JasobEscapeStr amount="50">
var str = "this is a test";
// </JasobEscapeStr>

Please note that after you have obfuscated your files, string characters will not appear escaped in the file viewer (the Obfuscated tab). This is due to various navigation operations that are available in Jasob GUI. String characters are replaced with their escape sequences when obfuscated files are SAVED, however, additional characters used for escape sequences are included in the statistics for a file immediately after the obfuscation has finished. For more information on escaping string characters to hexadecimal values, see File Types: Escape random characters in all JavaScript strings when saving.
Q. | I have a PHP file which is actually a JavaScript file with some server side PHP code included. I cannot obfuscate such PHP files properly because Jasob treats non server side code in those PHP files as the HTML code instead of the JavaScript code. Is there a solution to this issue?
A. | Sure. This is often the case with certain PHP, ASP, ASP.NET, JSP... files. To obfuscate such files properly, right-click files in the project files list and choose Settings... > Client Side JavaScript and CSS Code tab from the context menu and make sure option Whole file is JavaScript code is checked. You may need to first uncheck In HTML elements, In ASP.NET elements, In JSP elements, In XML elements and In CFML elements options for the Whole file is JavaScript code option to become enabled.
Q. | I have a large .js file which is linked to other ASP.NET pages. The problem is that I don't want to obfuscate all names inside a .js file since some of the JavaScript function names are used by the server side VB.NET code. Can I specify which function names should not be obfuscated in that .js file, or is there some other method to accomplish this?
A. There are few methods in Jasob to exclude certain names (variables or functions) from the obfuscation:

1. After you have opened and analyzed your files in Jasob and name lists are populated with names, you can simply unmark for obfuscation certain names while marking for obfuscation all other names in name lists. After you have successfully obfuscated your files you can save the changes with the Jasob project (or Web site settings). You can then also use that Jasob project (or Web site settings) when working in command-line mode by using /src: and /wss: command-line parameters. For more information on command-line obfuscation, see Command-Line Parameters.

2. To maintain a list of names that have specific settings (marked or unmarked for obfuscation) you should create a names bag and then apply that names bag settings to the names in name lists. To create the names bag, choose Obfuscate > Names Bag... from the main menu and then choose Add... from the names bag context menu to add names to the names bag. Once you have created the names bag, save it to the file by choosing Save from the names bag context menu. Now when you have your names bag with specific settings for certain names, you can initially mark for obfuscation all names in name lists and then apply settings from the names bag to names in name lists. To apply settings from names in the names bag to names in name lists, choose Apply All from the names bag context menu. Alternatively, if you wish to only apply settings for some of the names in names bag, select those names from the names bag and choose Apply from the names bag context menu. For more information on the names bag, see The Names Bag. When working with Jasob command-line, you can use the names bag by using the following command-line parameters: /nb: /nbset [image] /nbget. For more information, see Command-Line Parameters.

3. You can automatically mark or unmark for obfuscation (or select only) names with specific prefixes and/or suffixes by choosing Obfuscate > Mark Names With Prefixes... from the main menu. For more information, see Marking Names for Obfuscation: Marking Names with Prefixes and/or Suffixes. When working with Jasob command-line, you can mark or unmark for obfuscation names with specific prefixes and/or suffixes by using the following command-line parameters: /markprefixes: /marksuffixes: /markprefsuffcs [image] /unmarkprefixes: /unmarksuffixes: /unmarkprefsuffcs. For more information, see Command-Line Parameters.
Q. | Is there a way I can have an exclude list of JavaScript variables and functions that will not be obfuscated?
A. | Yes, you need to create the names bag in order to maintain a list of names with specific settings (marked or unmarked for obfuscation) and then apply that names bag settings to the names in name lists. Please see answer to the previous question for more information on the names bag.
Q. | I want to obfuscate JavaScript code across .js files and in HTML files but don't want to obfuscate values of ID and NAME attributes in HTML documents and where those values are referred to in the JavaScript code (e.g. via document.getElementById("MyIDName") or document.MyFormName.MyFieldName). How do I exclude those from the obfuscation?
A. | You can automatically mark or unmark for obfuscation (or select only) names that are found in certain elements and/or attributes by choosing Obfuscate > Mark Names In Elements... from the main menu. A dialog will appear where, in your case, you should enter "id name" (without quotes) into the Attributes edit box, click the Unmark names radio-button and make sure option Case sensitive comparison is unchecked. For more information, see Marking Names for Obfuscation: Marking Names in Elements and/or Attributes. When working with Jasob command-line, you can mark or unmark for obfuscation names that are found in certain elements and/or attributes by using the following command-line parameters: /markelements: /markattributes: /markelemattrcs [image] /unmarkelements: /unmarkattributes: /unmarkelemattrcs. For more information, see Command-Line Parameters.
Q. | I don't want Jasob to process certain parts of my code. How can this be done?
A. To exclude parts of your code from the analysis and obfuscation you should use <JasobNoObfs>...</JasobNoObfs> elements in your files to designate such regions, like:

