5 ms·

Thank you kind internet stranger. Now, how does it work?

by Pezmc 13y ago

CatsoCatsoCatso 13y ago
I'm puzzled as to how he got an alert to appear without alert anywhere in the script.
- mattdw 13y ago
  If he can get a reference to the window or 'this' at any point (which I haven't yet figured out), he can presumably use his string-building tricks to build the string "alert", then use: window["alert"]("hello")
  - mattdw 13y ago
    (it's lucky that all of the letters in "alert" can be found in "true" and "false", although "undefined", "NaN" and "[object Object]" could probably be used too.)
- colinbartlett 13y ago
  Oh, thank you. I did not notice there was an alert because I did not run the page. I thought it was just cleverly shaped code that did nothing, decidedly less impressive.
- adam-a 13y ago
  It's quite clever, the script gets a reference to the function prototype by making the string "constructor" and calling (0)["constructor"]["constructor"]. Calling Function on a string returns a new function with the string as the body, which you can then execute. Partially deobfuscated: http://jsbin.com/qiwib/1/edit?js,output http://jsbin.com/qiwib/1/edit?js,output
  - dioltas 13y ago
    Just tried to understand the last bit myself. So he's doing 0["constructor"] which gives the constructor of a number, Number. Then he's 0["constructor"]["constructor"] gives the constructor of Number, which is like a function, so he gets Function. var y = (0)["constructor"]["constructor"]; y == Function; // true Then he basically does this ($.$ == Function): Function( Function( "return \"alert('I love you');\"" )() )(); The inner function just returns the string "alert('I love you');", which then becomes the body for the outer function. I don't know why they didn't make it: Function ("alert('I love you');")(); Maybe they needed more chars for the heart. That was a good little crash course in javascript Function constructors!
    - adam-a 13y ago
      I was a bit confused by the double Function call too. The string input to the first Function is: "return"ale\162t(\"\111\40lo\166e\40\171ou.\"\40)"" which when evaluated becomes: "alert("I love you." )" He gets the other letters from names of types and other JS native things. I guess he couldn't get 'r', 'I', ' ', 'v' or 'y' and so had to make them using the octal escape codes.
mattdw 13y ago
It's actually understandable, just tedious. Lot of dynamic typing/casting tricks. First, we set var '$' to bitwise NOT of [], which is -1 ([] casts to 0 or false depending on the operator): $ = ~[]; Then we re-set $ to an object: $ = {___: ++$, $$$$: (![]+"")[$], ... Which gives us: $.___ == 0 // ($ was still -1, now it's 0) $.$$$$ == "f" // I think The "f" is a bit clever: ![] == false (![]+"") == "false" (![]+"")[$] is an index on the string, and $ is now 0 That's as far as I've bothered. (edited for formatting)

Thank you kind internet stranger. Now, how does it work?

by Pezmc 13y ago

Thank you kind internet stranger. Now, how does it work?

CatsoCatsoCatso 13y ago

I'm puzzled as to how he got an alert to appear without alert anywhere in the script.

mattdw 13y ago
If he can get a reference to the window or 'this' at any point (which I haven't yet figured out), he can presumably use his string-building tricks to build the string "alert", then use: window["alert"]("hello")
- mattdw 13y ago
  (it's lucky that all of the letters in "alert" can be found in "true" and "false", although "undefined", "NaN" and "[object Object]" could probably be used too.)
colinbartlett 13y ago
Oh, thank you. I did not notice there was an alert because I did not run the page. I thought it was just cleverly shaped code that did nothing, decidedly less impressive.
adam-a 13y ago
It's quite clever, the script gets a reference to the function prototype by making the string "constructor" and calling (0)["constructor"]["constructor"]. Calling Function on a string returns a new function with the string as the body, which you can then execute. Partially deobfuscated: http://jsbin.com/qiwib/1/edit?js,output http://jsbin.com/qiwib/1/edit?js,output
- dioltas 13y ago
  Just tried to understand the last bit myself. So he's doing 0["constructor"] which gives the constructor of a number, Number. Then he's 0["constructor"]["constructor"] gives the constructor of Number, which is like a function, so he gets Function. var y = (0)["constructor"]["constructor"]; y == Function; // true Then he basically does this ($.$ == Function): Function( Function( "return \"alert('I love you');\"" )() )(); The inner function just returns the string "alert('I love you');", which then becomes the body for the outer function. I don't know why they didn't make it: Function ("alert('I love you');")(); Maybe they needed more chars for the heart. That was a good little crash course in javascript Function constructors!
  - adam-a 13y ago
    I was a bit confused by the double Function call too. The string input to the first Function is: "return"ale\162t(\"\111\40lo\166e\40\171ou.\"\40)"" which when evaluated becomes: "alert("I love you." )" He gets the other letters from names of types and other JS native things. I guess he couldn't get 'r', 'I', ' ', 'v' or 'y' and so had to make them using the octal escape codes.

mattdw 13y ago

It's actually understandable, just tedious. Lot of dynamic typing/casting tricks. First, we set var '$' to bitwise NOT of [], which is -1 ([] casts to 0 or false depending on the operator): $ = ~[]; Then we re-set $ to an object: $ = {___: ++$, $$$$: (![]+"")[$], ... Which gives us: $.___ == 0 // ($ was still -1, now it's 0) $.$$$$ == "f" // I think The "f" is a bit clever: ![] == false (![]+"") == "false" (![]+"")[$] is an index on the string, and $ is now 0 That's as far as I've bothered. (edited for formatting)