6 ms·

Brainfuck beware: JavaScript is after you (2012)

123 points by SworDsy 12y ago

facorreia 12y ago
> For instance, here is 4: !+[]+!![]+!![]+!![]. Gotta love this language... It's a wonder we can get any work done with it. But, used with discipline, it's not too bad.
dj-wonk 12y ago
{Brace} yourself before (and after) reading this.
shittyanalogy 12y ago
Encoder for a similar subset: http://utf-8.jp/public/jjencode.html http://utf-8.jp/public/jjencode.html
ChrisAntaki 12y ago
This was a brilliant article, I learned a ton, thanks.
zatkin 12y ago
I'm curious on what the performance implications are. If I have some JavaScript on a webpage that I want to "obfuscate", would using this accomplish the task?
- alcuadrado 12y ago
  The performance seriously decreases. I haven't measure how much, but I guess it'd only work for very very small scripts.
  - xxs 12y ago
    once the eval() invocation is complete and the code generated/compiled the performance should be the same as the code normally written. Basically it's only compiler from []{}!+ to javascript.
    - calibwam 12y ago
      However, your js files would get really big, and download latency could actually be a performance drop.
      - xxs 12y ago
        True, however they should be very well compressible by 'deflate' too, the main concern is the initial parsing grok by the JIT. Yet, on runtime the scripts will be good as any.
  - SaturateDK 12y ago
    http://jsperf.com/jsfuck-test http://jsperf.com/jsfuck-test
- calibwam 12y ago
  This isn't really obfuscating, as it is very easy to get the code back into normal js.
Pitarou 12y ago
Yet another example of the horrible mess unprincipled automatic type conversion causes. What prevents language designers from avoiding all these lurking bugs with a generic type-conversion operator? E.g. here's how it might look in a Python-like language: >>> x = 1 >>> y = "2" >>> print(x + cast(y)) 3 >>> print(cast(x) + y) "12" >>> print(cast(x) + cast(y)) Exception: ambiguous type
- anonymoushn 12y ago
  Why is this preferable to a set of functions that return a particular type? Most uses of such a cast function would be something like cast(unknown_type) <op> known_type The programmer could just write tostring or tonumber instead of cast, if the type of the other operand is known >_>
  - Pitarou 12y ago
    Automatic type casting remains popular because it reduces the syntactic and cognitive overhead. I'm suggesting that a better solution would be to retain explicit casting, but minimise the overheads. So, to take things a step further, lets use, say, the $ operator for casting. Then we have: >>> x = 1 >>> y = "2" >>> print($x + y) 3 >>> print(x + $y) "12" >>> print($x + $y) CastError: ... What do you think?
    - mateuszf 12y ago
      Python example with str and int are IMHO much better. They require only little more typing, but are very readable and explicit.
    - danbruc 12y ago
      The proper way to do this is using something like TryParse() and ToString() and to handle the case of failing to parse the string as a number and maybe even specifying the locale for both operations. If you are absolutely sure that parsing can not fail you can use Parse() and omit the error handling.
- 12y ago
nirmel 12y ago
I am not a programmer so this is part curiosity and part criticism. Why do programmers seem to enjoy creating programs that satisfy some syntactical constraint? Is it a fun mental exercise, or or can you just admit that you're showing off on something that really does not matter?
- tfigment 12y ago
  He did indicate he is a security researcher and this technique would allow bypassing certain checks. No alphanumerics but then I would guess it would be easy to detect these scripts as malicious anyway if someone wanted to since most of this stuff is questionable in a standard script.
- crazytony 12y ago
  this can be used to get around some forms of antivirus checkers/content inspectors.
- lawl 12y ago
  I'd say both. But it does matter. It could for example be used in obfuscators. Brainfuck itself has formal proof of being turing complete, so the easiest way today to prove that a language is turing complete is to implement a brainfuck interpreter. Which is just a few lines of code instead of this: http://www.iwriteiam.nl/Ha_bf_Turing.html http://www.iwriteiam.nl/Ha_bf_Turing.html
- icambron 12y ago
  Waiving aside the practical applications for a second, remember that this is an art to us. We have a canvas and a set of paints, and we make stuff out of it. Exploring the limits of that medium is part of the fun, but also part of understanding our art. What are the consequences of this? How far can this envelope be pushed? There was a guy who wrote an entire novel that never used the letter "e" [1]. Is that showing off? Maybe, I guess. It's also a really interesting exercise in writing. [1] https://en.wikipedia.org/wiki/Gadsby_(novel) https://en.wikipedia.org/wiki/Gadsby_(novel)
- gioele 12y ago
  «It is hard to write a simple definition of something as varied as hacking, but I think what these activities have in common is playfulness, cleverness, and exploration. Thus, hacking means exploring the limits of what is possible, in a spirit of playful cleverness. Activities that display playful cleverness have "hack value".» https://stallman.org/articles/on-hacking.html https://stallman.org/articles/on-hacking.html «The MIT group defined a hack as a project undertaken or a product built to fulfill some constructive goal, but also with some wild pleasure taken in mere involvement.» http://en.wikipedia.org/wiki/Hacker_ethic http://en.wikipedia.org/wiki/Hacker_ethic
Noctem 12y ago
It's been a while since I last brushed up on the Geneva Conventions, but I think this violates most of them.
aqrashik 12y ago
This method could also be used to evade XSS filters. For e.g. I believe encoding code using something similar is the only way to solve this challenge - http://escape.alf.nu/9/ http://escape.alf.nu/9/
tonylampada 12y ago
I've seen this before here: http://www.jsfuck.com/ http://www.jsfuck.com/. It's nice that this guy actually explains how it works
nubs 12y ago
I once did something similar in PHP.[1] View the semi-useful writeup[2] as well. [1]: https://gist.githubusercontent.com/nubs/5849633/raw/78bae58f6675f4e514d7a784c3142dd7d98f0629/nodigitsorquoteseither.php https://gist.githubusercontent.com/nubs/5849633/raw/78bae58f... [2]: https://gist.github.com/nubs/5849633 https://gist.github.com/nubs/5849633

