It”s very interesting when you play code golf . Check this out (https://codegolf.stackexchange.com/a/17980). You have 100% chance to lose
JSFuck (2012)
101–110 of 168 posts
Re: JSFuck (2012)
#102I probably deserve to get downvoted to oblivion for this but... I've deployed JSFuck in production! We wanted to obfuscate this bit of code, to make life just a little bit harder for reverse engineers. We made this huge function where we pretty much passed in all our application state, and it would run this JSFuck code, and spit out a token. We even made a few tweaks to the code so that you couldn't just reverse it b…
I think I might've actually analysed the code you're describing. We even made a few tweaks to the code so that you couldn't just reverse it back into JS This is why a lot of us keep our tools private... an old tradition of the cracking scene going back decades to the 80s. Think of things like IDA/Hexrays and Ghidra, then realise the most prolific crackers had similar private tools they had written many years before t…
>This is why a lot of us keep our tools private
How ironic, that you want to open up other peoples code but keep your own hidden.
Re: JSFuck (2012)
#103Earlier quoted context omitted.
I think someone once asked me the simplified variant of that question. What is the result of: []+[] And I didn’t know the answer to that (I mean, who does that kind of fuckery in Javascript, you can’t sum arrays). I would have no chance with these Google level questions.
This is in my opinion actually a decent interview question. If you know JS in detail, if you know how the "+" operator works, it's a super easy question. If you don't know JS in detail, if you don't know how the "+" operator works, it's pretty tough. If you want an engineer who knows JS in detail, asking this question can be valuable.
"+" isn't some singular operator. They are different operators for different types using the same character. You'd have to memorize a table of all JS types and what "+" does for each, which is silly considering that the only place it should really be used in modern JS is arithmetic and the occasional string concatenation.
Re: JSFuck (2012)
#104Earlier quoted context omitted.
I think someone once asked me the simplified variant of that question. What is the result of: []+[] And I didn’t know the answer to that (I mean, who does that kind of fuckery in Javascript, you can’t sum arrays). I would have no chance with these Google level questions.
looks like you need to watch the WAT talk https://www.destroyallsoftware.com/talks/wat
Thanks for the reminder, love to re-watch this every now and again! So funny!
Does ayone know of any similar-calibre sequels or similar vids?
Re: JSFuck (2012)
#105Earlier quoted context omitted.
I think someone once asked me the simplified variant of that question. What is the result of: []+[] And I didn’t know the answer to that (I mean, who does that kind of fuckery in Javascript, you can’t sum arrays). I would have no chance with these Google level questions.
This is in my opinion actually a decent interview question. If you know JS in detail, if you know how the "+" operator works, it's a super easy question. If you don't know JS in detail, if you don't know how the "+" operator works, it's pretty tough. If you want an engineer who knows JS in detail, asking this question can be valuable.
it would be more relevant to ask about the valueOf method that can mess up all the various conversions.
Re: JSFuck (2012)
#106Earlier quoted context omitted.
I think someone once asked me the simplified variant of that question. What is the result of: []+[] And I didn’t know the answer to that (I mean, who does that kind of fuckery in Javascript, you can’t sum arrays). I would have no chance with these Google level questions.
In case anyone is wondering, the answer is '' (empty string).
How can adding two empty arrays give you an empty string?
Re: JSFuck (2012)
#107Earlier quoted context omitted.
makes me sad to hear that :( I will say, as a reverse engineer, that javascript minifiers like closure compiler will optimize almost all obfuscation out, and the rest you can usually translate to a form which it can understand and then it will do the rest. The effect of obfuscation is not what you expect. It seems like it moves the whole difficulty up, but it only moves up the floor. By doing so it tends to remove al…
I'm curious: can you can undo the obfuscation of JScrambler and Obfuscator.io easily? Some time ago I tried to run both through Closure Compiler, but it was way harder than I thought would be.
JScrambler I actually did de-obfuscate to bypass some very significant bot detection a few years ago, but it took a bit more doing -- it uses ES6 features IIRC so I had to transpile it down to ES5 via babel first, but it worked OK after that.
has a pretty good crack at obfuscator.io, too: https://closure-compiler.appspot.com/home#code%3D%252F%252F%...
That's the example from the site. "console.log('Hello world')" gets deobfuscated to "console[a(482)]("Hello World!");"
Re: JSFuck (2012)
#108Earlier quoted context omitted.
makes me sad to hear that :( I will say, as a reverse engineer, that javascript minifiers like closure compiler will optimize almost all obfuscation out, and the rest you can usually translate to a form which it can understand and then it will do the rest. The effect of obfuscation is not what you expect. It seems like it moves the whole difficulty up, but it only moves up the floor. By doing so it tends to remove al…
Do you consider Google Closure sufficiently good obfuscation?
I think closure compiler's 'obfuscation' is an incidental part of its minification passes.
Re: JSFuck (2012)
#109Earlier quoted context omitted.
That's an idiotic interview question. I've experienced this at young companies where both the company and its engineers are too immature to understand basic etiquette in the industry. Btw I doubt Google would ask a stupid "gotcha" question like that. They tend to ask hard algorithmic questions.
FWIW I’ve had Google recruiters ask me stuff where they don’t understand the answer and the questions are things like “what is the protocol number for ICMP” and “what port does NTP use”. If one doesn’t work with these things very often, they’re very forgettable as they’re so easy to google and find the correct answer to in seconds, and therefore not worth memorizing. No idea if they’re still doing this, but it was li…
> “what port does NTP use”.
I’d just Google it.
Re: JSFuck (2012)
#110Earlier quoted context omitted.
In case anyone is wondering, the answer is '' (empty string).
How can adding two empty arrays give you an empty string?
That's Javascript for you.
Summing arrays calls `.toString()` on them, and two empty string gives you a new empty string.
[].toString() === ''
[] + []
=== '' + ''
=== ''