81–90 of 131 posts
Earlier quoted context omitted.
[flagged]
> Packers and obfuscators are not a "VM". It may look like a VM and act like a VM, in that it has opcodes that you can write to in another higher-level "language", but that is not a VM. It's in the same sandbox as the thing you're trying to obfuscate. Indignant, caustic comments that simply discard all presented evidence such as this is the primary reason why people with the relevant experience have reduced their con…
> As this is a Javascript file executed on the web, it is actually possible to replace the normal webmssdk.js with the deobfuscated file and use TikTok normally. > This can be achieved by using two browser extensions known as Tampermonkey for executing custom code and CSP to disable CSP so I can fetch files from blocked origins. This is so I can put latestDeobf.js in my own file server and have it be fetched each tim…
You can also install some trusted certs and MITM the requests, replacing the content with whatever you'd like Likely overkill for this use case, but no matter the client, you can in theory do whatever you want to any traffic up until the point it leaves your network.
ad-hoc code, or something with a more structured workflow, maybe?
this sounds like a fun thing to try, thanks for your time
Earlier quoted context omitted.
Which AI agents did you use?
I've tried different ones, they all seem to do a great job.
Is TikTok so obfuscated to prevent people from knowing the full extent of data collection and device fingerprinting?
1. Practically speaking all this javascript fingerprinting pales in comparison to what native apps have access to. Most people aren't using tiktok on their browsers, and the browser version heavily pushes you to using the app, so you should be far more worried about whatever's happening in the app. 2. Despite tiktok having a giant target painted on its back for its perceived connections to the CCP, I haven't really s…
Take a look for request parameters in TikTok vs. Instagram for example.
Every request for TikTok forces you to pass most of the information that browser can collect from the end-user before server responds:
Earlier quoted context omitted.
You are replying to a comment that looks extremely unhuman.
It looks like OP filled out the text area alongside with the URL when submitting the post. HN takes that text and turns it into a comment. I’ve seen it happen before. The unfortunate outcome of that IMO is that sometimes text that makes sense as a description of a submission feels a bit out of place as a comment due to how they are worded. And these comments sometimes then end up getting downvoted. I wouldn’t be comp…
Yeah, this is exactly what happened, but I decided to keep it rather than delete and filled it out more with the synopsis from the repo.
Looking back at it, it really does look like an AI bulleted summary. I probably should have noted that the last part was indeed a quotation.
Earlier quoted context omitted.
1. Practically speaking all this javascript fingerprinting pales in comparison to what native apps have access to. Most people aren't using tiktok on their browsers, and the browser version heavily pushes you to using the app, so you should be far more worried about whatever's happening in the app. 2. Despite tiktok having a giant target painted on its back for its perceived connections to the CCP, I haven't really s…
> 2. Despite tiktok having a giant target painted on its back for its perceived connections to the CCP, I haven't really seen any evidence that it does any more tracking/fingerprinting that most other websites (eg. facebook) or security services (eg. cloudflare or recaptcha) already do. Take a look for request parameters in TikTok vs. Instagram for example. Every request for TikTok forces you to pass most of the info…
Half of the parameters are stuff relating to the app itself, or could be inferred from other sources like user-agent. The other fingerprinting stuff (eg. canvas or webgl fingerprinting) is basically industry standard and by no means unique to tiktok. Even the claim that "browser can collect from the end-user before server responds" doesn't hold up to scrutiny, because there's no meaningful difference between that, and browser check interstitials (eg. the cloudflare checkbox), which fingerprint you before letting you access the content. It's also unclear how that's more sinister than the alternative approach of sending telemetry/fingerprinting data to a separate endpoint.
This seems like quite a lot of work to hide the code. What would the legitimate reasons for this be? Because it looks like it would make the program less optimized and more complexity just leads to more errors. I understand the desire to make it harder for bots, but 1) it doesn't seem to be effective and bots seem to be going a very different route 2) there's got to be better ways that are more effective. It's not li…
Very impressive work! I always enjoy a good write up about reverse engineering efforts and yours was really simple to follow. Many popular/large websites and bot protection services usually have environment checking as a baseline and mouse-movement tracking in some of the more aggressive anti-bot checks. It's always interesting to see how long it takes from when the measures have been defeated/publicised until the se…
I was sharing this here since I thought it was a great write up, but did not intend to pass it off as my own!
There is certainly always a good amount of push and pull, though my personal concern as a contributor to yt-dlp under another alias is more about archival of the underlying media rather than automating things like comments.
YouTube also uses an interesting scheme for authenticating requests for media as well which required implementing a very basic JavaScript interpreter within Python for yt-dlp too. I expect this kind of thing to continue to become even more common and complicated.
Earlier quoted context omitted.
VM-based architectures are really common in the obfuscation space, which is why you have executable packers[1], JS packers[2] and bot management products[3][4] leveraging similar techniques. As for why the obfuscation is needed: bot management products suffer from a fundamental weakness in that ultimately, all of them simply collect static data from the environment, therefore it would make much more sense to make the…
[flagged]
The article mentioned that important API calls are signed. So you would need at least partially to deconstruct their front-end to invoke the calls.
Any other nefarious purposes aside, this seems explicitly anti-bot because you can change the obfuscation whenever you like, forcing another RE effort.