Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JavaScript Obfuscation Techniques by Example

trickster.dev

Post reply on HN
Print view View original

61–70 of 75 posts

Re: JavaScript Obfuscation Techniques by Example

#61

Post by captainbland »

etamponi wrote: post #8

Sorry for the slightly offtopic question: this page caused Chrome on my mobile phone to freeze completely. I had to reboot my phone, and even after that, I had to figure out a way to close the tab without opening Chrome. Did it happen to someone else?

Had the same problem. The browser was essentially soft locked as the tab would be brought back after restarting the app until I cleared Chrome's storage which closes all tabs (and clears history, cookies, etc. too which is a bit annoying).

Re: JavaScript Obfuscation Techniques by Example

#63

Post by kekebo »

zamadatix wrote: post #39
Animats wrote: post #26

You want to see obfusication? Check out FreeSlots.com. Look at view source on one of the slot machines.[1] Can anyone decode this and figure out the odds generator? [1] view-source: https://www.freeslots.com/slot515.min.js?v=84

I gave it a 10 minute poke just for fun. My main enemy for the first few minutes was the browser trying to tell me I can't do things like eval/etc. Once I got that out of the way with some policy the next issue was the console not really being used to non-printable characters catching me up. In the end those two tricks (both I'm sure being a pain on purpose not by accident) netted me not getting very far as expected,…

JSNice[0] often does a good job deobfuscating js, the statistical renaming isn't foolproof but often useful.

With it I get https://ghostbin.me/62d52999cc217 , from there it's decoding UTF-16 and at least one more decoding step (parts of decoded UTF-16 are mangled) to get the string j and the function o and resolving the original function with it.

[0] http://jsnice.org/

Re: JavaScript Obfuscation Techniques by Example

#65

Post by selfmodruntime »

uetttyywwww wrote: post #24
ffhhj wrote: post #3

Why obfuscating JS when there is WASM?

Why WASM when you can create a full VM with its own custom bytecode implementation complete with nonsense instructions and compile to that.

An incredibly cool example of this is the newest iteration of the HIVE malware which does exactly that. They build a custom VM via RCE in a buggy image format parser which allowed them to execute custom code on an iOS device.

Re: JavaScript Obfuscation Techniques by Example

#66

Post by aardshark »

Something else that sites do, which is not really deobfuscation, but an anti-debugger technique, is to run a loop checking whether the DevTools are open and crash the page via catastrophic regex backtracking if they are.

You can get around this by intercepting the request and returning a copy of the js with this check patched out, but it's just another hurdle in the way of casual inspection.

Re: JavaScript Obfuscation Techniques by Example

#67

Post by aardshark »

Animats wrote: post #26

You want to see obfusication? Check out FreeSlots.com. Look at view source on one of the slot machines.[1] Can anyone decode this and figure out the odds generator? [1] view-source: https://www.freeslots.com/slot515.min.js?v=84

The code goes through a few eval steps first. Here is what is finally evaled -- you can replace the whole file with this for the same result: https://paste.ee/p/VTgj8

Figuring out the odds generator...is a task I will leave to someone else :)

Re: JavaScript Obfuscation Techniques by Example

#68

Post by LoganDark »

aardshark wrote: post #66

Something else that sites do, which is not really deobfuscation, but an anti-debugger technique, is to run a loop checking whether the DevTools are open and crash the page via catastrophic regex backtracking if they are. You can get around this by intercepting the request and returning a copy of the js with this check patched out, but it's just another hurdle in the way of casual inspection.

Then it turns out the anti-debugger code was contained in a function that gets stringified, so if you change the source code at all, the script stops working. So you have to manually substitute usages of the function-as-string with the string representation of the original obfuscated function...

Re: JavaScript Obfuscation Techniques by Example

#69

Post by LoganDark »

cfcf14 wrote: post #64

Interestingly enough, passing even the most complex example in the link to GPT-3 with the prompt "What does this code output when run?" returns the correct result.

Now I wonder if it's possible to train a neural network to run JavaScript. Or lay out a web page.

Re: JavaScript Obfuscation Techniques by Example

#70

Post by LoganDark »

uetttyywwww wrote: post #24
ffhhj wrote: post #3

Why obfuscating JS when there is WASM?

Why WASM when you can create a full VM with its own custom bytecode implementation complete with nonsense instructions and compile to that.

This is already what (a lot of) Lua obfuscators do for game cheats, since Lua has a reference implementation that generates bytecode, that can be easily modified to generate the most awful, encrypted, obfuscated mess ever.
Post reply on HN