Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JSFuck (2012)

jsfuck.com

Post reply on HN
Print view View original

121–130 of 168 posts

Re: JSFuck (2012)

#121

Post by z3t4 »

ollyfg wrote: post #19

I probably deserve to get downvoted to oblivion for this but... I've deployed JSFuck in production! We wanted to obfuscate this bit of code, to make life just a little bit harder for reverse engineers. We made this huge function where we pretty much passed in all our application state, and it would run this JSFuck code, and spit out a token. We even made a few tweaks to the code so that you couldn't just reverse it b…

A further obfuscation you could also compress it and have the app unpack itself.

eJztVUESwyAIfAs3GJ60w/+/UZKiUUwzztT20OZiwgIbWJXAwARTmMAX02qRr0o9Vu02xRmwgKUPTzHv0weu8bGtZFhKyKSnTK0Z/parAJ/VI5WyXp7Uo/HYNc3qNchzKWBACnpCK3uj3N1Quvs6qCSJ4Gvah+++VT9/q3AlWLH5Pg3/cRqO94lR5SM5T6rDKSelDOUKC0+EzQ36l5N/zR7lDqti9Xjsj3U71f4AduQBlR9rUg==

Re: JSFuck (2012)

#122

Post by int0x2e »

classichasclass wrote: post #50
ollyfg wrote: post #19

I probably deserve to get downvoted to oblivion for this but... I've deployed JSFuck in production! We wanted to obfuscate this bit of code, to make life just a little bit harder for reverse engineers. We made this huge function where we pretty much passed in all our application state, and it would run this JSFuck code, and spit out a token. We even made a few tweaks to the code so that you couldn't just reverse it b…

I understand the frustration, but as someone having to debug browser bugs with JavaScript edge cases, minified (and in this case ultra-obfuscated) JS is hell on earth to untangle and I wish people wouldn't.

Just making sure - you're using js source maps, right? The minifaction should be adding significant pain in your debugging process.

Re: JSFuck (2012)

#123

Post by catchaway_4v93a »

ollyfg wrote: post #19

I probably deserve to get downvoted to oblivion for this but... I've deployed JSFuck in production! We wanted to obfuscate this bit of code, to make life just a little bit harder for reverse engineers. We made this huge function where we pretty much passed in all our application state, and it would run this JSFuck code, and spit out a token. We even made a few tweaks to the code so that you couldn't just reverse it b…

Interesting. I can definitely relate. As an author of a proprietary application written in web technologies, it's easy to be envious of compiled languages.

This is my recipe for minification:

1. Apply a convention where all class properties and methods have to end with a trailing underscore (it's trivial to make an Eslint rule to enforce it)

2. Use 2 minification tools in following order: Closure Compiler (simple optimizations mode), then Terser for best output.

3. Configure Terser mangle.properties.regex: /_$/

4. If it's a desktop app, use Bytenode for Node.js processes (cannot be used for the renderer)

Re: JSFuck (2012)

#124

Post by hungryforcodes »

TeMPOraL wrote: post #120
hungryforcodes wrote: post #61

Earlier quoted context omitted.

Why are you reverse engineering my code in the first place?

Because you gave it to me to run it. I want to know what is it exactly that I'm running. Also, why do you mind me doing that?

No, I didn't give it to you to run. It's explained below if you read the whole thread.

Re: JSFuck (2012)

#125

Post by MrQuincle »

zemnmez wrote: post #45
ollyfg wrote: post #19

I probably deserve to get downvoted to oblivion for this but... I've deployed JSFuck in production! We wanted to obfuscate this bit of code, to make life just a little bit harder for reverse engineers. We made this huge function where we pretty much passed in all our application state, and it would run this JSFuck code, and spit out a token. We even made a few tweaks to the code so that you couldn't just reverse it b…

makes me sad to hear that :( I will say, as a reverse engineer, that javascript minifiers like closure compiler will optimize almost all obfuscation out, and the rest you can usually translate to a form which it can understand and then it will do the rest. The effect of obfuscation is not what you expect. It seems like it moves the whole difficulty up, but it only moves up the floor. By doing so it tends to remove al…

Makes me think of what might deter a reverse engineer and then this most awesome youtube talk on psychological warfare by Chris Domas

https://youtu.be/HlUe0TUHOIc

It's so good.

Re: JSFuck (2012)

#126

Post by veb »

zemnmez wrote: post #45
ollyfg wrote: post #19

I probably deserve to get downvoted to oblivion for this but... I've deployed JSFuck in production! We wanted to obfuscate this bit of code, to make life just a little bit harder for reverse engineers. We made this huge function where we pretty much passed in all our application state, and it would run this JSFuck code, and spit out a token. We even made a few tweaks to the code so that you couldn't just reverse it b…

makes me sad to hear that :( I will say, as a reverse engineer, that javascript minifiers like closure compiler will optimize almost all obfuscation out, and the rest you can usually translate to a form which it can understand and then it will do the rest. The effect of obfuscation is not what you expect. It seems like it moves the whole difficulty up, but it only moves up the floor. By doing so it tends to remove al…

Thanks for the link to that blog post, really interesting!

Re: JSFuck (2012)

#127

Post by raspasov »

zemnmez wrote: post #108
raspasov wrote: post #91

Earlier quoted context omitted.

Do you consider Google Closure sufficiently good obfuscation?

I think closure compiler's 'obfuscation' is an incidental part of its minification passes.

Got it. Thank you.

I've been using the Google Closure compiler for many years with advanced and every time I look at the code output I'm like "there's no way in a 100 years I would be able to de-obfuscate back to my own code to a great extent". But I don't specialize in reverse engineering, so I might be missing something big.

Re: JSFuck (2012)

#128

Post by woojoo666 »

zemnmez wrote: post #45
ollyfg wrote: post #19

I probably deserve to get downvoted to oblivion for this but... I've deployed JSFuck in production! We wanted to obfuscate this bit of code, to make life just a little bit harder for reverse engineers. We made this huge function where we pretty much passed in all our application state, and it would run this JSFuck code, and spit out a token. We even made a few tweaks to the code so that you couldn't just reverse it b…

makes me sad to hear that :( I will say, as a reverse engineer, that javascript minifiers like closure compiler will optimize almost all obfuscation out, and the rest you can usually translate to a form which it can understand and then it will do the rest. The effect of obfuscation is not what you expect. It seems like it moves the whole difficulty up, but it only moves up the floor. By doing so it tends to remove al…

While I think itcs bad to use obfuscation to hide security holes, I do think obfuscation has it's uses. If there's reasons to make data private, then there's reasons to make execution private as well. Not to mention, it was recently proved that indistinguishable obfuscation is possible, so I'm not sure how useful de-obfuscation tools will be in the future

Re: JSFuck (2012)

#129

Post by egberts1 »

I don’t bother with obfuscated JavaScript codes; I hook the equal operators for all strings and arrays then look for URL patterns. L33t!

Re: JSFuck (2012)

#130

Post by dorgo »

dylan604 wrote: post #57
Aeolun wrote: post #43

Earlier quoted context omitted.

I think someone once asked me the simplified variant of that question. What is the result of: []+[] And I didn’t know the answer to that (I mean, who does that kind of fuckery in Javascript, you can’t sum arrays). I would have no chance with these Google level questions.

looks like you need to watch the WAT talk https://www.destroyallsoftware.com/talks/wat

[] + {} is not an object but a string.
Post reply on HN