CODEWITHSUNDEEP
javascriptobfuscation
Marc
Marc

Reputation: 6771

Does obfuscated javascript slow a browser down?

I have a script which is obfuscated and begins like this:

var _0xfb0b=["\x48\x2E\x31\x36\x28\x22\x4B\x2E

...it continues like that for more then 435.000 chars (the file has 425kB) and in the end this is coming:

while(_0x8b47x3--){if(_0x8b47x4[_0x8b47x3]){_0x8b47x1=_0x8b47x1[_0xfb0b[8]]( 
new RegExp(_0xfb0b[6]+_0x8b47x5(_0x8b47x3)+_0xfb0b[6],_0xfb0b[7]),
_0x8b47x4[_0x8b47x3]);} ;} ;return _0x8b47x1;} 
(_0xfb0b[0],62,2263,_0xfb0b[3][_0xfb0b[2]](_0xfb0b[1])));

My question is: Isn't it way harder for a browser to execute that compared to a not-obfuscated script and if so, how much time I'm probably loosing because of the obfuscation? Especially the older browsers like IE6 which are really not that performant in JS must spend a lot more time on that, right?

Upvotes: 3

Views: 2015

Answers (3)

Ryan Kempt
Ryan Kempt

Reputation: 4209

It certainly does slow down the browser more significantly on older browsers (specifically when initializing), but it definitely slows it down even afterwards. I had a heavily obfuscated file that took about 1.2 seconds to initialize, unobfuscated in the same browser and PC was about 0.2 seconds, so, significant.

Upvotes: 4

Ira Baxter
Ira Baxter

Reputation: 95400

It depends on what the obfuscator does.

If it primarily simply renames identifiers, I would expect it to have little impact on performance unless the identifier names it used were artificially long.

If it scrambles control or data flow, it could have arbitrary impact on code execution. Some control flow scrambling can be done with only constant overhead.

You'll have to investigate the method of obfuscation to know the answer to this. Might be easier to just measure the difference.

Upvotes: 3

DanRedux
DanRedux

Reputation: 9359

The obfuscation you're using seems to just store all string constants into one array and put them into the code where they originally were. The strings are obfuscated into the array but still come out as string. (Try console.log(_0xfb0b) to see what I mean).

It does, definitely, slow down the code INITIALIZATION. However, once that array has been initialized, the impact on the script is negligible.

Upvotes: 2

Related Questions