Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering the obfuscated TikTok VM

github.com

Post reply on HN
Print view View original

41–50 of 131 posts

Re: Reverse engineering the obfuscated TikTok VM

#41

Post by noduerme »

supriyo-biswas wrote: post #18
noduerme wrote: post #8

Earlier quoted context omitted.

A generous take would be that they have their own internal GUI tools that make it easier for non-programmers to set up visual elements in this. That was historically the reason to invent VMs like Flash. A less generous take would account for the enormous potential for hiding nefarious code inside such a thing, and account for the nature of the government which deployed it, and conclude that it was a national security…

VM-based architectures are really common in the obfuscation space, which is why you have executable packers[1], JS packers[2] and bot management products[3][4] leveraging similar techniques. As for why the obfuscation is needed: bot management products suffer from a fundamental weakness in that ultimately, all of them simply collect static data from the environment, therefore it would make much more sense to make the…

[flagged]

Re: Reverse engineering the obfuscated TikTok VM

#42

Post by Scaevolus »

godelski wrote: post #3

This seems like quite a lot of work to hide the code. What would the legitimate reasons for this be? Because it looks like it would make the program less optimized and more complexity just leads to more errors. I understand the desire to make it harder for bots, but 1) it doesn't seem to be effective and bots seem to be going a very different route 2) there's got to be better ways that are more effective. It's not li…

Obfuscation is one part of defense in depth. Tiktok also has a variety of captchas to block scrapers, independent of this.

None of it's perfect, and they can be worked around, but by providing a barrier you've restricted some of the bad actors (spambots, scrapers) from acting at all.

It's easier to deal with 100 spambots than 1000!

Re: Reverse engineering the obfuscated TikTok VM

#43

Post by supriyo-biswas »

noduerme wrote: post #41
supriyo-biswas wrote: post #18

Earlier quoted context omitted.

VM-based architectures are really common in the obfuscation space, which is why you have executable packers[1], JS packers[2] and bot management products[3][4] leveraging similar techniques. As for why the obfuscation is needed: bot management products suffer from a fundamental weakness in that ultimately, all of them simply collect static data from the environment, therefore it would make much more sense to make the…

[flagged]

> Packers and obfuscators are not a "VM". It may look like a VM and act like a VM, in that it has opcodes that you can write to in another higher-level "language", but that is not a VM. It's in the same sandbox as the thing you're trying to obfuscate.

Indignant, caustic comments that simply discard all presented evidence such as this is the primary reason why people with the relevant experience have reduced their contributions on HN. I suspect I'll join their ranks too.

Re: Reverse engineering the obfuscated TikTok VM

#44

Post by saagarjha »

kleiba wrote: post #30

I've been using a shitty streaming website whose player interrupts the playback of a video in irregular intervals and presents a cryptic error message. I've started looking into the JavaScript code to see if I can't code up a work-around mechanism (basically debugging their garbage implementation), and of course (why actually?) their player code is also obfuscated. And I've gotta say, emplying an AI assistant has pro…

Is it truly obfuscated, or just minified?

Re: Reverse engineering the obfuscated TikTok VM

#45

Post by esseph »

klabetron wrote: post #35
kleiba wrote: post #33

Earlier quoted context omitted.

I've tried different ones, they all seem to do a great job.

Out of curiosity (as someone disappointingly new to prompt engineering), what’s an example prompt you used with some success?

Ask questions. Be disappointed in the outcomes.

Ask more questions. Get some right answers. Repeat.

Make question asking muscle get swole.

Re: Reverse engineering the obfuscated TikTok VM

#46

Post by noduerme »

MonkeyClub wrote: post #15
noduerme wrote: post #7

Earlier quoted context omitted.

Is calling a massive embedded JS obfuscator a "VM" a bit of a stretch? Ultimately it's not translating anything to a lower-level language. Still, I had no idea. This is really taking JS obfuscation to the next level. One kind of wonders, what is the purpose of that level of obfuscation? The naive take is that obfuscation is usually to protect intellectual property... but this is client-side code that wouldn't give aw…

> Is calling a massive embedded JS obfuscator a "VM" a bit of a stretch? Ultimately it's not translating anything to a lower-level language. From the Repo's README: "TikTok is using a full-fledged bytecode VM, if you browse through it, it supports scopes, nested functions and exception handling. This isn't a typical VM and shows that it is definitely sophiscated."

