Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JSFuck (2012)

jsfuck.com

Post reply on HN
Print view View original

91–100 of 168 posts

Re: JSFuck (2012)

#91

Post by raspasov »

zemnmez wrote: post #45
ollyfg wrote: post #19

I probably deserve to get downvoted to oblivion for this but... I've deployed JSFuck in production! We wanted to obfuscate this bit of code, to make life just a little bit harder for reverse engineers. We made this huge function where we pretty much passed in all our application state, and it would run this JSFuck code, and spit out a token. We even made a few tweaks to the code so that you couldn't just reverse it b…

makes me sad to hear that :( I will say, as a reverse engineer, that javascript minifiers like closure compiler will optimize almost all obfuscation out, and the rest you can usually translate to a form which it can understand and then it will do the rest. The effect of obfuscation is not what you expect. It seems like it moves the whole difficulty up, but it only moves up the floor. By doing so it tends to remove al…

Do you consider Google Closure sufficiently good obfuscation?

Re: JSFuck (2012)

#92

Post by Dylan16807 »

hungryforcodes wrote: post #77
8note wrote: post #69

Earlier quoted context omitted.

Because it's broken for my usecase, and I need to do something slightly different on the webpage

You shouldn't have access to it -- it's on my private servers doing stuff for me. How did you get it? I think the problem with this thread is people think I am writing browser code, or code that is going to be shared on GitHub. I am not. Also I'm only half joking as I've indicated with the "/s" below.

> You shouldn't have access to it -- it's on my private servers doing stuff for me. How did you get it?

Well thanks for chiming in about a completely unrelated topic from website javascript. My comment wasn't getting downvoted until your slapfight with oauea blew up.

Re: JSFuck (2012)

#94

Post by moron4hire »

IncRnd wrote: post #53
Aeolun wrote: post #43

Earlier quoted context omitted.

I think someone once asked me the simplified variant of that question. What is the result of: []+[] And I didn’t know the answer to that (I mean, who does that kind of fuckery in Javascript, you can’t sum arrays). I would have no chance with these Google level questions.

The right type of answer for that is to laugh and say, "you should ask the fool who wrote that code instead of asking me."

This kind of thing does happen in the wild, through no fault of anyone in arms' reach, in particular when service APIs change in subtle and unexpected ways.

You might have a service that yesterday returned a JSON payload:

    { tasks: 5, ... }
but today returns:

    { tasks: [{...}, ...], ...}
If you had an array of these objects and were trying to sum the count of tasks, now your code returns weird results. Knowing how the JS engine's type coercion works is then invaluable for figuring out the problem quickly.

Yes, it's shitty code, and a change of API like that is shitty. But we don't always get to choose what code we're interfacing with, particularly when it comes to web services.

Re: JSFuck (2012)

#95

Post by hungryforcodes »

Dylan16807 wrote: post #92
hungryforcodes wrote: post #77

Earlier quoted context omitted.

You shouldn't have access to it -- it's on my private servers doing stuff for me. How did you get it? I think the problem with this thread is people think I am writing browser code, or code that is going to be shared on GitHub. I am not. Also I'm only half joking as I've indicated with the "/s" below.

> You shouldn't have access to it -- it's on my private servers doing stuff for me. How did you get it? Well thanks for chiming in about a completely unrelated topic from website javascript. My comment wasn't getting downvoted until your slapfight with oauea blew up.

Specifically from the web page:

"It does not depend on a browser, so you can even run it on Node.js."

Re: JSFuck (2012)

#96

Post by userbinator »

ollyfg wrote: post #19

I probably deserve to get downvoted to oblivion for this but... I've deployed JSFuck in production! We wanted to obfuscate this bit of code, to make life just a little bit harder for reverse engineers. We made this huge function where we pretty much passed in all our application state, and it would run this JSFuck code, and spit out a token. We even made a few tweaks to the code so that you couldn't just reverse it b…

I think I might've actually analysed the code you're describing.

We even made a few tweaks to the code so that you couldn't just reverse it back into JS

This is why a lot of us keep our tools private... an old tradition of the cracking scene going back decades to the 80s. Think of things like IDA/Hexrays and Ghidra, then realise the most prolific crackers had similar private tools they had written many years before those appeared.

Re: JSFuck (2012)

#97

Post by howaboutnope »

hungryforcodes wrote: post #95
Dylan16807 wrote: post #92

Earlier quoted context omitted.

> You shouldn't have access to it -- it's on my private servers doing stuff for me. How did you get it? Well thanks for chiming in about a completely unrelated topic from website javascript. My comment wasn't getting downvoted until your slapfight with oauea blew up.

Specifically from the web page: "It does not depend on a browser, so you can even run it on Node.js."

That wasn't a top level question though, it was a question to a commenter saying "We wanted to obfuscate this bit of code, to make life just a little bit harder for reverse engineers." That you obfuscate code nobody other than you can even access is completely irrelevant as a reply to that question.

Re: JSFuck (2012)

#98

Post by hungryforcodes »

howaboutnope wrote: post #97
hungryforcodes wrote: post #95

Earlier quoted context omitted.

Specifically from the web page: "It does not depend on a browser, so you can even run it on Node.js."

That wasn't a top level question though, it was a question to a commenter saying " We wanted to obfuscate this bit of code, to make life just a little bit harder for reverse engineers. " That you obfuscate code nobody other than you can even access is completely irrelevant as a reply to that question.

So then you should ignore the entire thread and move on. Why are you wasting time on this?

Re: JSFuck (2012)

#99

Post by forty »

Aeolun wrote: post #43
abacadaba wrote: post #9

New interview question: What will be the result of running the following code? [][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[ ]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[] ])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+ (!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+ !+[]+[+[]]]+(![]+[])[!+[]+!+[…

I think someone once asked me the simplified variant of that question. What is the result of: []+[] And I didn’t know the answer to that (I mean, who does that kind of fuckery in Javascript, you can’t sum arrays). I would have no chance with these Google level questions.

It's a stupid question, unless they also give you the ecmascript spec and let you figure it out ;)
Post reply on HN