Why obfuscating JS when there is WASM?
Why WASM when you can create a full VM with its own custom bytecode implementation complete with nonsense instructions and compile to that.
This is how ReCaptcha is implemented, right?
JavaScript Obfuscation Techniques by Example
71–75 of 75 posts
Re: JavaScript Obfuscation Techniques by Example
#72Earlier quoted context omitted.
I gave it a 10 minute poke just for fun. My main enemy for the first few minutes was the browser trying to tell me I can't do things like eval/etc. Once I got that out of the way with some policy the next issue was the console not really being used to non-printable characters catching me up. In the end those two tricks (both I'm sure being a pain on purpose not by accident) netted me not getting very far as expected,…
JSNice[0] often does a good job deobfuscating js, the statistical renaming isn't foolproof but often useful. With it I get https://ghostbin.me/62d52999cc217 , from there it's decoding UTF-16 and at least one more decoding step (parts of decoded UTF-16 are mangled) to get the string j and the function o and resolving the original function with it. [0] http://jsnice.org/
Even easier: open up Chrome DevTools, add a breakpoint at the eval, step into function. Repeat a couple of times.
Comment at the top also points to https://freeslots.com/libs/mersenne-twister.js
Using those two together to decode the RNG function, and searching around for some more local pointers (with some judicious renaming of functions for legibility, and some comments):
// polyfill for IE??
function trunc(a) {
return a >> 5,
c = genrand_int32(a) >>> 6;
// (b a) return a + trunc(c * (b - a));
return a;
}
function Kma() {
// credits is `Lma`; if you want to cheat, you can edit that variable directly
credits There's then more to determine whether your state is a winner (based on the game mode), but I didn't feel like looking into that specifically.
Re: JavaScript Obfuscation Techniques by Example
#73Earlier quoted context omitted.
To answer your question, yes. Someone absolutely can decode that and figure out the odds. If they couldn't then there would be less obfuscation used. A browser ABSOLUTELY has to be able to run the javascript. Anyone dedicated enough can de-compile that javascript to a program. Is it easy? No, but people do it all the time. I have had to deal with client that thought they could keep some bit of code secret on a browse…
nothing special about code in a browser. there are regular reports from bug finders where they detail how they disassembled iOS or some native app etc and worked out how some exploit worked
The Hexrays decompilation plugin for ARM architecture works very fine and produces more readable code than this js :D
Re: JavaScript Obfuscation Techniques by Example
#74Why obfuscate, when you can just follow modern trends and use webpack (or similar) which gives you completely unreadable shit.
end of the day once you can apply a tool like ghidra to a given program, understanding what it is doing is straightforward unless they went to extremely great lengths beyond simple obfuscation
reversing is one of the few classic skills from the home computing era that is alive and well in 2022. it's kind of nice.