Live data from Hacker News

Reverse engineering the obfuscated TikTok VM

github.com

31–40 of 131 posts

Re: Reverse engineering the obfuscated TikTok VM

#31
post #30

I've been using a shitty streaming website whose player interrupts the playback of a video in irregular intervals and presents a cryptic error message. I've started looking into the JavaScript code to see if I can't code up a work-around mechanism (basically debugging their garbage implementation), and of course (why actually?) their player code is also obfuscated. And I've gotta say, emplying an AI assistant has pro…

Which AI agents did you use?

Re: Reverse engineering the obfuscated TikTok VM

#33
post #31
post #30

I've been using a shitty streaming website whose player interrupts the playback of a video in irregular intervals and presents a cryptic error message. I've started looking into the JavaScript code to see if I can't code up a work-around mechanism (basically debugging their garbage implementation), and of course (why actually?) their player code is also obfuscated. And I've gotta say, emplying an AI assistant has pro…

Which AI agents did you use?

I've tried different ones, they all seem to do a great job.

Re: Reverse engineering the obfuscated TikTok VM

#35
post #33
post #31

Earlier quoted context omitted.

Which AI agents did you use?

I've tried different ones, they all seem to do a great job.

Out of curiosity (as someone disappointingly new to prompt engineering), what’s an example prompt you used with some success?

Re: Reverse engineering the obfuscated TikTok VM

#36

Earlier quoted context omitted.

That's probably not the goal. There are bots advertising illegal services (e.g. ads for "hacking services", illegal drugs) in most comment sections. If you report these comments, 99.9% of the time the report will be rejected with "no violations found" and the spam stays up.

That doesn’t mean that it’s “probably not the intention”.

The balance of evidence suggests otherwise. If they cared about spam bots they would take action when spammers are handed to them on a silver platter. The kinds of spammers who will leave 30 identical comments advertising illegal services, not some weird moderation corner case.

If you ever end up on a video that's related to drugs, there will be entire chains of bots just advertising to each other and TikTok won't find any violations when reported. But sure, I'm sure they care a whole lot about not ending up like Twitter.

Re: Reverse engineering the obfuscated TikTok VM

#39
post #7

Earlier quoted context omitted.

Is calling a massive embedded JS obfuscator a "VM" a bit of a stretch? Ultimately it's not translating anything to a lower-level language. Still, I had no idea. This is really taking JS obfuscation to the next level. One kind of wonders, what is the purpose of that level of obfuscation? The naive take is that obfuscation is usually to protect intellectual property... but this is client-side code that wouldn't give aw…

You are replying to a comment that looks extremely unhuman.

It looks like OP filled out the text area alongside with the URL when submitting the post.

HN takes that text and turns it into a comment. I’ve seen it happen before.

The unfortunate outcome of that IMO is that sometimes text that makes sense as a description of a submission feels a bit out of place as a comment due to how they are worded. And these comments sometimes then end up getting downvoted.

I wouldn’t be completely sure it was not human written. Even though it feels a bit weird to read it as a comment.

Re: Reverse engineering the obfuscated TikTok VM

#40
post #4

There is no legitimate reason for a social media platform to employ this much obfuscation.

If you believe this you underestimate how adversarial the software world really is. TikTok will be on the receiving end of botnets by everything from commercial entities, state backed groups and criminals.

They won't be betting that this stops that entirely, but it adds a layer of friction that is easy for them to change on a continuous basis. These things are also very good for leaving honeypots in where if someone is found to still be using something after a change you can tag them as a bot or otherwise hacking. Both of those approaches are also widely used in game anti-cheat mechanisms, and as shown there the lengths people will go to anyway are completely insane.

Post reply on HN