Implementing Self-Defending Code Integrity Checks in JavaScript

The foundation of integrity checking is generating a checksum of your code. This serves as a fingerprint that can be verified later.

// Generate a simple hash of a string
function simpleHash(str) {
  let hash = 0;
  if (str.length === 0) return hash;
  
  for (let i = 0; i < str.length; i++) {
    const char = str.charCodeAt(i);
    hash = ((hash << 5) - hash) + char;
    hash = hash & hash; // Convert to 32bit integer
  }
  
  return hash.toString(16); // Convert to hex string
}

// Example: Calculate checksum of a function
function calculateFunctionChecksum(func) {
  return simpleHash(func.toString());
}

For production use, consider using more robust hashing algorithms through libraries like CryptoJS:

// Using CryptoJS for stronger hashing
function secureHash(str) {
  return CryptoJS.SHA256(str).toString();
}

Once you've calculated checksums, you need to store them securely for later verification. There are several approaches:

Approach 1: Embedded Checksums

// Store checksums in obfuscated variables
(function() {
  const checksums = {
    validatePayment: "a1b2c3d4", // Checksum of validatePayment function
    processOrder: "e5f6g7h8",    // Checksum of processOrder function
    // More checksums...
  };
  
  // Obfuscated validity check performed periodically
  // ...
})();

Approach 2: Self-Referential Checksums

function validatePayment(amount, cardDetails) {
  // Original implementation
  // ...
  
  // Hidden property containing function's own checksum
  validatePayment._integrity = "a1b2c3d4";
}

Next, implement the logic that periodically verifies your code's integrity by comparing current checksums with the stored references.

// Verify integrity of critical functions
function verifyCodeIntegrity() {
  // Check validatePayment function
  const currentValidateChecksum = calculateFunctionChecksum(validatePayment);
  if (currentValidateChecksum !== checksums.validatePayment) {
    // Tampering detected!
    handleTamperingDetected('validatePayment');
    return false;
  }
  
  // Check processOrder function
  const currentProcessChecksum = calculateFunctionChecksum(processOrder);
  if (currentProcessChecksum !== checksums.processOrder) {
    // Tampering detected!
    handleTamperingDetected('processOrder');
    return false;
  }
  
  // All checks passed
  return true;
}

// Run verification periodically
setInterval(verifyCodeIntegrity, 5000); // Check every 5 seconds

For better protection, randomize the check intervals and obfuscate the verification logic itself.

When tampering is detected, you need a strategy to respond. Here are several effective approaches:

function handleTamperingDetected(functionName) {
  // Option 1: Silent recovery - restore the original function
  if (functionName === 'validatePayment') {
    window.validatePayment = originalValidatePayment;
    console.warn('Restored modified validatePayment function');
  }
  
  // Option 2: Degraded functionality
  if (functionName === 'processOrder') {
    // Replace with a version that appears to work but doesn't complete orders
    window.processOrder = function(...args) {
      showOrderProcessingSpinner();
      // Simulate processing but never complete
      setTimeout(() => {
        showGenericError('Unable to process order. Please try again later.');
      }, 3000);
      return false;
    };
  }
  
  // Option 3: Lock application
  // appState.locked = true;
  // showApplicationLockedScreen();
  
  // Option 4: Phone home (report tampering attempt)
  // reportTamperingAttempt(functionName, location.href);
}

Self-healing code takes integrity protection a step further by automatically restoring modified functions to their original state.

// Advanced self-healing implementation
(function() {
  // Store original implementations
  const originalFunctions = {
    validatePayment: validatePayment,
    processOrder: processOrder,
    // More functions...
  };
  
  // Generate checksums for all original functions
  const originalChecksums = {};
  for (const [name, func] of Object.entries(originalFunctions)) {
    originalChecksums[name] = calculateFunctionChecksum(func);
  }
  
  // Verification and healing function
  function verifyAndHeal() {
    for (const [name, originalFunc] of Object.entries(originalFunctions)) {
      // Get current function reference
      const currentFunc = window[name];
      
      // Check if function reference is missing
      if (typeof currentFunc !== 'function') {
        // Function was deleted - restore it
        window[name] = originalFunc;
        console.warn(`Restored missing function: ${name}`);
        continue;
      }
      
      // Calculate current checksum
      const currentChecksum = calculateFunctionChecksum(currentFunc);
      
      // Compare with original
      if (currentChecksum !== originalChecksums[name]) {
        // Function was modified - restore original
        window[name] = originalFunc;
        console.warn(`Healed modified function: ${name}`);
      }
    }
  }
  
  // Run verification at irregular intervals to make pattern detection harder
  function scheduleNextCheck() {
    const randomDelay = 1000 + Math.random() * 4000; // 1-5 seconds
    setTimeout(() => {
      verifyAndHeal();
      scheduleNextCheck();
    }, randomDelay);
  }
  
  // Start the verification cycle
  scheduleNextCheck();
})();