Earlier quoted context omitted.
I think closure compiler's 'obfuscation' is an incidental part of its minification passes.
Got it. Thank you. I've been using the Google Closure compiler for many years with advanced and every time I look at the code output I'm like "there's no way in a 100 years I would be able to de-obfuscate back to my own code to a great extent". But I don't specialize in reverse engineering, so I might be missing something big.
JSFuck (2012)
141–150 of 168 posts
Re: JSFuck (2012)
#142Earlier quoted context omitted.
I think I might've actually analysed the code you're describing. We even made a few tweaks to the code so that you couldn't just reverse it back into JS This is why a lot of us keep our tools private... an old tradition of the cracking scene going back decades to the 80s. Think of things like IDA/Hexrays and Ghidra, then realise the most prolific crackers had similar private tools they had written many years before t…
>This is why a lot of us keep our tools private How ironic, that you want to open up other peoples code but keep your own hidden.
Re: JSFuck (2012)
#143Earlier quoted context omitted.
I think someone once asked me the simplified variant of that question. What is the result of: []+[] And I didn’t know the answer to that (I mean, who does that kind of fuckery in Javascript, you can’t sum arrays). I would have no chance with these Google level questions.
That's an idiotic interview question. I've experienced this at young companies where both the company and its engineers are too immature to understand basic etiquette in the industry. Btw I doubt Google would ask a stupid "gotcha" question like that. They tend to ask hard algorithmic questions.
Re: JSFuck (2012)
#144Past threads: JSFuck – esoteric JavaScript - https://news.ycombinator.com/item?id=9479834 - May 2015 (38 comments) JSFuck – Write any JavaScript with 6 Characters: []()!+ - https://news.ycombinator.com/item?id=6379732 - Sept 2013 (71 comments) JSFuck []()+ Use only 6 characters to write any JavaScript - https://news.ycombinator.com/item?id=4421848 - Aug 2012 (1 comment)
You're awesome dang. Thanks for the context.
Dang has his own tool, but it’s handy when he hasn’t done the search yet.
(The 1st such link, at the very top, emulates previous days’ front page.)
Re: JSFuck (2012)
#145Earlier quoted context omitted.
I'm curious: can you can undo the obfuscation of JScrambler and Obfuscator.io easily? Some time ago I tried to run both through Closure Compiler, but it was way harder than I thought would be.
JScrambler I actually did de-obfuscate to bypass some very significant bot detection a few years ago, but it took a bit more doing -- it uses ES6 features IIRC so I had to transpile it down to ES5 via babel first, but it worked OK after that. has a pretty good crack at obfuscator.io, too: https://closure-compiler.appspot.com/home#code%3D%252F%252F%... That's the example from the site. "console.log('Hello world')" get…
That does not look deobfuscated to me.
Re: JSFuck (2012)
#146I probably deserve to get downvoted to oblivion for this but... I've deployed JSFuck in production! We wanted to obfuscate this bit of code, to make life just a little bit harder for reverse engineers. We made this huge function where we pretty much passed in all our application state, and it would run this JSFuck code, and spit out a token. We even made a few tweaks to the code so that you couldn't just reverse it b…
makes me sad to hear that :( I will say, as a reverse engineer, that javascript minifiers like closure compiler will optimize almost all obfuscation out, and the rest you can usually translate to a form which it can understand and then it will do the rest. The effect of obfuscation is not what you expect. It seems like it moves the whole difficulty up, but it only moves up the floor. By doing so it tends to remove al…
Re: JSFuck (2012)
#147Earlier quoted context omitted.
Then why are you obfuscating it or even worried about people deobfuscating it? This thread is about Javascript.
Dude, I write financial applications in Node. Node IS javascript. These applications run on the back end. Some of the API facing VMs have been attacked and so to be honest I've configured them so that if someone did get access to them, they wouldn't find much. Maybe just some API keys I can invalidate. Although I probably won't do it -- an obfuscator like this could be very handy here.
Re: JSFuck (2012)
#148Earlier quoted context omitted.
Just making sure - you're using js source maps, right? The minifaction should be adding significant pain in your debugging process.
Source maps are used for anti-debugging: https://www.perimeterx.com/tech-blog/2019/javascript-anti-de...
Re: JSFuck (2012)
#149New interview question: What will be the result of running the following code? [][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[ ]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[] ])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+ (!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+ !+[]+[+[]]]+(![]+[])[!+[]+!+[…
I think someone once asked me the simplified variant of that question. What is the result of: []+[] And I didn’t know the answer to that (I mean, who does that kind of fuckery in Javascript, you can’t sum arrays). I would have no chance with these Google level questions.
Re: JSFuck (2012)
#150Earlier quoted context omitted.
This kind of thing does happen in the wild, through no fault of anyone in arms' reach, in particular when service APIs change in subtle and unexpected ways. You might have a service that yesterday returned a JSON payload: { tasks: 5, ... } but today returns: { tasks: [{...}, ...], ...} If you had an array of these objects and were trying to sum the count of tasks, now your code returns weird results. Knowing how the…
Sure, but in the wild, you would actually run the thing in the repl to see what it does. So either you know the answer or you don't and it doesn't affect whether or not you can do the job well. In my opinion binary knowledge-based questions are seldom useful unless you specifically are checking for that exact knowledge. You can have someone who is totally terrible in general but just knows that one thing or the answe…
In practice, unless you have some extremely pedantic, end to end testing, your first hint that something is going wrong is probably going to be malformed output. TypeScript won't catch this error because it doesn't do runtime checking, it trusts that type annotations are correct. It's very possible for code like this to pass through without causing any exceptions to throw. Indeed, JavaScript was originally designed to "keep on trucking" in this way, and that's why we have this degree of type coercion. So you're going to be working backwards from a result rather than forward from a source. If you already know how your code works and you see a weird result like that, knowing the type coercion gotchas can help you work backwards to understanding where the change occurred.
But in the former issue, I don't think the question on its own is bad for job interviews. How the question is used is what determines if it's good or bad. For example, it is a little unreasonable to expect people to know every single, little gotcha in JavaScript and the exact way in which they misbehave. But I do think it's reasonable to expect people to know that there are gotchas and that this is a common one. I'd accept as a valid answer, "I don't know the exact results, but I do know that this doesn't concatenate arrays and instead does something unexpected".