Overview

Microsoft® Scripting Technology - Microsoft® Script Encoder
Overview
 Next

Script Encoder is a simple command-line tool that enables script designers to encode their final script so that Web hosts and Web clients cannot view or modify their source. Note that this encoding only prevents casual viewing of your code; it will not prevent the determined hacker from seeing what you've done and how.

Web designers use scripting on Web pages and server-side active server pages (.ASP) to add virtually every kind of feature you can imagine. In addition, scripting is used by the Windows® Scripting Host (WSH) and in a number of other applications with equally impressive results.

Up to now, one of the shortcomings of using scripts is that they afford no protection of the intellectual property contained within, nor do they provide any assurance that what users get is what you created. Clever algorithms and carefully designed scripts were always completely visible because they were stored as plain text. As a result, script users at every level could see the script designer's code and could then take it, modify it, and make it their own. Obviously, this is not good if you're trying to get an edge in a very competitive environment.

With the introduction of scriptlets, protecting the source code becomes even more important. Script designers want to use this simple component architecture, but they don't necessarily want to share their source code with the world. After a script is encoded, changing any part of the resulting file will render it inoperable, thus ensuring the absolute integrity of your encoded script.

The documentation for the Script Encoder is presented in the following topics:

  • Using the Script Encoder

  • Script Encoder Syntax

  • Encoding Sample

© 1998 Microsoft Corporation. All rights reserved. Terms of Use.


Using the Script Encoder (CLE)

Microsoft® Scripting Technology - Microsoft® Script Encoder
Using the Script Encoder
 Previous
Next

The Script Encoder encodes only scripting code, with all other file content left untouched to appear as plain text. To use the Script Encoder, develop and debug your script in the usual manner, then use this utility to encode your final script. The Script Encoder uses markers within your source code to identify where encoding should begin.

For Visual Basic® Scripting Edition (VBScript), the following example illustrates how the encoding marker is used to expose a plain-text copyright message:

<SCRIPT LANGUAGE="VBScript">
'Copyright© 1998. XYZ Productions. All rights reserved.
'**Start Encode**
' Your code goes here.
</SCRIPT>
In JScript®, the encoding marker looks like this:

<SCRIPT LANGUAGE="JScript">
//Copyright© 1998. ZYX Productions. All rights reserved.
//**Start Encode**
// Your code goes here.
</SCRIPT>
When the Script Encoder is invoked, anything in the script block before the start marker is left unencoded, while everything else in the script block is encoded. Therefore, if the start marker is omitted, the entire scripting block is encoded, but if the start marker is at the end of the scripting block, nothing is encoded.

After the encoding takes place, you should be aware that the language designator in the <SCRIPT> tag has changed. For VBScript, the new designator looks like this:

<SCRIPT LANGUAGE="VBScript.Encode">
For JScript (or JavaScript), the new designator looks like this:
<SCRIPT LANGUAGE="JScript.Encode">
The Script Encoder is invoked on the MS-DOS command line or in the Run dialog box as follows:
SRCENC [switches] inputfile outputfile
The syntax for this utility is explained in Script Encoder Syntax.


Script Encoder Syntax

Microsoft® Scripting Technology - Microsoft® Script Encoder
Script Encoder Syntax
 Previous
Next

Description
Encodes scripting source code so it cannot be easily viewed or modified by users.

Syntax
SCRENC [/s] [/f] [/xl] [/l defLanguage ] [/e defExtension] inputfile outputfile

The Script Encoder syntax has these parts:

Part | Description
/s | Optional. Switch that specifies that the Script Encoder is to work silently, that is, produce no screen output. If omitted, the default is to provide verbose output.
/f | Optional. Specifies that the input file is to be overwritten by the output file. Note that this option destroys your original input source file. If omitted, the output file is not overwritten.
/xl | Optional. Specifies that the @language directive is not added at the top of .ASP files. If omitted, @language directive is added for all .ASP files.
/l defLanguage | Optional. Specifies the default scripting language (JScript® or VBScript) to use during encoding. Script blocks within the file being encoded that do not contain a language attribute are assumed to be of this specified language. If omitted, JScript is the default language for HTML pages and scriptlets, while VBScript is the default for active server pages. For plain text files, the file extension (either .js or .vbs) determines the default scripting language.
/e defExtension | Optional. Associates the input file with a specific file type. Use this switch when the input file's extension doesn't make the file type obvious, that is, when the input file extension is not one of the recognized extensions, but the file content does fall into one of the recognized types. There is no default for this option. If a file with an unrecognized extension is encountered and this option is not specified, the Script Encoder fails for that unrecognized file. Recognized file extensions are asa, asp, cdx, htm, html, js, sct, and vbs.
inputfile | Required. The name of the input file to be encoded, including any necessary path information relative to the current directory.
outputfile | Required. The name of the output file to be produced, including any necessary path information relative to the current directory.

