Source codes protection

[mb]

Is there a way to package the application so its source codes are not accessible from outside? You know, for commercial use and such.

[Tim Caswell]

You can hide your javascripts inside a zip and concatenate that with the nw binary.  It's not impossible to get at if the hacker knows it's node-webkit.  Most off-the-shelf unzip tools will be able to get at the contents prety easily.

You can obfuscate your javascript using a js compresser like uglify-js before putting it in the zip and it will be much harder to understand.

This last weekend I accidentally discovered a great way to obfuscate code by writing the logic in lua, compiling to bytecode (binary blobs) and then running the lua bytecode in node or browser contexts using a lua vm I wrote.  This has the down-side that you have to write the code you want to protect in lua and involve a compile step, but it will be much harder for anyone to ever understand the code.

For example, the following factorial module:

local function fact (n)

  if n == 0 then

    return 1

  else

    return n * fact(n-1)

  end

end

return fact

Would be stored as the following 83 binary bytes in your node-webkit app.

00000000  1b 4c 4a 01 02 37 00 01  03 01 00 02 0b 09 00 00  |.LJ..7..........|

00000010  00 54 01 03 80 27 01 01  00 48 01 02 00 54 01 05  |.T...'...H...T..|

00000020  80 2b 01 00 00 15 02 01  00 3e 01 02 02 20 01 01  |.+.......>... ..|

00000030  00 48 01 02 00 47 00 01  00 00 c0 00 02 14 03 00  |.H...G..........|

00000040  01 00 01 00 03 31 00 00  00 30 00 00 80 48 00 02  |.....1...0...H..|

00000050  00 00 00                                          |...|

00000053

Which would be decoded by my luavm to the something like the following javascript:

function fn0($0) {

  var $, $$, $1, $2;

  var state = "0";

  for(;;) {

    loop: switch(state) {

    case "0":

      if ($0 !== 0) { state = "5"; break loop; }

      $1 = 1;

      return [$1];

      state = "a"; break loop;

    case "5":

      $2 = $0 - 1;

      $ = arr($1($2));

      $1 = $[0];

      $ = undefined;

      $1 = $0 * $1;

      return [$1];

    case "a":

      return [];

    }

  }

}

function fn1() {

  var $, $$, $0;

  $0 = fn0.bind(this);

  return [$0];

}

(note I haven't yet implemented closures so this particular example doesn't work yet. I did just start writing this vm 3 days ago)

See my new vm at https://github.com/creationix/brozula