已关闭特殊情况无法处理的拦截逻辑，可以自由混淆
Cocos 3.x 插件 v3.12.33 商业化深度升级概要支持重复混淆，重复混淆（默认配置的参数）增加的包体大小非常小，对于超大型js文件非常友好
混淆后对整体游戏的性能影响很小（采用强离线智能分析算法对游戏逻辑写法进行的智能深度混淆）
Cocos 3.x Plugin v3.12.33 Commercial Upgrade Summary算是基本上定稿了，兼顾单机离线智能扫描提高代码改写和混淆的性能，提高混淆的复杂度
后期预计内置构建前混淆ts代码的功能逻辑放进去作为高级版本（目前测试中）
本次更新重点完善增包、控制流、废代码、性能和稳定性。
自动授权失败的请联系qq就行
智能AI离线判断改造代码混淆不会影响调制混淆参数，基本稳定，有新BUG请私信即可
Alt+B 可快捷打开操作面板（内有详细介绍参数功能作用）
compact=true 的最终真实单行压缩能力。System.register、CommonJS、AMD、UMD 等模块格式兼容性。compact=true is enabled.System.register, CommonJS, AMD, UMD, and other module formats.compact=true 的真实物理单行压缩能力。System.register 文件无法完成最终收口的问题。EJS_PROCESS_FAILED 的问题。System.register、ESM 与 CommonJS 模块合同保护，避免依赖路径、公开导出及执行结构发生漂移。完善外部 JSON 配置参数执行链，确保字符串数组、字符串分割、控制流、废代码、包装器、调用阈值及 Seed 等参数真实生效。
强化高强度 AST 抗还原能力，新增相邻字符串常量折叠防护及 UTF-16/XOR 运行时解码，阻止多轮压缩后恢复业务明文。
加强标准版与 VIP 终态字符串保护，覆盖 Unicode 业务文本、短 ID、接口路由、令牌及常见敏感字符串，同时保护 Cocos 与模块运行合同。
完善 Browser、Node、CommonJS、ESM、UMD、Worker、小游戏及 System.register 兼容链，失败时自动安全降级，避免未混淆却误报成功。
完成文件、文件夹、ZIP、SourceMap、固定/随机 Seed 及反调试全流程验收；独立 Terser AST 攻击明文恢复为 0，内置发布自检 879/879 全部通过。
Improved the external JSON configuration pipeline to ensure that string arrays, string splitting, control flow, dead code injection, wrappers, call thresholds, seeds, and other parameters take full effect.
Strengthened high-intensity AST deobfuscation resistance with adjacent string constant-folding protection and runtime UTF-16/XOR decoding, preventing sensitive business strings from being recovered after repeated compression.
Enhanced final-stage string protection for both Standard and VIP editions, covering Unicode business text, short IDs, API routes, tokens, and other sensitive strings while preserving Cocos and module runtime contracts.
Improved compatibility across Browser, Node.js, CommonJS, ESM, UMD, Worker, mini-game, and System.register environments, with automatic safe fallback instead of reporting false obfuscation success.
Completed end-to-end validation for files, folders, ZIP archives, SourceMaps, fixed/random seeds, and anti-debugging. Independent Terser AST attacks recovered zero protected plaintext, and all 879 built-in release checks passed.
有需要的兄弟可以看看
修复 Cocos System.register 死代码变量提升遮蔽导入对象的问题，避免模块执行中断及资源加载失败。
强化模块绑定与终态执行审计，确保模块名称、依赖、Setters、Execute 及导出合同保持一致。
完善五档高级恢复链，单档终态失败后继续尝试其余高级方案，全部失败后才允许进入经典回退。
新增文件夹自适应高级预算，消除小文件 1024B 假上限及微文件预算转嫁，几百 KB 至数 MB 文件均按实际结构安全处理。
统一高级与经典产物的失控硬门，透明区分参数目标与安全结构开销；完整自检 885/885、商业门 58/58、微型 System.register 69/69 高级链通过。
Fixed a Cocos System.register issue where hoisted variables from injected dead code could shadow imported objects, interrupt module execution, and cause resource-loading failures.
Strengthened final module-binding and execution audits to preserve module names, dependencies, setters, execution behavior, and export contracts.
Improved the five-stage advanced recovery pipeline so remaining advanced strategies are attempted after a finalization failure, with classic fallback allowed only after full exhaustion.
Added adaptive advanced budgeting for folder processing, eliminating false 1024B limits and micro-file budget transfers while safely supporting files from a few hundred KB to several MB.
