execution delay

Why It Matters

For developers working in environments where code must be protected from reverse engineering, execution delay serves as a foundational technique to increase the effort required to analyze a script. It is particularly useful in applications that handle sensitive logic, proprietary algorithms, or financial transactions.

When attackers attempt to deobfuscate or analyze scripts, execution delay can break their assumptions about timing and execution paths. This makes automated tools less effective and forces attackers to spend more time manually stepping through code. From a performance perspective, it can also be used to mask the true runtime behavior of a script, especially in cases where a script is expected to run quickly but may be intentionally slowed to avoid detection.

How It Works

Execution delay operates by inserting artificial delays into code execution, often through loops, timeouts, or asynchronous operations. These delays are designed to obscure the timing and flow of execution, thereby making it harder to predict or trace what a script is doing at any given moment.

• Execution delay is commonly implemented using setTimeout or setInterval with a small delay, such as 1 millisecond.
• It can also be achieved using tight loops or busy-waiting techniques to consume CPU cycles without performing useful work.
• The delay is typically introduced at key points in the script, such as before or after critical logic blocks.
• It is often combined with other obfuscation techniques like string encoding or control flow flattening.
• Modern tools may use dynamic delays that vary based on runtime conditions, such as system load or time of day.

Quick Reference

Basic Example

This basic example demonstrates how a simple execution delay can be introduced using setTimeout to delay the execution of a function.

function delayedFunction() {
  console.log('This runs after delay');
}

setTimeout(delayedFunction, 100);

The setTimeout call schedules delayedFunction to run after 100 milliseconds, introducing a delay in execution that disrupts the immediate flow of the script.

Production Example

This production example shows how execution delay is used in a more complex scenario, where a sensitive function is delayed to obscure its purpose.

function checkCredentials(username, password) {
  // Obfuscation: Delay execution to disrupt analysis
  setTimeout(() => {
    if (username === 'admin' && password === 'secret') {
      console.log('Access granted');
    } else {
      console.log('Access denied');
    }
  }, 50); // Delay of 50 milliseconds
}

checkCredentials('admin', 'secret');

This version is more suitable for production because it introduces a delay in a way that is not immediately obvious to an analyst. The delay is small enough to not impact user experience but sufficient to make static analysis more difficult.

Common Mistakes

• Using overly long delays that degrade user experience or are easily detected by automated tools.
• Applying delay inconsistently, which can reveal obfuscation patterns to attackers.
• Over-relying on execution delay without combining it with other obfuscation techniques.
• Not accounting for browser or environment differences that may affect timing behavior.
• Using predictable delay values that can be bypassed by advanced reverse engineering tools.

Security And Production Notes

• Execution delay should not be the sole obfuscation technique; it must be combined with other methods for effective protection.
• Too much delay can make scripts appear unresponsive, which can degrade user experience and cause performance issues.
• It is important to ensure that delays do not interfere with legitimate script functionality or error handling.
• Dynamic delays should be carefully implemented to avoid introducing performance bottlenecks or race conditions.
• Execution delay is not a substitute for proper input validation, encryption, or access control mechanisms.

Related Concepts

Execution delay is closely related to several other concepts in obfuscation and security. These include:

• Control Flow Obfuscation: Restructures code execution paths to make analysis harder.
• String Encoding: Encodes strings to prevent easy reading of sensitive values.
• Dead Code Insertion: Adds irrelevant code to confuse reverse engineers.
• Timing Attacks: Techniques that exploit timing differences to infer information.
• Anti-Debugging: Methods to detect and resist debugging attempts.

Further Reading

• MDN Web Docs
• WHATWG HTML Standard