how is this "educational"? it's about as readable as hexadecimal machine code. What's the lesson?
It demonstrates how awful javascript is.
JSFuck (2012)
11–20 of 168 posts
Re: JSFuck (2012)
#12Re: JSFuck (2012)
#13I don't understand how this works. I've seen brainfuck before, but not truly understood it. How is it possible to open up a new tab, paste the encoded form, and have working JavaScript?
It's because it _is_ working javascript. It's just obfuscated, taking advantage of the quirks of javascript's implicit type casting to represent expressions in odd ways. Look at the "basics" section of the page to get an idea of how it works on a small scale.
Brainfuck is an unrelated, separate programming language.
Re: JSFuck (2012)
#14I don't understand how this works. I've seen brainfuck before, but not truly understood it. How is it possible to open up a new tab, paste the encoded form, and have working JavaScript?
Here's the decoder ring: https://github.com/aemkei/jsfuck/blob/master/jsfuck.js
With this I was able to get the letter 'a' by starting with their initial definition `(false+"")[1]`, then continually substituting
(false+'')[1]
(![]+'')[1]
(![]+([]+[]))[1]
(![]+([]+[]))[+!(+[])]
All of the above lines when evaluated result in 'a'.
Re: JSFuck (2012)
#15This is horrifying.
I thought it’s really cool instead.
Re: JSFuck (2012)
#16I don't understand how this works. I've seen brainfuck before, but not truly understood it. How is it possible to open up a new tab, paste the encoded form, and have working JavaScript?
[deleted]
Re: JSFuck (2012)
#17I remember encountering this as one of the layers of a heavily obfuscated script (with DRM-related purposes, not surprisingly...) many years ago --- fortunately, there's a corresponding unobfuscator for it:
https://enkhee-osiris.github.io/Decoder-JSFuck/
The same script also featured both of these equally-amusing obfuscations:
Re: JSFuck (2012)
#18> It does not depend on a browser, so you can even run it on Node.js.
wow this is exactly what I wanted!
Re: JSFuck (2012)
#19I probably deserve to get downvoted to oblivion for this but... I've deployed JSFuck in production!
We wanted to obfuscate this bit of code, to make life just a little bit harder for reverse engineers. We made this huge function where we pretty much passed in all our application state, and it would run this JSFuck code, and spit out a token. We even made a few tweaks to the code so that you couldn't just reverse it back into JS with something like https://enkhee-osiris.github.io/Decoder-JSFuck/.
Performance was surprisingly alright, and it has never hit an environment where it couldn't execute. All in all, a fun few hours setting it up, and I haven't had to touch it since!