Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering the obfuscated TikTok VM

github.com

Post reply on HN
Print view View original

61–70 of 131 posts

Re: Reverse engineering the obfuscated TikTok VM

#61

Post by turtleyacht »

Wowfunhappy wrote: post #57

...can I ask a really stupid question? What is a VM in this context? I've used VM's for years to run Windows on top of macOS or Linux on top of Windows or macOS on top of macOS when I need an isolated testing environment. I also know that Java works via the "Javascript Virtual Machine" which I've always thought of as "Java code actually runs in its own lightweight operating system on top of the host OS, which makes i…

Virtual Machine Decompiling: https://github.com/LukasOgunfeitimi/TikTok-ReverseEngineerin...

And also VM223, with statements that do stuff to an array "stack": https://github.com/LukasOgunfeitimi/TikTok-ReverseEngineerin...

One obvious giveaway for a VM is laying out memory, or processing some intermediate language. In this case, it could be the latter.

In-browser, you have Chrome V8 running Javascript; that Javascript could be running an interpreted environment where abstractions are not purely business logic, but an execution model separate from domain stuff: auth, video, user, etc.

By that observation, this C snippet is a VM:

  char instruction = 'p'; /* or array */

  if (instruction == 'p') {
    println("document.appendChild(...)");
  }
If the program outputs to a vm.js file, it's kinda-sorta a "VM." I would call it something else, maybe a generator of sorts (for now). Just in my opinion, for me, if I were working on a VM, the threshold of calling it that would be much higher than the above.

On the other hand, if I had to comment in the generated Javascript debugging hints referring to execution stack or stack pointers, it is kind of a VM idea.

Re: Reverse engineering the obfuscated TikTok VM

#62

Post by [deleted] »

noduerme wrote: post #56
esseph wrote: post #48

Earlier quoted context omitted.

If you explain what you disagree with, maybe people would learn something. If you joint "their ranks", you've simply gone down the bit of the "social media + expertise" bell curve, where the more expertise you get on a particular topic, the less you want to engage about it in public. This is not unique to any one field or realm of knowledge.

It's also a learning experience on both sides if people who have the knowledge share it with others. Teaching is a great way to learn; I exercise a great deal in my mind when I'm not working by trying to help other people solve problems.

[deleted]

Re: Reverse engineering the obfuscated TikTok VM

#63

Post by poincaredisk »

kleiba wrote: post #30

I've been using a shitty streaming website whose player interrupts the playback of a video in irregular intervals and presents a cryptic error message. I've started looking into the JavaScript code to see if I can't code up a work-around mechanism (basically debugging their garbage implementation), and of course (why actually?) their player code is also obfuscated. And I've gotta say, emplying an AI assistant has pro…

I'm surprised by this. As a professional reverse engineering I've actually found LLMs to be terrible at deobfuscation of JS (especially in the context of JS malware). But maybe my requirements are higher and it's actually OK for occasional use against weak packers?

Re: Reverse engineering the obfuscated TikTok VM

#64

Post by oefrha »

esseph wrote: post #48
supriyo-biswas wrote: post #43

Earlier quoted context omitted.

> Packers and obfuscators are not a "VM". It may look like a VM and act like a VM, in that it has opcodes that you can write to in another higher-level "language", but that is not a VM. It's in the same sandbox as the thing you're trying to obfuscate. Indignant, caustic comments that simply discard all presented evidence such as this is the primary reason why people with the relevant experience have reduced their con…

If you explain what you disagree with, maybe people would learn something. If you joint "their ranks", you've simply gone down the bit of the "social media + expertise" bell curve, where the more expertise you get on a particular topic, the less you want to engage about it in public. This is not unique to any one field or realm of knowledge.

> I can't think of a scenario where you'd need to deconstruct their front-end to mimic the calls. Just observe the calls and mimic them.

Just about everything in that wall of text is wrong, but it’s rather pointless to engage someone who clearly has never reverse engineered a single thing with a modicum of defense, yet has tons of opinions on the subject. It’s like debating the pros and cons of programming languages with someone whose claim of expertise is having used computers. I totally get gp’s frustration. Denial of service with too many absurd points is real.

> If you explain what you disagree with, maybe people would learn something.

TFA explains in detail why reverse engineering is necessary, and specifically what is achieved by reverse engineering which part. ggp clearly has zero interest in learning when much of what they wrote has been refuted in the damn post being discussed. Other people can RTFA to learn as well, it’s a good technical post, and we don’t get enough of those these days.

