3 ms·

I'm puzzled as to how he got an alert to appear without alert anywhere in the script.

mattdw 13y ago
If he can get a reference to the window or 'this' at any point (which I haven't yet figured out), he can presumably use his string-building tricks to build the string "alert", then use: window["alert"]("hello")
- mattdw 13y ago
  (it's lucky that all of the letters in "alert" can be found in "true" and "false", although "undefined", "NaN" and "[object Object]" could probably be used too.)
colinbartlett 13y ago
Oh, thank you. I did not notice there was an alert because I did not run the page. I thought it was just cleverly shaped code that did nothing, decidedly less impressive.
adam-a 13y ago
It's quite clever, the script gets a reference to the function prototype by making the string "constructor" and calling (0)["constructor"]["constructor"]. Calling Function on a string returns a new function with the string as the body, which you can then execute. Partially deobfuscated: http://jsbin.com/qiwib/1/edit?js,output http://jsbin.com/qiwib/1/edit?js,output
- dioltas 13y ago
  Just tried to understand the last bit myself. So he's doing 0["constructor"] which gives the constructor of a number, Number. Then he's 0["constructor"]["constructor"] gives the constructor of Number, which is like a function, so he gets Function. var y = (0)["constructor"]["constructor"]; y == Function; // true Then he basically does this ($.$ == Function): Function( Function( "return \"alert('I love you');\"" )() )(); The inner function just returns the string "alert('I love you');", which then becomes the body for the outer function. I don't know why they didn't make it: Function ("alert('I love you');")(); Maybe they needed more chars for the heart. That was a good little crash course in javascript Function constructors!
  - adam-a 13y ago
    I was a bit confused by the double Function call too. The string input to the first Function is: "return"ale\162t(\"\111\40lo\166e\40\171ou.\"\40)"" which when evaluated becomes: "alert("I love you." )" He gets the other letters from names of types and other JS native things. I guess he couldn't get 'r', 'I', ' ', 'v' or 'y' and so had to make them using the octal escape codes.

If he can get a reference to the window or 'this' at any point (which I haven't yet figured out), he can presumably use his string-building tricks to build the string "alert", then use: window["alert"]("hello")

mattdw 13y ago
(it's lucky that all of the letters in "alert" can be found in "true" and "false", although "undefined", "NaN" and "[object Object]" could probably be used too.)

colinbartlett 13y ago

Oh, thank you. I did not notice there was an alert because I did not run the page. I thought it was just cleverly shaped code that did nothing, decidedly less impressive.

adam-a 13y ago

It's quite clever, the script gets a reference to the function prototype by making the string "constructor" and calling (0)["constructor"]["constructor"]. Calling Function on a string returns a new function with the string as the body, which you can then execute. Partially deobfuscated: http://jsbin.com/qiwib/1/edit?js,output http://jsbin.com/qiwib/1/edit?js,output

dioltas 13y ago
Just tried to understand the last bit myself. So he's doing 0["constructor"] which gives the constructor of a number, Number. Then he's 0["constructor"]["constructor"] gives the constructor of Number, which is like a function, so he gets Function. var y = (0)["constructor"]["constructor"]; y == Function; // true Then he basically does this ($.$ == Function): Function( Function( "return \"alert('I love you');\"" )() )(); The inner function just returns the string "alert('I love you');", which then becomes the body for the outer function. I don't know why they didn't make it: Function ("alert('I love you');")(); Maybe they needed more chars for the heart. That was a good little crash course in javascript Function constructors!
- adam-a 13y ago
  I was a bit confused by the double Function call too. The string input to the first Function is: "return"ale\162t(\"\111\40lo\166e\40\171ou.\"\40)"" which when evaluated becomes: "alert("I love you." )" He gets the other letters from names of types and other JS native things. I guess he couldn't get 'r', 'I', ' ', 'v' or 'y' and so had to make them using the octal escape codes.