Remarks
There are four kinds of files than can be processed by the Script Encoder. They are:
  • ASP. This format consists of a text active server page containing valid HTML and embedded scripting blocks within <SCRIPT> ... </SCRIPT> tags or <% ... %> tags. Applications that use this format include Microsoft® Internet Information Services (IIS). Recognized file extensions are .asp, .asa, and .cdx.
  • HTML. This format consists of a text file that contains valid HTML along with embedded script blocks. Applications using this scripting format include Microsoft FrontPage®, Microsoft® Visual InterDev™ and virtually all Web designers and browsers. Recognized file extensions are .htm and .html.
  • Plain text. This format consists of text file that contains only script with no surrounding tags. Applications using scripting format include Windows® Scripting Host (WSH) and Microsoft® Outlook®. Recognized file extensions are .js and .vbs, which are changed to .jse and .vbe, respectively, after encoding.
  • Scriptlet. This format consists of a text file that contains valid scriptlet code within <SCRIPT> ... </SCRIPT> tags. Recognized file extension is .sct and .wsh.
Examples
The following are examples of the use of the Script Encoder and a brief explanation of the results:

To encode input file test.html and produce output file encode.html, use:

screnc test.html encode.html
To encode input file test.htm and overwrite the input file with the encoded output file, use:
screnc /f test.htm
To encode all .ASP files in the current directory and place the encoded output files in c:\temp, use:
screnc *.asp c:\temp
To encode all files in the current directory as .ASP files and place them in c:\temp, use:
screnc /e asp *.* c:\temp
To encode input file test.htm and produce output file encode.htm, ensuring that all script blocks that don't have a language attribute specified use VBScript, use:
screnc /l vbscript test.htm encode.htm
To encode all scriptlet files in the current directory and overwrite them with encoded files, while displaying no message, use:
screnc /s /f *.sct


Encoding Sample

Microsoft® Scripting Technology - Microsoft® Script Encoder
Encoding Sample
 Previous
Here's a short example of a Web page that includes some JScript code that needs protecting:
<HTML>
<HEAD>
<TITLE>Script Encoder Sample Page</TITLE>
<SCRIPT LANGUAGE="JScript">
<!--//
//Copyright© 1998 Microsoft Corporation. All Rights Reserved.
//**Start Encode**
function verifyCorrectBrowser(){
  if(navigator.appName == "Microsoft Internet Explorer")
    if (navigator.appVersion.indexOf ("5.") >= 0)
      return(true);
    else
      return(false);
}
function getAppropriatePage(){
  var str1 = "Had this been an actual Web site, a page compatible with ";
  var str2 = "browsers other than ";
  var str3 = "Microsoft Internet Explorer 5.0 ";
  var str4 = "would have been loaded.";
  if (verifyCorrectBrowser())
    document.write(str1 + str3 + str4);
  else
    document.write(str1 + str2 + str3 + str4);
}
//-->
</SCRIPT>
</HEAD>
<BODY onload="getAppropriatePage()">
</BODY>
</HTML>
Here's the same page as it appears after being run through the Script Encoder:
<HTML>
<HEAD>
<TITLE>Script Encoder Sample Page</TITLE>
<SCRIPT LANGUAGE="JScript.Encode">
<!--//
//Copyright© 1998 Microsoft Corporation. All Rights Reserved.
//**Start Encode**#@~^QwIAAA==@#@&0;	mDkW	P7nDb0zZKD.n1YAMGhk+Dvb`@#@&P,kW`UC7kLlDGDcl22gl:n~{'~Jtr1DGkW6YP&xDnD	+OPA62sKD+ME#@#@&P,~~k6PvxC\rLmYGDcCwa.n.kkWU bx[+X66Pcr*cJ#,@*{~!*P~P,P~.YEMU`DDEbIP,P,+s/n@#@&P~P,~PM+O;Mx`WC^/n#pN6EU1YbWx,oObaw.WaDrCD+nmL+v#	@#@&~P7lMPdY.q,'~J_CN,Y4rkP4nn	PCx,C1Y;mV,+(PkrY~~l,wCLPmKhwmYk(snPSkDt~JI@#@&P~\m.PkY.+,'PE8MWA/.kPGDtDPDtmUPri@#@&,P-CMP/D.&,'Pr\rmMWkWWY~(	YnD	nY,2a2^WDn.,* !,Ep@#@&,P7lD,/D.c,'~JSW;s9Ptm-+,4+U~VKl9+[REI,Pr0,c\DrWHZW..mOAMGS/nM`*#@#@&P,~P9W^Es+UOchDbO+v/YMq~_,/DDfPQ~kY.c*IP,+sd@#@&~~,P[W1;s+UDRSDkD+vdYMF~_,/O.yP_,dYM&P3~dYMc*iNz&R @*^#~@
//-->
</SCRIPT>
</HEAD>
<BODY onload="getAppropriatePage()">
</BODY>
</HTML>
Important After encoding, if you change even one character in the encoded text, the integrity of the entire script is lost and it can no longer be used.


Copyright

Microsoft® Script Encoder

Information in this document is subject to change without notice. The names of companies, products, people, characters, and/or data mentioned herein are fictitious and are in no way intended to represent any real individual, company, product, or event, unless otherwise noted. Complying with all applicable copyright laws is the responsibility of the user. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

© 1991-1998 Microsoft Corporation. All rights reserved.

Microsoft, MS, MS-DOS, ActiveX, JScript, Microsoft Press, Visual Basic, Windows, Windows NT, Win32, and Win32s are either registered trademarks or trademarks of Microsoft Corporation in the U.S.A. and/or other countries.

Other product and company names mentioned herein may be the trademarks of their respective owners.