Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JavaScript Obfuscation Techniques by Example

trickster.dev

Post reply on HN
Print view View original

41–50 of 75 posts

Re: JavaScript Obfuscation Techniques by Example

#41

Post by zamadatix »

atwood22 wrote: post #38
Animats wrote: post #26

You want to see obfusication? Check out FreeSlots.com. Look at view source on one of the slot machines.[1] Can anyone decode this and figure out the odds generator? [1] view-source: https://www.freeslots.com/slot515.min.js?v=84

Why is the odds generator run on the client?

As long as the generator is seeded by the server and deterministic the only thing running the generator on the server for every spin would do is cost more money. In the rare situation a claim is made the server can run the spins in bulk with the same data it gave the client, if the results are different or the number of spins suspicious the claim is thrown out. If the client doesn't win anything (i.e. almost every client) the server doesn't need to do anything except serve the initial page.

Re: JavaScript Obfuscation Techniques by Example

#42

Post by atwood22 »

zamadatix wrote: post #41
atwood22 wrote: post #38

Earlier quoted context omitted.

Why is the odds generator run on the client?

As long as the generator is seeded by the server and deterministic the only thing running the generator on the server for every spin would do is cost more money. In the rare situation a claim is made the server can run the spins in bulk with the same data it gave the client, if the results are different or the number of spins suspicious the claim is thrown out. If the client doesn't win anything (i.e. almost every cl…

If the odds generator was only seeded by the server, but run on the client, you could test the next run locally before deciding to place a bet. How would that make sense?

Re: JavaScript Obfuscation Techniques by Example

#43

Post by jollybean »

pjbeam wrote: post #36
jollybean wrote: post #34

Earlier quoted context omitted.

Oh I love this. Take it one step further: hire sufficiently terrible spaghetti coders that nobody, not you or even they know what the code does, and any hacker trying to make sense of it will feel ill.

I'm imagining some state or APT engineers who, having reversed the mess, are then having very fraught discussions about what it could mean and getting the boss to bring in a specialist to figure out what they're missing.

So this is closer to reality than we might want to admit. I once had a terrible business idea that we laughed at internally and mentioned it to someone in the industry, who then promptly 'ripped it off'. Our 'secret' was not a great new product, it was actually a ridiculous concept.

Re: JavaScript Obfuscation Techniques by Example

#44

Post by efortis »

tjkoury wrote: post #40

A favorite trick of mine is to replace regular length variable names with absolutely massive ones that all share the same first 1024 characters, plays hell with debugger UIs and makes differentiation all but impossible without writing a custom lexer. Add into that a bit of Z̶͚͎̙̭͈͚͚̘͗̑̉̈́͌̆̀̚͝ă̶̡͉̠͍̻͔̯͔͖̪̤̤̫̓̽̏̉̎͌͒̆͘̕ḻ̴̡̡̝̫̠͇̻͎̥̲̜͆͌͑̍ͅg̸͈͒̏̀͂̈͊̂̾̑̈́̑͝o̴̡̙͍͉͓̘̮͗̏̒̂̃̏̓́̕ͅ and you’ve got a stew going, baby!

That reminded me of a base4 encoding using these characters: '0' 'O' '1' 'I'

The code looked like:

    var O11IOOO1I011 = 1

Re: JavaScript Obfuscation Techniques by Example

#45

Post by jknutson »

jollybean wrote: post #34
muhehe wrote: post #4

Why obfuscate, when you can just follow modern trends and use webpack (or similar) which gives you completely unreadable shit.

Oh I love this. Take it one step further: hire sufficiently terrible spaghetti coders that nobody, not you or even they know what the code does, and any hacker trying to make sense of it will feel ill.

If I don’t know what I am doing, surely my enemy cannot know what I am doing either…

Re: JavaScript Obfuscation Techniques by Example

#46

Post by darknavi »

efortis wrote: post #44
tjkoury wrote: post #40

A favorite trick of mine is to replace regular length variable names with absolutely massive ones that all share the same first 1024 characters, plays hell with debugger UIs and makes differentiation all but impossible without writing a custom lexer. Add into that a bit of Z̶͚͎̙̭͈͚͚̘͗̑̉̈́͌̆̀̚͝ă̶̡͉̠͍̻͔̯͔͖̪̤̤̫̓̽̏̉̎͌͒̆͘̕ḻ̴̡̡̝̫̠͇̻͎̥̲̜͆͌͑̍ͅg̸͈͒̏̀͂̈͊̂̾̑̈́̑͝o̴̡̙͍͉͓̘̮͗̏̒̂̃̏̓́̕ͅ and you’ve got a stew going, baby!