Unified runaway-size limits across advanced and classic outputs while clearly separating requested growth targets from required security overhead. All 885 built-in checks, 58 commercial gates, and 69 micro System.register advanced-path cases passed.
大幅强化高级 VIP 字符串保护，新增统一字符串池，进一步减少业务明文暴露。
强化高级 VIP 深度混淆能力，提升属性、成员、模块结构和代码逻辑的隐藏效果。
优化控制流、废代码、字符串拆分、字符串数组等经典混淆能力，执行更加稳定可靠。
强化大型 Cocos Bundle 与二次混淆文件支持，在保持高强度混淆的同时进一步优化性能。
完善高级 VIP 与标准版能力区分，高级版提供更深层的字符串、结构及反分析保护。
完善高级参数、SourceMap、随机种子及旧配置兼容，现有配置可继续直接使用。
Significantly enhanced Advanced VIP string protection with a unified string pool to further reduce exposed business plaintext.
Improved Advanced VIP deep obfuscation for properties, members, modules, and code structures.
Improved the stability of classic obfuscation features including control flow, dead code, string splitting, and string arrays.
Enhanced support for large Cocos bundles and repeatedly obfuscated files while maintaining strong protection and optimized performance.
Improved the separation between Standard and Advanced VIP editions, with deeper string, structural, and anti-analysis protection available in VIP.
Improved advanced parameter handling, SourceMap support, random seeds, and backward compatibility with existing configurations.
修复抖音小游戏严格 JS 编译器对 Unicode 转义保留字的兼容问题，避免 default 等关键字被错误转义后导致编译失败。
优化过滤规则机制，历史排除列表默认仅保留配置、不主动生效，避免标准版或高级 VIP 因旧规则出现文件被意外跳过的问题。
强化配置文件无损升级逻辑，更新版本时尽量完整保留现有许可证、VIP 配置、自定义参数及说明字段，减少配置被重建或丢失的风险。
完善标准版与高级 VIP 的全流程状态校验，高级链路异常时优先进行安全恢复，避免非必要降级或功能被静默关闭。
加强 Cocos System.register、二次混淆及大型 Bundle 的兼容检查，进一步降低构建后代码在不同小游戏平台编译阶段出现异常的概率。
完整执行标准版、高级 VIP、ZIP、SourceMap、参数合同、性能及异常恢复回归测试，进一步提升正式发布版本的稳定性。
Fixed compatibility issues with strict JavaScript compilers in ByteDance Mini Games, preventing reserved words such as default from being incorrectly Unicode-escaped and causing compilation failures.
Improved exclusion-rule handling. Legacy exclusion lists are now preserved but disabled by default, preventing Standard or Advanced VIP obfuscation from unexpectedly skipping files.
Improved lossless configuration upgrades, preserving existing license data, VIP settings, custom parameters, and configuration metadata during version updates.
Strengthened the complete Standard and Advanced VIP execution flow. Advanced processing now prioritizes safe recovery instead of unnecessary fallback or silent feature disabling.
Improved compatibility checks for Cocos System.register, repeated obfuscation, and large Bundles, reducing the risk of platform-side compilation failures after obfuscation.
Completed full regression verification covering Standard, Advanced VIP, ZIP, SourceMap, parameter contracts, performance, and recovery paths for improved release stability.
大幅优化 JS 混淆速度，尤其改善大型文件、复杂代码和高字符串密度文件处理过慢的问题。
优化随机混淆效果，同一份代码多次混淆可生成不同结果，同时继续支持固定结果模式。
优化批量文件、文件夹、ZIP 和多路径处理效率，长时间连续混淆更加稳定。
新增更直观的耗时显示，可查看单文件、单任务以及整批处理耗时，方便快速判断处理进度。
优化高级混淆异常恢复能力，减少不必要的经典回退，提高复杂项目和二次混淆场景的稳定性。
完善整体兼容性与稳定性，进一步提升 Cocos 3.x、CommonJS、System.register 等构建代码的正式发布可靠性。
Significantly improved JS obfuscation speed, especially for large files, complex scripts, and string-heavy bundles.
Improved randomized obfuscation so the same source can produce different protected outputs, while reproducible fixed-output mode remains available.
Improved performance and stability for batch files, folders, ZIP archives, and multi-path processing.
Added clearer processing-time information for individual files, tasks, and complete batches.
Improved advanced obfuscation recovery to reduce unnecessary fallback and increase stability for complex and repeatedly obfuscated projects.
Improved overall compatibility and release stability for Cocos 3.x, CommonJS, System.register, and other common build outputs.