But that's basically an emulator of a VM, isn't it? It's like rewriting the Flash AVM2 into JS... it's still running in JS whereas the original VM was C++. It could JIT compile stuff but only because it literally was reserving memory that could overflow, and (semi-technical take here) from that advantage, of being closer to the metal, flowed all of the flaws in AVM2 that precipitated most of Adobe's woes with Flash. A VM implant in a web page that uses a plugin like Java or Flash, to get around running browser-sandboxed code, which can take over physical memory, is far different from just emulating a VM in Javascript. I wouldn't call writing a ton of opcodes in JS, which resolved to JS functions, a "virtual machine", because it isn't reserving anything or doing anything that Javascript can't do. Someone correct me here if I'm wrong... this is just heavy-duty obfuscation.

Also, one major purpose of a VM is to improve performance over what's available in the browser. If you use that as a measurement, this clearly doesn't fit that goal.

Re: Reverse engineering the obfuscated TikTok VM

#47

Post by saagarjha »

noduerme wrote: post #41
supriyo-biswas wrote: post #18

Earlier quoted context omitted.

VM-based architectures are really common in the obfuscation space, which is why you have executable packers[1], JS packers[2] and bot management products[3][4] leveraging similar techniques. As for why the obfuscation is needed: bot management products suffer from a fundamental weakness in that ultimately, all of them simply collect static data from the environment, therefore it would make much more sense to make the…

[flagged]

Amazing. Every word of what you said was wrong.

Re: Reverse engineering the obfuscated TikTok VM

#48

Post by esseph »

supriyo-biswas wrote: post #43
noduerme wrote: post #41

Earlier quoted context omitted.

[flagged]

> Packers and obfuscators are not a "VM". It may look like a VM and act like a VM, in that it has opcodes that you can write to in another higher-level "language", but that is not a VM. It's in the same sandbox as the thing you're trying to obfuscate. Indignant, caustic comments that simply discard all presented evidence such as this is the primary reason why people with the relevant experience have reduced their con…

If you explain what you disagree with, maybe people would learn something.

If you joint "their ranks", you've simply gone down the bit of the "social media + expertise" bell curve, where the more expertise you get on a particular topic, the less you want to engage about it in public.

This is not unique to any one field or realm of knowledge.

Re: Reverse engineering the obfuscated TikTok VM

#49

Post by SoKamil »

> As this is a Javascript file executed on the web, it is actually possible to replace the normal webmssdk.js with the deobfuscated file and use TikTok normally.

> This can be achieved by using two browser extensions known as Tampermonkey for executing custom code and CSP to disable CSP so I can fetch files from blocked origins. This is so I can put latestDeobf.js in my own file server and have it be fetched each time, this is so I can easily edit the file and let the changes take effect each time I refresh. This makes it much easier to bebug when reversing functions.

I believe you can achieve the same effect without any 3rd party extensions. You can use Local Overrides in Chrome DevTools.

Great work!

Re: Reverse engineering the obfuscated TikTok VM

#50

Post by supriyo-biswas »

esseph wrote: post #48
supriyo-biswas wrote: post #43

Earlier quoted context omitted.

> Packers and obfuscators are not a "VM". It may look like a VM and act like a VM, in that it has opcodes that you can write to in another higher-level "language", but that is not a VM. It's in the same sandbox as the thing you're trying to obfuscate. Indignant, caustic comments that simply discard all presented evidence such as this is the primary reason why people with the relevant experience have reduced their con…

If you explain what you disagree with, maybe people would learn something. If you joint "their ranks", you've simply gone down the bit of the "social media + expertise" bell curve, where the more expertise you get on a particular topic, the less you want to engage about it in public. This is not unique to any one field or realm of knowledge.

This is all correct, just that I'm lamenting the decline of technical discussions over uninformed positions and polarizing diatribes at a place I loved to come to be informed. /soapbox
Post reply on HN