// <JasobNoObfs>
...
... JavaScript code that is excluded from the analysis and obfuscation
...
// </JasobNoObfs>

If you wish to also remove that code completely from the obfuscated file, use the remove attribute with <JasobNoObfs> element and set its value to true, like <JasobNoObfs remove="true">...</JasobNoObfs>. When using <JasobNoObfs> elements in your files you should make sure option Don't obfuscate JavaScript and CSS code inside <JasobNoObfs> elements is checked for a file. To access this option, right-click file in the project files list and choose Settings... > Client Side JavaScript and CSS Code tab. Beside excluding parts of the code from the analysis and obfuscation by using <JasobNoObfs> elements, you can also exclude/include the whole file by right-clicking file in the project files list and checking/unchecking the Excluded option. For a complete list of <Jasob... > elements that can be used in source files, see Jasob Elements for Source Files.
Q. | I have custom tags in my ASP.NET files, such as <asp:mycustomcomponent jsonclick="MyCustomJSFunction_OnClick"> ... </asp:mycustomcomponent> which contain JavaScript code in some attribute values. Can I obfuscate that JavaScript code also?
A. | Yes. You have to specify which ASP.NET elements and/or attributes contain JavaScript code and then Jasob will analyze and obfuscate that content as well. To define ASP.NET elements and/or attributes that contain JavaScript code choose Obfuscate > Options... > ASP.NET tab from the main menu. Right-click the ASP.NET elements list on the Options dialog and choose Add... from the context menu. A dialog will appear where, in your case, you should enter "asp:mycustomcomponent" (without quotes) into the Elements edit box and "$serverSide='true' jsonclick" (without quotes) into the Attributes edit box and click the OK button. You should actually add all custom ASP.NET elements and/or attributes that contain JavaScript code in your ASP.NET files to the ASP.NET elements list on the Options dialog. For more information, see The ASP.NET.
Q. | I use Smarty, which uses the .tpl file extension for its HTML templates. Smarty variables are placed inside {$ ... } characters and they must be left unchanged. Can I tell Jasob to treat .tpl files like HTML files?
A. | Yes you can. You need to add Smarty file type (.tpl) to Jasob so Jasob will be able to open and process such files. To do so, choose Obfuscate > File Types... from the main menu. On the File Types dialog, click the New... button. A dialog will appear where you should enter "Smarty Files" (without quotes) into the Filter description edit box and from the Filter template combo box choose HTML Files since Smarty files are very similar to HTML files. After you click the OK button, the Smarty Files filter will be added to the File Types dialog where (for the Smarty Files filter) you should enter "*.tpl" (without quotes) into the File extensions edit box (overwriting existing text there if it exists) and make sure option Inside {$ ... } is checked on the Server Side Code tab. Click the OK button on the File Types dialog and you are now ready to open Smarty files with Jasob.
Q. How can I add XUL files to Jasob, is it possible at all? I've managed to add a file type for .xul file extension, but the JavaScript code is not obfuscated, like in the following oncommand attribute:

