Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JSFuck (2012)

jsfuck.com

Post reply on HN
Print view View original

161–168 of 168 posts

Re: JSFuck (2012)

#161

Post by zemnmez »

0xFF0123 wrote: post #139
zemnmez wrote: post #45

Earlier quoted context omitted.

makes me sad to hear that :( I will say, as a reverse engineer, that javascript minifiers like closure compiler will optimize almost all obfuscation out, and the rest you can usually translate to a form which it can understand and then it will do the rest. The effect of obfuscation is not what you expect. It seems like it moves the whole difficulty up, but it only moves up the floor. By doing so it tends to remove al…

Really enjoyed that blog post, thanks for linking it! How long would you say actually finding those two issues took? The attack surface must've been fairly large, but I guess intuition helps.

If I recall, the whole thing took about 6 hours

Re: JSFuck (2012)

#162

Post by raspasov »

zemnmez wrote: post #160
raspasov wrote: post #127

Earlier quoted context omitted.

Got it. Thank you. I've been using the Google Closure compiler for many years with advanced and every time I look at the code output I'm like "there's no way in a 100 years I would be able to de-obfuscate back to my own code to a great extent". But I don't specialize in reverse engineering, so I might be missing something big.

personally, I find the code it outputs to be easier to understand often than the source because it simplifies a lot of stuff into the most abstract logic. I think it takes some getting used to for your brain to connect those pieces, though

Fair enough, thank you.

I guess ultra-shortening the names into a,b,c,d,e, etc makes it superficially hard to understand what's going on but I agree on your point about abstract logic.

Re: JSFuck (2012)

#164

Post by _jsza »

stavros wrote: post #154
ByteJockey wrote: post #153

Earlier quoted context omitted.

Anyone familiar with JS is going to have some really good guesses at what a(482) is in this case. And, even if you don't, you can always call a(482)

Yes, but "obfuscated" means "To make so confused or opaque as to be difficult to perceive or understand". That's obfuscated, not deobfuscated.

Is that difficult? Harder, but still quite easy.

Re: JSFuck (2012)

#165

Post by stavros »

_jsza wrote: post #164
stavros wrote: post #154

Earlier quoted context omitted.

Yes, but "obfuscated" means "To make so confused or opaque as to be difficult to perceive or understand". That's obfuscated, not deobfuscated.

Is that difficult? Harder, but still quite easy.

My point was that the GP seems to have mixed the words "obfuscate" and "deobfuscate".

Re: JSFuck (2012)

#166

Post by zemnmez »

stavros wrote: post #165
_jsza wrote: post #164

Earlier quoted context omitted.

Is that difficult? Harder, but still quite easy.

My point was that the GP seems to have mixed the words "obfuscate" and "deobfuscate".

To clarify, that's what happens once you pass it through the obfuscation and THEN closure compiler. If you click the link you will see the obfuscation is much more complex

Re: JSFuck (2012)

#167

Post by stavros »

zemnmez wrote: post #166
stavros wrote: post #165

Earlier quoted context omitted.

My point was that the GP seems to have mixed the words "obfuscate" and "deobfuscate".

To clarify, that's what happens once you pass it through the obfuscation and THEN closure compiler. If you click the link you will see the obfuscation is much more complex

Oh, then I misunderstood and everyone should ignore this whole thread :P

Re: JSFuck (2012)

#168

Post by eyelidlessness »

fctorial wrote: post #151
justin_oaks wrote: post #39

Earlier quoted context omitted.

JavaScript can certainly be awesome, but the tricks that JSFuck relies on aren't "flexible". They're things that make you say "Wat?" https://www.destroyallsoftware.com/talks/wat

If your code adds two arrays together, there's something seriously wrong with your code. It isn't that different from divide by zero error.

A lot of other languages allow + to concatenate lists/arrays/sequences, even merge dicts/objects/maps. Languages that don’t have those semantics often have much safer and more idiomatic ways to join data structures (see lisps of all sorts) in ways you wouldn’t immediately expect if you’re coming from this perspective.

Adding two arrays together isn’t the problem, it’s a perfectly obvious thing to do. Adding two arrays together and getting a new language out of it is bonkers.

Edit to add: I work in JS/TS almost exclusively. This isn’t a chip on my shoulder criticizing a language I’m not invested in.

Post reply on HN