123 points by SworDsy 12y ago

> For instance, here is 4: !+[]+!![]+!![]+!![]. Gotta love this language... It's a wonder we can get any work done with it. But, used with discipline, it's not too bad.

dj-wonk 12y ago

{Brace} yourself before (and after) reading this.

shittyanalogy 12y ago

Encoder for a similar subset: http://utf-8.jp/public/jjencode.html http://utf-8.jp/public/jjencode.html

ChrisAntaki 12y ago

This was a brilliant article, I learned a ton, thanks.

zatkin 12y ago

I'm curious on what the performance implications are. If I have some JavaScript on a webpage that I want to "obfuscate", would using this accomplish the task?

alcuadrado 12y ago
The performance seriously decreases. I haven't measure how much, but I guess it'd only work for very very small scripts.
- xxs 12y ago
  once the eval() invocation is complete and the code generated/compiled the performance should be the same as the code normally written. Basically it's only compiler from []{}!+ to javascript.
  - calibwam 12y ago
    However, your js files would get really big, and download latency could actually be a performance drop.
    - xxs 12y ago
      True, however they should be very well compressible by 'deflate' too, the main concern is the initial parsing grok by the JIT. Yet, on runtime the scripts will be good as any.
- SaturateDK 12y ago
  http://jsperf.com/jsfuck-test http://jsperf.com/jsfuck-test
calibwam 12y ago
This isn't really obfuscating, as it is very easy to get the code back into normal js.

