0

I am experimenting with 'hiding' my JavaScript code in such a way that if I were to make a library and share it, users could not see the implementation of functions. Out of curiosity, I tried doing the following:

console.log(Math.abs.toString());

This is what's logged to console:

function abs() { [native code] }

I want to know if the Math.abs source is accessible. My reason for wanting to know this directly ties to my second part of the question: how did the developers implement the behavior shown by this code, and if there are other ways to see implementations that are hindered, how were those hinderances implemented? Perhaps I wrote this in a confusing way, but basically I want to hide implementation of my functions, and it seems like the native Math library may be source for inspiration.

So, if I write the following code:

const behindTheScenes = a => {
    a *= 2;
    return a;
};
console.log(behindTheScenes.toString());

The following is logged to the console:

a => {
    a *= 2;
    return a;
}

This is what I expected, but I desire the log statement to not show this code. Let's imagine a *= 2 is a super secret thing I came up with myself.

Now, I've tried the following:

const behindTheScenes = a => {
    a *= 2;
    return a;
};
behindTheScenes.constructor.prototype.toString = () => {};
console.log(behindTheScenes.toString());

The following is logged to the console:

undefined

This is about what I expected. However, I do not know if this is the best solution. By that I mean, perhaps

  1. this solution is not foolproof
  2. it is not how the Math.abs behavior is implemented.

Also, I do not know exactly how to implement this in the file structure and such. You see, I am a student who is relatively new to JavaScript. All my coding using the language has been on the Codecademy website. That being said, when I'm using an IDE, would I put the behindTheScenes.constructor.prototype.toString = () => {} line in the file in which behindTheScenes is defined?

I recognize that this use of 'file' and 'IDE' may not even make sense in the context of making a library, but again I simply am unexperienced, so please excuse this and answer my questions with the vocabulary which makes sense in the context.

Anyway, it may be that functions like Math.abs can be found on chrome's engine code Github or Firefox's engine code. But I do not know how to navigate these pages.

VLAZ
  • 26,331
  • 9
  • 49
  • 67
Keith Rubin
  • 1
  • 2
    "*I want to hide implementation of my functions*" - you can't, really. Who are you trying to hide it from and why? – Bergi Aug 13 '23 at 00:35
  • The `Math` library is not written in Javascript. It's written in C or C++, embedded in the interpreter. The same is true for most of the built-in libraries. That's the only way to get performance. – Tim Roberts Aug 13 '23 at 00:37
  • 2
    Yes, it can be found in the V8 engine source code, in particular [here](https://github.com/v8/v8/blob/1db97e57290873fbe50b6115ea38f7ef2ee1854c/src/builtins/math.tq#L27-L60) (found via [code search](https://github.com/search?q=repo%3Av8%2Fv8+math.abs&type=code)). It's implemented in their own intermediate representation language that the engine's compiler backend will generate native code from. Somewhere else there's code that exposes this builtin code to the runtime as a function on the `Math` object - that's why it's native code, native to the engine, and the native `toString()` knows that. – Bergi Aug 13 '23 at 00:39
  • @Bergi I'm just practicing, so I can only propose a hypothetical. Let's say hypothetically I'm making a web-based video game. I want to make the game open for mod development, but I want to hide, say the physics logic. Why? Maybe it's some revolutionary stuff, and I want to be the only developer who knows how to do what I did. With that, do you have an idea for how I can achieve 'hiding' certain functional implementations? – Keith Rubin Aug 13 '23 at 01:58
  • 1
    @KeithRubin You can't run JavaScript code in the user's (player's) browser without that user being able to see that code. You can [obfuscate it](https://stackoverflow.com/q/194397/1048572) (make it harder to read and understand), but ultimately the code needs to get to the user so they can run it. As to running extension code in your game without the extension being able to access your physics engine (code) is possible by locking down the environment and/or executing the extension code in its own environment, but ultimately the mod developers will be players too and read your code. – Bergi Aug 13 '23 at 02:05
  • @Bergi What does 'locking down the environment' and 'executing the extension code in its own environment' mean? – Keith Rubin Aug 13 '23 at 02:10
  • @KeithRubin Basically, overwriting `toString()` on the function like you did, and preventing the extension code from working around it. This question is also discussed by security researches regarding the execution of untrusted js code in general, see e.g. https://github.com/endojs/endo/blob/master/packages/ses/README.md – Bergi Aug 13 '23 at 02:23

0 Answers0