使用ConfuserEX自动混淆应用构建输出的技术问询

Got it, let's work through this. You've built an app that lets users click a button to generate files, with the source code stored in your app's resources. The problem is you need to obfuscate the final output files after they're built—but all the resources you've found so far only talk about obfuscating during the build process itself, not the end result. Here's how to fix that:

First, don't try to mix obfuscation into the build logic directly. Have your build process first write the unobfuscated output to a temporary folder. Keeping these steps separate makes debugging easier and ensures a failed obfuscation doesn't wreck a valid build.

The right tool depends on what kind of files you're generating:

• JavaScript/TypeScript: Use tools like Terser or JavaScript Obfuscator. You can call their APIs directly from your app post-build. For example (if your app uses Node.js):

  const obfuscator = require('javascript-obfuscator');
  const fs = require('fs');
  
  // Read the freshly built unobfuscated file
  const rawOutput = fs.readFileSync('./temp/build-result.js', 'utf8');
  // Configure obfuscation settings (tweak these based on your needs)
  const obfuscatedResult = obfuscator.obfuscate(rawOutput, {
    compact: true,
    controlFlowFlattening: true,
    stringArray: true
  }).getObfuscatedCode();
  // Save the obfuscated file to your final destination
  fs.writeFileSync('./dist/obfuscated-app.js', obfuscatedResult);
  

• Python: Tools like PyArmor or pyobfuscate work well. You can run their CLI commands from your app using process execution (e.g., Python's subprocess module).
• .NET Assemblies: Use ConfuserEx or Dotfuscator—both offer APIs you can integrate, or you can trigger their CLI tools after your build completes.
• Other Languages: Look for language-specific obfuscators with either API support or CLI access so you can automate the step.

Add a post-build step to your app that does the following:

• First, confirm the build succeeded (no point running obfuscation on a broken file!)
• Load the unobfuscated output from the temporary location
• Execute your chosen obfuscation tool (via API or CLI)
• Write the obfuscated file to your intended final path
• Optional: Delete the temporary unobfuscated file to clean up

Since your source code is stored as resources, double-check that your build process properly extracts those resources to generate the unobfuscated output. For example, if you have embedded .java files, extract them to a temp directory, compile them to .class files, then obfuscate the compiled output.

Obfuscation can sometimes break functionality if settings are too aggressive. Always test the obfuscated file to make sure it behaves exactly like the unobfuscated version—test all features, edge cases, and error scenarios to avoid surprises.

内容的提问来源于stack exchange，提问作者Tourettes