Pitarou 12y ago

Yet another example of the horrible mess unprincipled automatic type conversion causes. What prevents language designers from avoiding all these lurking bugs with a generic type-conversion operator? E.g. here's how it might look in a Python-like language: >>> x = 1 >>> y = "2" >>> print(x + cast(y)) 3 >>> print(cast(x) + y) "12" >>> print(cast(x) + cast(y)) Exception: ambiguous type

anonymoushn 12y ago
Why is this preferable to a set of functions that return a particular type? Most uses of such a cast function would be something like cast(unknown_type) <op> known_type The programmer could just write tostring or tonumber instead of cast, if the type of the other operand is known >_>
- Pitarou 12y ago
  Automatic type casting remains popular because it reduces the syntactic and cognitive overhead. I'm suggesting that a better solution would be to retain explicit casting, but minimise the overheads. So, to take things a step further, lets use, say, the $ operator for casting. Then we have: >>> x = 1 >>> y = "2" >>> print($x + y) 3 >>> print(x + $y) "12" >>> print($x + $y) CastError: ... What do you think?
  - mateuszf 12y ago
    Python example with str and int are IMHO much better. They require only little more typing, but are very readable and explicit.
  - danbruc 12y ago
    The proper way to do this is using something like TryParse() and ToString() and to handle the case of failing to parse the string as a number and maybe even specifying the locale for both operations. If you are absolutely sure that parsing can not fail you can use Parse() and omit the error handling.
12y ago

nirmel 12y ago

I am not a programmer so this is part curiosity and part criticism. Why do programmers seem to enjoy creating programs that satisfy some syntactical constraint? Is it a fun mental exercise, or or can you just admit that you're showing off on something that really does not matter?

tfigment 12y ago
He did indicate he is a security researcher and this technique would allow bypassing certain checks. No alphanumerics but then I would guess it would be easy to detect these scripts as malicious anyway if someone wanted to since most of this stuff is questionable in a standard script.
crazytony 12y ago
this can be used to get around some forms of antivirus checkers/content inspectors.
lawl 12y ago
I'd say both. But it does matter. It could for example be used in obfuscators. Brainfuck itself has formal proof of being turing complete, so the easiest way today to prove that a language is turing complete is to implement a brainfuck interpreter. Which is just a few lines of code instead of this: http://www.iwriteiam.nl/Ha_bf_Turing.html http://www.iwriteiam.nl/Ha_bf_Turing.html
icambron 12y ago
Waiving aside the practical applications for a second, remember that this is an art to us. We have a canvas and a set of paints, and we make stuff out of it. Exploring the limits of that medium is part of the fun, but also part of understanding our art. What are the consequences of this? How far can this envelope be pushed? There was a guy who wrote an entire novel that never used the letter "e" [1]. Is that showing off? Maybe, I guess. It's also a really interesting exercise in writing. [1] https://en.wikipedia.org/wiki/Gadsby_(novel) https://en.wikipedia.org/wiki/Gadsby_(novel)
gioele 12y ago
«It is hard to write a simple definition of something as varied as hacking, but I think what these activities have in common is playfulness, cleverness, and exploration. Thus, hacking means exploring the limits of what is possible, in a spirit of playful cleverness. Activities that display playful cleverness have "hack value".» https://stallman.org/articles/on-hacking.html https://stallman.org/articles/on-hacking.html «The MIT group defined a hack as a project undertaken or a product built to fulfill some constructive goal, but also with some wild pleasure taken in mere involvement.» http://en.wikipedia.org/wiki/Hacker_ethic http://en.wikipedia.org/wiki/Hacker_ethic

Noctem 12y ago

It's been a while since I last brushed up on the Geneva Conventions, but I think this violates most of them.

aqrashik 12y ago

This method could also be used to evade XSS filters. For e.g. I believe encoding code using something similar is the only way to solve this challenge - http://escape.alf.nu/9/ http://escape.alf.nu/9/

tonylampada 12y ago

I've seen this before here: http://www.jsfuck.com/ http://www.jsfuck.com/. It's nice that this guy actually explains how it works

nubs 12y ago

I once did something similar in PHP.[1] View the semi-useful writeup[2] as well. [1]: https://gist.githubusercontent.com/nubs/5849633/raw/78bae58f6675f4e514d7a784c3142dd7d98f0629/nodigitsorquoteseither.php https://gist.githubusercontent.com/nubs/5849633/raw/78bae58f... [2]: https://gist.github.com/nubs/5849633 https://gist.github.com/nubs/5849633