本版本已完成正式冻结验收，建议作为 v3.13.153 长期稳定基线使用
恢复并强化百分比混淆增包机制，用户设置的混淆强度可更稳定地映射到最终包体增长目标，标准版与高级版保持一致的尺寸合同。
进一步提升 Cocos 3.x、System.register、CommonJS、UMD、Webpack 等复杂 JavaScript 结构的兼容性，增强复杂作用域、语法结构及多种工程输出场景下的稳定性。
完善 SourceMap 全链路处理，修复平台前导内容、高级恢复及最终组装过程中可能出现的映射偏移、引用错位和 JS / Map 不一致问题。
优化大文件及连续多轮混淆性能，降低重复混淆时进入异常慢路径的概率，并保持每轮混淆参数、包体目标及最终结果持续有效。
强化文件、ZIP、多目录以及 JS + SourceMap 的原子写入与异常恢复机制，提升进程中断、发布异常及复杂工程场景下的数据一致性与文件安全性。
增强高级版字符串、结构与语义扰动保护，进一步提高格式化、自动化分析、批量还原及 AI 辅助代码分析的处理成本，同时兼顾小游戏运行性能与工程兼容性。
优化项目级混淆预算分配，改善小文件、平台前导及多文件工程下的增包预算分配和最终尺寸一致性，减少局部文件偏差对整体目标的影响。
完善事务级故障恢复闭环，增强旧事务残留隔离、同名项目并发安全及发布阶段异常中断后的恢复能力，进一步降低 JS、SourceMap 或工程文件状态不一致的风险。
完善自动化验收与正式冻结验证体系，加强语义正确性、SourceMap、事务恢复、最终产物及历史问题的独立校验，进一步提升长期发布稳定性。
This release has completed final freeze validation and is recommended as the long-term stable v3.13.153 baseline.
Restored and strengthened percentage-based output growth control, allowing configured obfuscation strength to map more consistently to the final output size target across both Standard and Advanced editions.
Improved compatibility with complex JavaScript structures used by Cocos 3.x, System.register, CommonJS, UMD, Webpack and related build pipelines, with better stability for complex scopes, syntax patterns and project outputs.
Improved the complete SourceMap processing pipeline, addressing potential mapping offsets, source reference mismatches and JavaScript / Map inconsistencies during platform-prefix handling, recovery and final output assembly.
Optimized large-file and repeated obfuscation performance, reducing the chance of abnormal slow paths during multi-pass processing while keeping obfuscation parameters, output-size targets and final results effective across repeated runs.
Strengthened atomic writing and failure recovery for files, ZIP packages, multi-directory projects and JavaScript + SourceMap output pairs, improving consistency and file safety during interrupted processes, publishing failures and complex project workflows.
Strengthened Advanced-edition string, structural and semantic obfuscation, increasing the cost of formatting, automated analysis, bulk deobfuscation and AI-assisted code analysis while maintaining runtime performance and project compatibility.
Optimized project-level obfuscation budget allocation for small files, platform prefixes and multi-file projects, improving output-size consistency and reducing the impact of individual file deviations on the overall target.
Improved transaction-level failure recovery with stronger legacy transaction residue isolation, same-name project concurrency protection and recovery after abnormal termination during publishing, further reducing the risk of inconsistent JavaScript, SourceMap or project file states.
Improved automated validation and final freeze verification with stronger independent checks for semantic correctness, SourceMap handling, transaction recovery, final artifacts and historical regression cases, improving long-term release stability.
专业 JSVM 虚拟机混淆功能正在开发中
Professional JSVM-based obfuscation functionality is currently under development.