<?xml version="1.0"?>
<overlay>
<script type="application/x-javascript" src="commands.js" />
<commandset>
<command id="Highlight" oncommand="commandHighlightWords();" />
</commandset>
</script>
</overlay>
A. | Please see answer to the previous question on how to properly add a new file type to Jasob, except in your case you will be adding the XUL Files that are based on the XML Files filter template and without making any changes to the Server Side Code tab on the File Types dialog. After you have added the XUL file type to Jasob, you need to specify where JavaScript code is placed inside XUL files. To do so, make sure option In XML elements is checked on the Client Side JavaScript and CSS Code tab on the File Types dialog (for the added XUL file type). Now you need to define XML elements and/or attributes inside XUL files that contain JavaScript code by choosing Obfuscate > Options... > XML tab from the main menu. Right-click the XML elements list on the Options dialog and choose Add... from the context menu. A dialog will appear where, in your case, you should enter "command" (without quotes) into the Elements edit box and "oncommand" (without quotes) into the Attributes edit box and click the OK button. You should actually add all XML elements and/or attributes that contain JavaScript code in XUL files to the XML elements list on the Options dialog. For more information, see The XML. Click the OK button on the Options dialog and you are now ready to open XUL files with Jasob.
Q. | I have a server side parser that doesn't like very long lines (8192 characters max per each line). Can I restrict Jasob to create obfuscated code lines that do not exceed a given length?
A. | Yes, you can limit obfuscated code line length by specifying maximum number of characters each obfuscated code line can contain. To do so for the desired file, right-click file in the project files list and choose Settings... > Other tab from the context menu and make sure option Limit obfuscated code line length is checked. Into the Maximum line length edit box enter the maximum number of characters each obfuscated code line can contain.
Q. | Basically I have written my own .NET http request handlers and have a few classes that generate JavaScript code to be sent to the browser. When I load the C# file into Jasob, I can't seem to get it to recognise the JavaScript within the quotes.
A. | Jasob doesn't obfuscate server side code directly. To make your C# code work you need to use variables for JavaScript names that you are using in your C# strings. After the obfuscation has finished, you have to replace those original C# variable values with obfuscated names. You can automate this process by using Jasob. For more information, see Obfuscating Dynamic Web Pages.
Q. I have an obfuscation problem with some PHP files that generate JavaScript code to be sent to the browser. For example, some PHP files have the following line:

<?php echo "<div onclick=\"test_function();\">"; ?>

The test_function is referenced in an external .js file, which is correctly obfuscated (i.e test_function is replaced by aa for example), while in the PHP code the function isn't replaced by aa.
A. | Jasob doesn't obfuscate server side code directly. To make your PHP code work you need to use variables for JavaScript names that you are using in your PHP strings. After the obfuscation has finished, you have to replace those original PHP variable values with obfuscated names. You can automate this process by using Jasob. For more information, see Obfuscating Dynamic Web Pages.
Q. I would like to obfuscate a general purpose JavaScript files (similar to AJAX) that define a series of objects, methods and properties. What I would like to have are two security levels regarding the obfuscation:

- Level 1 (development stage) - Developers should be able to interface to these objects and debug obfuscated code without having to obfuscate the whole project.

- Level 2 (production release) - After development is complete, the whole project is obfuscated and all JavaScript names are obfuscated for total security.

Could you explain how this might be done?
A. | You can have two Jasob projects for the same JavaScript files, the development project and the release project and then have different settings with each of the projects. For example, in the development project you could choose not to remove JavaScript comments and white space characters while in the release project you could turn on those options. You could also choose not to obfuscate certain names in the development project while obfuscationg all names in the release project. The same also applies if you are obfuscating the Web site, in which case you would use two different Web site settings files for the same Web site.
Q. | I'm using an ActiveX control with the JavaScript code. After the obfuscation the JavaScript code doesn't work properly with the ActiveX control. Is there a solution to this?
A. | Yes, the point is that AciveX object names, their properties, methods and events cannot be obfuscated in the JavaScript code since those are internal to the ActiveX objects. To handle ActiveX objects with Jasob, you should add ActiveX object names and their properties, methods and events to the system names. System names are reserved JavaScript and CSS names that cannot be obfuscated and as such don't appear in name lists. To maintain a list of system names, choose Obfuscate > Options... > System Names tab from the main menu. For more information on system names, see System Names. After adding object names, properties, methods and events for ActiveX controls that you are using in your JavaScript code, your obfuscated code should work correctly because valid ActiveX object names, properties, methods and events will be preserved in the obfuscated code.
Q. | In my JavaScript code I have a function with n name, like function n(par1, par2). When I try to obfuscate the code I cannot obfuscate that function name, I mean there's no that n in name lists. Why?
A. | When obfuscating JavaScript code not all names can be obfuscated. There are certain JavaScript and CSS reserved words, properties, methods... that cannot be changed in order to not break the obfuscated code. In Jasob, those names are called system names and, in your case, n happens to be on the system names list. The system names list can be modified. To maintain a list of system names, choose Obfuscate > Options... > System Names tab from the main menu. For more information on system names, see System Names.
Q. | I'm trying to obfuscate my JavaScript code with Jasob but the obfuscated code doesn't run and has errors. Is this normal? Do you provide consulting to help me obfuscate my files?
A. This could happen in certain cases because of the inappropriate settings in Jasob, but it can all be fixed by following these steps:

