order directive allows you to enable transformations in a specific block or statement and also in a specific order, opposed to
enable that enables transformations in a random order.
Consider the following contrived example:
The resulting code would look something like this:
In the first statement, the transformations were combined in a way that allowed
stringEncoding to target the identifier
moveTo and the numeric arguments
250. On the second statement we have changed the order so
stringEnconding would happen before
numberToString. This way
stringEnconding didn’t target the numeric arguments of the function
map.moveTo, because they haven’t been transformed to strings at the time. The last statement is the worst example because the selected order didn’t maximize the synergies between the transformations. Therefore, when
stringEncoding was called there were no strings to obfuscate.
You can also repeat transformations. Take a look at the following contrived example:
stringEncoding a second time we have transformed the numeric arguments produced by the first
stringEncoding and encoded all strings a second time therefore producing this code:
However, the number of times you can repeat the same transformation is limited. You can only repeat the same transformation up to 3 times. There are some exceptions to this, where transformations can’t be repeated, meaning that they can only be used once per node. The transformations that can only be used once are:
Order can also be inherited so if you define a specific order for a block, any inner statement and block will inherit it and combine it with any directive defined at that point.
Consider the following contrived example with made up transformations to make it easier to understand how
order inheritance works:
qux, inherit from function
Note that the first transformations to be applied are the ones respectively closer to
qux. Also if there are any matching transformation, those are merged in pairs so inheriting a transformation
A when the same transformation
A is defined locally, won’t apply the transformation twice. For
A has been applied only two times because there was one matching
A with the order inherited from
foo that was merged. For
B is applied first (and merged) and then the order inherited from
foo is applied.