深度代码保护模式｜开发预览专业 JSVMP 虚拟机混淆功能正在开发中。
目前处于持续研发、兼容性验证与性能优化阶段。
预热，敬请期待。
本次研发方向不再只是继续叠加传统 JavaScript 混淆强度。
在现有：
等能力基础上，计划进一步对部分高价值核心业务逻辑进行更加深入的结构级保护。
核心目标：
兼容性
+
运行性能
+
代码保护强度
在三者之间取得更合理的平衡。
计划中的主要能力
核心逻辑深度保护普通 JavaScript 混淆主要还是让代码：
更乱
更难读
更难搜索
深度保护模式希望进一步做到：
核心业务逻辑
↓
转换为内部执行结构
↓
不再直接以普通 JavaScript 业务表达式形式暴露
重点用于保护：
多层结构保护计划根据代码特征组合使用不同保护策略，包括：
函数结构保护
+
控制逻辑扰乱
+
调用关系保护
+
字符串保护
+
属性访问保护
+
核心逻辑深度转换
目标不是简单把文件变大。
而是提高：
自动分析成本
人工阅读成本
逻辑还原成本
批量恢复成本
智能分级保护并不会简单地：
所有函数
↓
全部套最重保护
而是计划根据代码类型自动选择更合适的保护方式：
普通业务逻辑
↓
高强度常规混淆
重要业务逻辑
↓
更深层结构保护
核心算法 / 授权 / 校验
↓
JSVMP 深度保护
高频运行逻辑
↓
优先保证运行性能
游戏性能优先针对游戏和小游戏环境，运行性能仍然是重要目标。
例如：
update
lateUpdate
tick
render
physics
Tween
动画循环
高频事件
每帧逻辑
不会简单粗暴地全部进入高成本保护结构。
后续会综合考虑：
自动选择更加合适的保护策略。
不同构建产生不同结构计划让同一份源码在不同构建中产生结构差异。
例如：
第一次构建
→ 保护结构 A
第二次构建
→ 保护结构 B
第三次构建
→ 保护结构 C
进一步增加固定规则批量分析多个版本的难度。
混淆前后效果示意以下代码仅用于简单展示不同保护层级之间的区别。
实际最终输出会根据：
源码
配置
构建随机性
代码类型
安全策略
产生变化。
function verify(score, token) {
if (token.length > 3 && score * 7 + 11 > 100) {
return "ok";
}
return "no";
}
业务逻辑非常直接：
token.length > 3
score * 7 + 11 > 100
阅读源码即可快速理解判断规则。
传统高强度混淆后，可能变成类似：
function _0x91(_a, _b) {
var _s = 0;
while (true) {
switch (_s) {
case 0:
if (_b.length > 3) {
_s = 1;
continue;
}
return _x[2];
case 1:
if (_a * 7 + 11 > 100) {
return _x[1];
}
return _x[2];
}
}
}
代码已经明显更难阅读。
但经过：
格式化
↓
整理变量
↓
简化控制流
仍然可能观察到：
_a * 7 + 11 > 100
也就是说：
普通混淆主要是在原有 JavaScript 结构上增加阅读和分析难度。
③ 深度保护模式效果示意正在研发的深度保护模式，希望让适合保护的核心业务逻辑进一步转换。
效果可能更接近：
function _a(a, b) {
return _v(
[a, b],
_p,
0x31ac
);
}
var _p = [
187, 22, 91, 7,
216, 53, 11, 168,
72, 199, 34, 5,
118, 63, 205, 17,
...
];
此时原本非常明显的：
score * 7 + 11 > 100
不会再直接以普通业务表达式的形式暴露。
攻击者看到的会更加接近：
内部执行结构
+
编码数据
+
复杂控制关系
+
运行状态
而不是直接看到原始业务公式。
简单理解| 保护方式 | 主要效果 | 分析难度 |
|---|---|---|
| 原始 JavaScript | 业务逻辑直接可读 |  |
| 普通高强度混淆 | 名称、字符串、流程被扰乱 |
|
| 深度保护模式 | 核心逻辑进一步转换为内部执行结构 |
|
保护目标普通混淆后的分析过程通常比较接近：
格式化代码
↓
恢复变量关系
↓
整理控制流
↓
阅读业务代码
深度保护模式希望进一步提高到：
识别内部执行结构
↓
分析数据关系
↓
恢复控制关系
↓
恢复调用逻辑
↓
恢复业务语义
从而进一步增加自动化分析和人工还原成本。
计划兼容环境主要面向：
等 JavaScript 项目环境。
关于安全性的说明任何最终运行在客户端的 JavaScript，都不存在真正意义上的：
绝对无法逆向
100% 无法破解
永久不可恢复
深度代码保护真正追求的是：
提高逆向成本、增加恢复步骤、降低批量自动分析效率。
同时尽量保证项目：
正常运行
+
平台兼容
+
性能可接受
当前功能仍在持续研发、兼容测试与性能优化中。
上述代码仅用于展示设计方向，不代表最终固定输出格式。
最终功能、兼容范围、运行性能及保护效果，以正式发布版本为准。
预热，敬请期待。 Deep Code Protection Mode | Development PreviewProfessional JSVMP-based virtualized JavaScript protection is currently under development.
Compatibility testing and performance optimization are still ongoing.
Coming soon.
This new protection mode is not simply about adding more layers to traditional JavaScript obfuscation.
Based on existing protection techniques such as:
the new mode is designed to provide deeper protection for selected high-value business logic.