1. Obfuscate your files without obfuscating (renaming) any names and without removing white space characters. Only use the setting in Jasob to remove comments from the obfuscated code. If you are seeing errors when running the obfuscated code in the Web browser, navigate to the location where Web browser reports an error in your file and it should be easy to identify the problem and perhaps adjust the source code a little.

2. Use the setting in Jasob to remove white space characters from the obfuscated code and obfuscate your files again. Run the obfuscated code in the Web browser and if there is an error navigate to the location where Web browser reports an error in your file to identify the problem. When removing white space characters from the obfuscated code Jasob automatically inserts the semicolon character (;) into the obfuscated JavaScript code where it is needed. Despite this, if your Web browser reports an error of the missing semicolon (;) character, insert the semicolon (;) character into the original JavaScript code where it is required.

3. Now you can start marking names in name lists for obfuscation. You have to be aware that which names in name lists can be marked for obfuscation highly depends on the JavaScript code you are obfuscating. You can mark for obfuscation only names for which Jasob has access (opened files) to every code fragment where those names are used. Sometimes those are actually all names in name lists but sometimes they are not, for example if you are using an ActiveX control then you cannot mark for obfuscation names related to that ActiveX control, like its property names or method names. Another example would be when you are obfuscating some of your .js files but not all of them which work together, where you obviously cannot mark for obfuscation names that are also used in those other .js files which you are not obfuscating. You should also make sure that JavaScript code fragments are properly recognized by Jasob in all opened files, like in <script> elements and in some attribute values in HTML code for example. If you are uncertain which names can be marked for obfuscation, you can use the iterative process by marking names in name lists in chunks of let's say 20 names at the time, obfuscating files and then testing them. In case of an error you would know that there is a problem with some name within the last chunk of marked names and then by narrowing that chunk of marked names and testing the obfuscated files you will eventually reach the name that is causing problems. You can then choose to simply unmark that name for obfuscation or you may slightly modify your source code to allow for that name to be marked for obfuscation too once you have figured out what was the problem with that name. You can highlight (and navigate to) all name occurrences in source and obfuscated code by right-clicking name in a name list and by choosing Go To Source from the name list context menu. For more information on how to navigate to names and their occurrences in the code, see Navigating to Names.

4. Please read also other Q & A in this FAQ as there you may find other useful information that may help you solving the problems you might have, like for example, questions related to obfuscation of the name occurrences in strings or questions related to obfuscation of dynamic Web pages.

5. You are welcome to send us your code examples you are having problems with and we will help you obfuscate your files. Send your code examples to trialsupport@jasob.com or support@jasob.com.
Q. | I wonder if JavaScript code using Mac Safari's DOM can be obfuscated with Jasob?
A. | Yes. If there are some reserved words, properties, methods... specific to Mac Safari's DOM which cannot be obfuscated you should check whether they exist on the system names list in Jasob. System names are reserved JavaScript and CSS names that cannot be obfuscated. You can add new or edit existing system names. To maintain a list of system names, choose Obfuscate > Options... > System Names tab from the main menu. For more information on system names, see System Names.
Q. | I am using the trial version and have noticed some comments that Jasob inserts into the obfuscated code. Is this also in the licensed version?
A. | No. After the Jasob license is purchased Jasob trial messages are no longer inserted into the obfuscated code.
Q. I am trying to use Jasob from the command-line by using the following commands:

start /wait "" jasob.exe /src:"D:\Sources\Test\*.js"
or
start /wait "" jasob.exe /src:"D:\Sources\Test\FileA.js" "D:\Sources\Test\FileB.js"

