Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering the obfuscated TikTok VM

github.com

Post reply on HN
Print view View original

101–110 of 131 posts

Re: Reverse engineering the obfuscated TikTok VM

#101

Post by ctoth »

poincaredisk wrote: post #63
kleiba wrote: post #30

I've been using a shitty streaming website whose player interrupts the playback of a video in irregular intervals and presents a cryptic error message. I've started looking into the JavaScript code to see if I can't code up a work-around mechanism (basically debugging their garbage implementation), and of course (why actually?) their player code is also obfuscated. And I've gotta say, emplying an AI assistant has pro…

I'm surprised by this. As a professional reverse engineering I've actually found LLMs to be terrible at deobfuscation of JS (especially in the context of JS malware). But maybe my requirements are higher and it's actually OK for occasional use against weak packers?

Have you seen this?

https://github.com/jehna/humanify

What they do is ground the LLM to the AST with Babel to ensure you still get the same shape of AST out of your deobfuscation pass. Probably this tool could be cleaned up, made to work with multiple llm and parser backends, have its prompts improved, &c.

Re: Reverse engineering the obfuscated TikTok VM

#102

Post by Jasper_ »

Wowfunhappy wrote: post #57

...can I ask a really stupid question? What is a VM in this context? I've used VM's for years to run Windows on top of macOS or Linux on top of Windows or macOS on top of macOS when I need an isolated testing environment. I also know that Java works via the "Javascript Virtual Machine" which I've always thought of as "Java code actually runs in its own lightweight operating system on top of the host OS, which makes i…

The words "virtual machine" and "interpreter" are mostly interchangeable; they both refer to a mechanism to run a computer program not by compiling it to machine code, but to some intermediate "virtual" machine code which will then get run. The terminology is new, but the idea is older, "P-code" was the term we used to use before it fell out of favor.

Sun popularized the term "virtual machine" when marketing Java instead of using "interpreter" or "P-code", both for marketing reasons (VMware had just come on the scene and was making tech headlines), but also to get away from the perception of classic interpreters being slower than native code since Java had a JIT compiler. Just-in-time compilers that compiled to the host's machine code at runtime were well-known in research domains at the time, but were much less popular than the more dominant execution models of "AST interpreter" and "bytecode interpreter".

There might be some gatekeepers that suggest that "interpreter" means AST interpreter (not true for the Python interpreter, for instance), or VM always means JIT compiled (not true for Ruby, which calls its bytecode-based MRI "RubyVM" in a few places), but you can ignore them.

Re: Reverse engineering the obfuscated TikTok VM

#103

Post by Wowfunhappy »

yjftsjthsd-h wrote: post #92
Wowfunhappy wrote: post #57

...can I ask a really stupid question? What is a VM in this context? I've used VM's for years to run Windows on top of macOS or Linux on top of Windows or macOS on top of macOS when I need an isolated testing environment. I also know that Java works via the "Javascript Virtual Machine" which I've always thought of as "Java code actually runs in its own lightweight operating system on top of the host OS, which makes i…

Nit: > I also know that Java works via the "Javascript Virtual Machine" Java Virtual machine. That Java and JavaScript are named the way they are is... basically a historical accident of a cross-promotion gone too far, IMO. They aren't really related (at least, in the way that the name might imply). Now to your real question. Virtual machines are anything that is one computer pretending to be another computer. Someti…

> Java Virtual machine. That Java and JavaScript are named the way they are is... basically a historical accident of a cross-promotion gone too far

Oops, that was a typo! Thank you.

Re: Reverse engineering the obfuscated TikTok VM

#105

Post by xfeeefeee »

dmitrygr wrote: post #97
xfeeefeee wrote: post #2

The fascinating process of reverse engineering this VM is detailed here. TikTok uses a custom virtual machine (VM) as part of its obfuscation and security layers. This project includes tools to: Deobfuscate webmssdk.js that has the virtual machine. Decompile TikTok’s virtual machine instructions into readable form. Script Inject Replace webmssdk.js with the deobfuscated VM injector. Sign URLs Generate signed URLs whi…

What is the purpose of you posting a bad ChatGPT summary of the original post?

I quoted the synopsis from the readme thinking it would be helpful.

Re: Reverse engineering the obfuscated TikTok VM

#106

Post by SoKamil »

ImPostingOnHN wrote: post #82
wutwutwat wrote: post #73

Earlier quoted context omitted.

You can also install some trusted certs and MITM the requests, replacing the content with whatever you'd like Likely overkill for this use case, but no matter the client, you can in theory do whatever you want to any traffic up until the point it leaves your network.

what toolset do you use for on-the-fly translation? ad-hoc code, or something with a more structured workflow, maybe? this sounds like a fun thing to try, thanks for your time

Charles, Proxyman, or mitmproxy if you like open source + terminal would do the job.

Re: Reverse engineering the obfuscated TikTok VM

#107

Post by lazyeye »

fidotron wrote: post #40
ronsor wrote: post #4

There is no legitimate reason for a social media platform to employ this much obfuscation.

If you believe this you underestimate how adversarial the software world really is. TikTok will be on the receiving end of botnets by everything from commercial entities, state backed groups and criminals. They won't be betting that this stops that entirely, but it adds a layer of friction that is easy for them to change on a continuous basis. These things are also very good for leaving honeypots in where if someone…

Nah..I agree with the parent comment, there is simply no legitimate reason for a social media app to employ this level of obsfucation.

Re: Reverse engineering the obfuscated TikTok VM

#108

Post by specialist »

Loughla wrote: post #96
klabetron wrote: post #35

Earlier quoted context omitted.

Out of curiosity (as someone disappointingly new to prompt engineering), what’s an example prompt you used with some success?

For help with prompt engineering, take a graduate level grant writing course. It teaches you how to ask the right questions to get answers from humans and how to break down complicated processes into bite size pieces; really useable for llm's.

Heh. Probably also useful should a djinn ever grant you three wishes.

Re: Reverse engineering the obfuscated TikTok VM

#109

Post by lazyeye »

miohtama wrote: post #12
ronsor wrote: post #4

There is no legitimate reason for a social media platform to employ this much obfuscation.

It's to keep bots away and not turn to be another Twitter.

Because bots cant interact with web pages at the browser level like humans do...
Post reply on HN