The main goal is to balance:
Compatibility
+
Runtime Performance
+
Protection Strength
Traditional JavaScript obfuscation mainly makes code:
Harder to read
Harder to search
Harder to understand
The new deep protection mode aims to go further:
Critical Business Logic
↓
Internal Execution Structure
↓
Original business expressions are no longer directly exposed
Typical targets include:
Multi-Layer Structural ProtectionDifferent protection strategies may be combined according to the characteristics of the source code:
Function Structure Protection
+
Control-Flow Transformation
+
Call-Relationship Protection
+
String Protection
+
Property Protection
+
Deep Logic Transformation
The goal is not simply to generate larger files.
The real target is to increase:
Automated Analysis Cost
Manual Analysis Cost
Logic Reconstruction Cost
Batch Recovery Cost
The new system is not designed to apply the heaviest protection to every function.
Instead:
Normal Business Logic
↓
High-Strength Traditional Obfuscation
Important Business Logic
↓
Deeper Structural Protection
Core Algorithms / License / Validation
↓
JSVMP Deep Protection
High-Frequency Runtime Logic
↓
Performance-Oriented Protection
Game and mini-game performance remains an important consideration.
High-frequency code such as:
update
lateUpdate
tick
render
physics
Tween callbacks
animation loops
frame-based logic
will not simply be forced into the heaviest protection structure.
The protection strategy will consider:
to automatically select a more suitable protection level.
Different Structures for Different BuildsThe same source code may produce different protection structures across different builds.
For example:
Build 1
→ Structure A
Build 2
→ Structure B
Build 3
→ Structure C
This is intended to increase the cost of applying one fixed recovery rule to multiple future builds.
Before / After ExampleThe following example is only intended to demonstrate the difference between protection levels.
Actual output may vary depending on:
Source Code
Configuration
Build Randomness
Code Type
Protection Strategy
function verify(score, token) {
if (token.length > 3 && score * 7 + 11 > 100) {
return "ok";
}
return "no";
}
The business logic is immediately visible:
token.length > 3
score * 7 + 11 > 100
A traditionally obfuscated result may look similar to:
function _0x91(_a, _b) {
var _s = 0;
while (true) {
switch (_s) {
case 0:
if (_b.length > 3) {
_s = 1;
continue;
}
return _x[2];
case 1:
if (_a * 7 + 11 > 100) {
return _x[1];
}
return _x[2];
}
}
}
The code is significantly harder to read.
However, after:
Beautification
↓
Variable Analysis
↓
Control-Flow Simplification
an analyst may still discover:
_a * 7 + 11 > 100
In other words:
Traditional obfuscation mainly increases complexity while the original JavaScript business structure still exists.
③ Deep Protection PreviewFor suitable high-value logic, the new protection mode is designed to transform the original business logic further.
The result may look more like:
function _a(a, b) {
return _v(
[a, b],
_p,
0x31ac
);
}
var _p = [
187, 22, 91, 7,
216, 53, 11, 168,
72, 199, 34, 5,
118, 63, 205, 17,
...
];
The original expression:
score * 7 + 11 > 100
is no longer directly exposed as ordinary business JavaScript.
Instead, an analyst is more likely to encounter:
Internal Execution Structure
+
Encoded Data
+
Complex Control Relationships
+
Runtime State
before reaching the original business logic.
Simple Comparison| Protection Level | Main Effect | Analysis Difficulty |
|---|---|---|
| Original JavaScript | Business logic directly readable | |
| Traditional Obfuscation | Names, strings and control flow transformed |
|
| Deep Protection Mode | Core logic transformed into an internal execution structure |
|
Protection GoalTraditional obfuscation analysis often follows a path similar to:
Beautify Code
↓
Recover Variable Relationships
↓
Simplify Control Flow
↓
Read Business Logic
The deep protection mode aims to increase the required analysis steps:
Identify Internal Execution Structure
↓
Analyze Data Relationships
↓
Recover Control Relationships
↓
Recover Call Logic
↓
Reconstruct Business Semantics
The goal is to significantly increase the cost of both automated analysis and manual reconstruction.
Planned CompatibilityMain target environments include:
Security NoticeNo client-side JavaScript protection can honestly guarantee:
100% Impossible to Reverse
Completely Unbreakable
Permanently Unrecoverable
The real purpose of advanced code protection is to:
Increase reverse-engineering cost, add reconstruction steps, and reduce the efficiency of automated recovery.
while maintaining:
Runtime Compatibility
+
Practical Performance
+
Protection Strength
This feature is still under active development, compatibility testing and performance optimization.
The examples above are intended only to demonstrate the design direction and do not represent a fixed final output format.
Final functionality, compatibility, runtime performance and protection strength may change before release.
Coming Soon.