Can't make it work

[ramsestom]

Hi
I am trying to use this module. I created the rn-cli.config.js and transformer.js file in my project root folder and kept the default obfuscatingTransformer options (So module.exports = obfuscatingTransformer({})).
But this doesn't seem to work. The index.android.bundle file in the generated app-release.apk still remains unobfuscated (I performed a gradlew assembleRelease like usual to create the bundle before
react-native run-android --variant=release)
What am I doing wrong?

[ds300]

Hi @ramsestom !

By default, this transformer only obfuscates files in your src directory, but leaves node_modules untouched. If you inspect the bundle, it may look unobfuscated for the most part, since such a large portion of it will come from node_modules. If your project-specific files are indeed also unobfuscated, I'm happy to offer more help.

[ramsestom]

I checked and my project-specific code is also unobfuscated in the bundle.
Actually I am not sure that the rn-cli.config.js file is correctly checked by the packager because there seems to be issues with it: facebook/react-native#12133 . Is there a simple way to check that the obfuscator is actually called?
I am using RN version 0.53.3 (will try to update to 0.54). What version do you use?

[tombailey]

I have tested this with "react-native": "^0.55.2" and it seems to work okay.

Note that I didn't use gradlew assembleRelease but instead
react-native bundle --platform android --dev false --entry-file index.android.js --bundle-output android/app/src/main/assets/index.android.bundle --assets-dest android/app/src/main/res

[zenz]

not work for me either,
React-Native 0.55.4, no script obfuscated.

[Nantris]

No obfuscation as far as I can tell here.

[wangghon]

Same as us, no obfuscation on our specific code.

[imelos]

same here

[marcorm]

same here :(

"react": "16.6.0-alpha.8af6728",
"react-native": "0.57.4",

did anyone of you found at least a workaround?

[horsewin]

same here...

These are my setting below.

    "react": "^16.5.0",
    "react-native": "0.57.8",

// transformer.js
const obfuscatingTransformer = require("react-native-obfuscating-transformer");
const typescriptTransformer = require("react-native-typescript-transformer");

module.exports = obfuscatingTransformer({
  upstreamTransformer: typescriptTransformer,
});

// rn-cli.config.js
module.exports = {
  getTransformModulePath() {
    return require.resolve('react-native-typescript-transformer');
  },
  transformer: {
    babelTransformerPath: require.resolve("./transformer")
  },
};

i execute this command, but no diff are shown before no obfuscation.

react-native bundle --platform android --dev false --entry-file index.js --bundle-output android/app/src/main/assets/index.android.bundle --assets-dest android/app/src/main/res

[varunjithtk22]

I have tested this with "react-native": "^0.55.2" and it seems to work okay.

Note that I didn't use gradlew assembleRelease but instead
react-native bundle --platform android --dev false --entry-file index.android.js --bundle-output android/app/src/main/assets/index.android.bundle --assets-dest android/app/src/main/res

Can you please provide the steps you followed.

[lorenc-tomasz]

The same on 0.59.10. Tried the above method as well.

[zenz]

The same on 0.59.10. Tried the above method as well.

With react-native hermes engine, I think you don't need obfuscator any more. it's compiled to bytecode.

[lanjinglingxx]

hermes engine just work in android,but what ios can do

Hey guys I would suggest to use https://github.com/javascript-obfuscator/javascript-obfuscator directly on your bundle. It will make obfuscation more efficient in sense that it will obfuscate code so much more... But probably at cost - your app will be more slow.

Also note that for ios you will be able to get it work, but for android with hermes enabled I am not sure how to done it at the moment. Also note that with hermes it is true that result bundle is some kind of bytecode but big portion of strings are not "obfuscated" by hermes in our case...

[AustinZuniga]

I finally figured out how to make it work after several test.

my react and react native version:

 "react": "16.9.0",
 "react-native": "0.61.5",

install other dependencies needed:

npm install babylon --save
npm install --save babel-traverse

transformer.js

const obfuscatingTransformer = require("react-native-obfuscating-transformer")
const filter = filename => { 
  return filename.startsWith("src");
};

module.exports = obfuscatingTransformer({
// this configuration is based on https://github.com/javascript-obfuscator/javascript-obfuscator
  obfuscatorOptions:{
    compact: true,
    controlFlowFlattening: false,
    deadCodeInjection: false,
    debugProtection: false,
    debugProtectionInterval: false,
    disableConsoleOutput: true,
    identifierNamesGenerator: 'hexadecimal',
    log: false,
    renameGlobals: false,
    rotateStringArray: true,
    selfDefending: true,
    shuffleStringArray: true,
    splitStrings: false,
    stringArray: true,
    stringArrayEncoding: false,
    stringArrayThreshold: 0.75,
    unicodeEscapeSequence: false
  },
  upstreamTransformer: require('metro-react-native-babel-transformer'),
  emitObfuscatedFiles: false,
  enableInDevelopment: true,
  filter: filter,
  trace: true
})

metro.config.js

module.exports = {
  transformer: {
    getTransformOptions: async () => ({
      transform: {
        experimentalImportSupport: false,
        inlineRequires: false,
      },
    }),
    babelTransformerPath: require.resolve("./transformer")   // add here the transformer.js
  },
};

NOTE:

set emitObfuscatedFiles to true in obfuscatorOptions to emit the obfuscated versions of files alongside their originals, for comparison.

If you're building in release, you can also compare the generated index.android.bundle (located in \android\app\build\generated\assets\react\release) with and without using the react-native-obfuscating-transformer using online diff tool to see the difference