Re: Reverse engineering the obfuscated TikTok VM

#65

Post by supriyo-biswas »

oefrha wrote: post #64
esseph wrote: post #48

Earlier quoted context omitted.

If you explain what you disagree with, maybe people would learn something. If you joint "their ranks", you've simply gone down the bit of the "social media + expertise" bell curve, where the more expertise you get on a particular topic, the less you want to engage about it in public. This is not unique to any one field or realm of knowledge.

> I can't think of a scenario where you'd need to deconstruct their front-end to mimic the calls. Just observe the calls and mimic them. Just about everything in that wall of text is wrong, but it’s rather pointless to engage someone who clearly has never reverse engineered a single thing with a modicum of defense, yet has tons of opinions on the subject. It’s like debating the pros and cons of programming languages…

> Denial of service with too many absurd points is real.

Otherwise also known as sealioning: https://en.wikipedia.org/wiki/Sealioning

Re: Reverse engineering the obfuscated TikTok VM

#66

Post by TheDong »

dns_snek wrote: post #36
bolognafairy wrote: post #21

Earlier quoted context omitted.

That doesn’t mean that it’s “probably not the intention”.

The balance of evidence suggests otherwise. If they cared about spam bots they would take action when spammers are handed to them on a silver platter. The kinds of spammers who will leave 30 identical comments advertising illegal services, not some weird moderation corner case. If you ever end up on a video that's related to drugs, there will be entire chains of bots just advertising to each other and TikTok won't fi…

So you're saying that TikTok's support team doing a poor job of handling reports is proof that the engineering team wasn't tasked with reducing spam by writing code obfuscation?

TikTok is a huge company, evidence of what the support department does or doesn't do has only minor bearing on the whole company, and basically none on the engineering department.

The thing that seems most likely to me is that they care about spam, the engineering department did this one thing, and the support department is either overworked or cares less. Or really efficient which is why you only see "a lot of spam", not "literally nothing but spam".

Re: Reverse engineering the obfuscated TikTok VM

#67

Post by wpietri »

dns_snek wrote: post #36
bolognafairy wrote: post #21

Earlier quoted context omitted.

That doesn’t mean that it’s “probably not the intention”.

The balance of evidence suggests otherwise. If they cared about spam bots they would take action when spammers are handed to them on a silver platter. The kinds of spammers who will leave 30 identical comments advertising illegal services, not some weird moderation corner case. If you ever end up on a video that's related to drugs, there will be entire chains of bots just advertising to each other and TikTok won't fi…

A large company is much less cohesive than you realize. You can't reliably reason about the goals of one part because another part isn't consistent. This particular difference could easily be explained by insufficient funding to moderation, which is endemic in social media.

Re: Reverse engineering the obfuscated TikTok VM

#68

Post by johann8384 »

saagarjha wrote: post #44
kleiba wrote: post #30

I've been using a shitty streaming website whose player interrupts the playback of a video in irregular intervals and presents a cryptic error message. I've started looking into the JavaScript code to see if I can't code up a work-around mechanism (basically debugging their garbage implementation), and of course (why actually?) their player code is also obfuscated. And I've gotta say, emplying an AI assistant has pro…

Is it truly obfuscated, or just minified?

Well the example in the article was obfuscated with several specific examples.

Re: Reverse engineering the obfuscated TikTok VM

#70

Post by noduerme »

oefrha wrote: post #64
esseph wrote: post #48

Earlier quoted context omitted.

If you explain what you disagree with, maybe people would learn something. If you joint "their ranks", you've simply gone down the bit of the "social media + expertise" bell curve, where the more expertise you get on a particular topic, the less you want to engage about it in public. This is not unique to any one field or realm of knowledge.

> I can't think of a scenario where you'd need to deconstruct their front-end to mimic the calls. Just observe the calls and mimic them. Just about everything in that wall of text is wrong, but it’s rather pointless to engage someone who clearly has never reverse engineered a single thing with a modicum of defense, yet has tons of opinions on the subject. It’s like debating the pros and cons of programming languages…

k, you're saying you can't understand the obfuscated bullet they're sending to the backend unless you understand how it's turned into a particular nut on the front, and understand both sides of the request. I see how that makes sense, if you can't even figure out how to decipher the requests as you read them going out. Is that what you're trying to say? If so, say it, rather this this "wall of text" about why technical posts are scarce and bla bla bla. I'm more interested in the reason for this kind of obfuscation (and no, I don't think it's just to protect against bots, as there are many ways to do that).
Post reply on HN