but none of the commands works. What am I doing wrong?
A. | When obfuscating files by using the command-line you have to use the /src: command-line parameter to specify files you wish to obfuscate. With the /src: command-line parameter you may either specify the Jasob project (.jsbp file) or the Web site (folder) you wish to obfuscate. In your case, you can first create a Jasob project for the files you wish to obfuscate by using the Jasob GUI and then use that project (.jsbp file) with the command-line /src: parameter. Or, you can also create a separate folder and copy files you wish to obfuscate to that folder and then specify that folder with the command-line /src: parameter. If you are obfuscating a Web site (or individual files inside the specified folder), use /destfolder: parameter to specify folder where obfuscated Web site will be saved. For complete explanation of the command-line obfuscation process and available command-line parameters you should see Command-Line Parameters before actually doing any command-line obfuscation.
Q. I am using the following command-line to obfuscate the Jasob project:

start /wait "" jasob.exe /src:"E:\MyFolder\MyProject.jsbp" /destfolder:"E:\OutputFolder"

but after the obfuscation has finished the destination folder (E:\OutputFolder) is empty. Why?
A. | The command-line parameter /destfolder: is used when obfuscating Web sites. When obfuscating Jasob projects, obfuscated files are saved to the obfuscated file names that are saved with the Jasob project (.jsbp file). To change locations where obfuscated files are saved, open your project with Jasob GUI, obfuscate files and then save those obfuscated files to the locations where you wish (by right-clicking files in the project files list and by choosing Save Obfuscated As... from the context menu) and then SAVE your Jasob project. After that, when you will be using that Jasob project with the command-line again, obfuscated files will be saved to different locations (as specified in the project for each individual project file). It is recommended to use the /log: command-line parameter (like /log:JasobLog.txt) which allows you to create the obfuscation log in which you can find full paths of the saved obfuscated files.
Q. | I have a Jasob project and have marked for obfuscation several names inside it. When I use this project with Jasob GUI I get correct results but when I use the same project with command-line the results are not the same. I have found out that when using this project with command-line there are also some other names marked for obfuscation. I only want to mark for obfuscation names that are marked for obfuscation inside the project, what should I do?
A. | This can happen when your project source files have been modified after the project (.jsbp file) has been last saved. As the result of the modifications you have made to your source files, additional names can emerge that don't yet exist in the current project (.jsbp file) and when obfuscating such project with the command-line those additional names get marked for obfuscation automatically. However, you can choose to not mark for obfuscation those additional names that don't exist in the project by specifying the /nomarkall command-line parameter. The same is also true when obfuscating the Web site from the command-line and using Web site settings. Here you can also prevent Jasob from automatically marking for obfuscation additional names that don't exist in the specified Web site settings (.jsbw file) by using the /nomarkall command-line parameter. For complete explanation of the command-line obfuscation process and available command-line parameters, see Command-Line Parameters.
Q. | Is there a command-line parameter that will allow me to not remove white space characters from the obfuscated files when obfuscating the Jasob project?
A. | Settings for removing white space characters are individual for each file that is part of the project. In order to have different settings for the project files you would need to create another Jasob project (with different settings) for the same files you wish to obfuscate and then use that project when working with Jasob command-line.
Q. | I was just wondering if there was any way to combine multiple .js files automatically?
A. | Yes, you can use Jasob to merge any number of specified files of any file type into a single file by using the /merge command-line parameter. When using the /merge command-line parameter, no other command-line parameters may be used except the /log: parameter. Files to be merged must follow after the /merge parameter. The last file specified is considered to be the combined file name. When creating the combined file, Jasob takes into account file encodings and inserts line break (CRLF) characters at the end of each separate file. For more information, see Command-Line Parameters.
Q. | I cannot see the Jasob User's Guide (JasobUsersGuide.chm file) properly. When I open it, the right-hand pane shows "Navigation to the webpage was canceled" error message. What's wrong?
A. | This could happen because of the Windows security feature introduced in Windows XP SP2 that exists in Windows Vista also. To solve the problem, righ-click the JasobUsersGuide.chm file in Windows Explorer and choose Properties from the context menu and then on the General tab click the Unblock button. The JasobUsersGuide.chm file is located in the Help folder of the Jasob installation folder (usually in the C:\Program Files\Genesis Mobile\Jasob 4.1\Help folder). If you are still unable to see the Jasob User's Guide properly please search the Internet for other known HTML Help issues.