That reminded me of a base4 encoding using these characters: '0' 'O' '1' 'I' The code looked like: var O11IOOO1I011 = 1

No lowercase 'l' in there?

Re: JavaScript Obfuscation Techniques by Example

#47

Post by pcthrowaway »

Kiro wrote: post #25
peanut_worm wrote: post #16

If you obfuscate client side javascript that is being served in a browser you should get banned from the internet

Why would serving it in the browser or not matter? It's like saying all code should be open source, which is a valid opinion but I don't see why writing JavaScript and serving it in the browser would be any different. It's not like I automatically agree on making my code fully available just because I happen to target the web. Sure, you can de-obfuscate JS but you can also reverse engineer other software.

Users of the webpage can't determine whether they want to run the scripts from looking at the scripts if it's (well)obfuscated.

Very few users may even want to do this (perhaps none), but in theory it's a nice thing that has historically been made possible by the web. Unlike binaries or backend code, the user gets the source themselves to run in their browser... fine, if you want to obfuscate it you can, but I think it's fair for users to also dislike websites that do this.

I'm not talking about minifiers/bundlers which are used to make the content more user-friendly, I'm specifically talking about steps taken to make the web less accessible and less free.

Re: JavaScript Obfuscation Techniques by Example

#48

Post by michaelsbradley »

throwntoday wrote: post #30
melissalobos wrote: post #29

Earlier quoted context omitted.

To answer your question, yes. Someone absolutely can decode that and figure out the odds. If they couldn't then there would be less obfuscation used. A browser ABSOLUTELY has to be able to run the javascript. Anyone dedicated enough can de-compile that javascript to a program. Is it easy? No, but people do it all the time. I have had to deal with client that thought they could keep some bit of code secret on a browse…

I think what the parent meant was, can someone looking at it decode what is going on. Not asking whether it is possible in general.

That's why they wrote "Anyone dedicated enough can de-compile that javascript..."

Meaning, effectively, it can be de-obfuscated into code with control flow that's readily understood by a human, even if it would take some patience and practice (and the right tools) to perform the de-obfuscation.

Re: the FreeSlots.com program, https://deobfuscate.io shows that most of the obfuscation is related to decoding characters per some algorithm of their devising and eventually eval'ing the string as a JS program. There are likely several tricky rounds of that technique (and others) used at layers within the obfuscated code.

If the FreeSlots devs are clever, then they likely have a scheme to randomly generate the code they want (producing their desired result in terms of odds), where the random part is w.r.t. how the obfuscation layers are composed. Done well, that could make it rather difficult to mechanically de-obfuscate their code changing over time, i.e. without a human intervening to help identify the distinct layers because... parsers are hard.

Re: JavaScript Obfuscation Techniques by Example

#49

Post by efortis »

darknavi wrote: post #46
efortis wrote: post #44

Earlier quoted context omitted.

That reminded me of a base4 encoding using these characters: '0' 'O' '1' 'I' The code looked like: var O11IOOO1I011 = 1

No lowercase 'l' in there?

Probably.

---

This one binary encoded with tabs and spaces:

https://www.youtube.com/watch?v=cQY7klANahY

Re: JavaScript Obfuscation Techniques by Example

#50

Post by zamadatix »

atwood22 wrote: post #42
zamadatix wrote: post #41

Earlier quoted context omitted.

As long as the generator is seeded by the server and deterministic the only thing running the generator on the server for every spin would do is cost more money. In the rare situation a claim is made the server can run the spins in bulk with the same data it gave the client, if the results are different or the number of spins suspicious the claim is thrown out. If the client doesn't win anything (i.e. almost every cl…

If the odds generator was only seeded by the server, but run on the client, you could test the next run locally before deciding to place a bet. How would that make sense?

To clarify the claim a client makes on this site is that you have been around to make enough tokens to enter your info for the $500 monthly sweepstakes. Your slot results don't actually net you direct money or even improve your chances beyond being able to enter after a relatively low bar. Any server side validation would be to check you are a person who has been seeing ads and giving a real sellable email away instead of a bot trying to game the sweepstakes and, more importantly, lowering the resale value of the email list. Doing live server side hosting of every game spin would probably cost them more than they make, I'd be surprised if they even did the full level of server side validations available.
Post reply on HN