HN Explorer

33 comments

[ 2.5 ms ] story [ 94.2 ms ] thread
Pezmc
Thank you kind internet stranger. Now, how does it work?
CatsoCatsoCatso
I'm puzzled as to how he got an alert to appear without alert anywhere in the script.
mattdw
If he can get a reference to the window or 'this' at any point (which I haven't yet figured out), he can presumably use his string-building tricks to build the string "alert", then use:

    window["alert"]("hello")
mattdw
(it's lucky that all of the letters in "alert" can be found in "true" and "false", although "undefined", "NaN" and "[object Object]" could probably be used too.)
colinbartlett
Oh, thank you. I did not notice there was an alert because I did not run the page.

I thought it was just cleverly shaped code that did nothing, decidedly less impressive.

adam-a
It's quite clever, the script gets a reference to the function prototype by making the string "constructor" and calling (0)["constructor"]["constructor"]. Calling Function on a string returns a new function with the string as the body, which you can then execute.

Partially deobfuscated: http://jsbin.com/qiwib/1/edit?js,output

dioltas
Just tried to understand the last bit myself.

So he's doing 0["constructor"] which gives the constructor of a number, Number. Then he's 0["constructor"]["constructor"] gives the constructor of Number, which is like a function, so he gets Function.

    var y = (0)["constructor"]["constructor"];
    y == Function;                                 // true
Then he basically does this ($.$ == Function):

    Function(
        Function(
            "return \"alert('I love you');\""
        )()
    )();
The inner function just returns the string "alert('I love you');", which then becomes the body for the outer function.

I don't know why they didn't make it:

Function ("alert('I love you');")();

Maybe they needed more chars for the heart. That was a good little crash course in javascript Function constructors!

adam-a
I was a bit confused by the double Function call too. The string input to the first Function is:

    "return"ale\162t(\"\111\40lo\166e\40\171ou.\"\40)""
which when evaluated becomes:

    "alert("I love you." )"
He gets the other letters from names of types and other JS native things. I guess he couldn't get 'r', 'I', ' ', 'v' or 'y' and so had to make them using the octal escape codes.
mattdw
It's actually understandable, just tedious. Lot of dynamic typing/casting tricks.

First, we set var '$' to bitwise NOT of [], which is -1 ([] casts to 0 or false depending on the operator):

     $ = ~[];
Then we re-set $ to an object:

     $ = {___: ++$,
          $$$$: (![]+"")[$],
          ...
Which gives us:

     $.___ == 0 // ($ was still -1, now it's 0)
     $.$$$$ == "f" // I think
The "f" is a bit clever:

     ![] == false
     (![]+"") == "false"
     (![]+"")[$] is an index on the string, and $ is now 0
That's as far as I've bothered. (edited for formatting)
kelmop
does anyone know what kind of obfuscator is used here? or is this hand crafted?
arms
Good way to start the morning. Love me some loving code.
rmchugh
More horrible things you can do with javascript.
jbeja
I don't even know you!.
iconjack
Nothing says "I love you" like a valentine made of dollars signs.
[deleted]
(comment deleted)
mkhalil
How much time did this take?
mouj
a java script code for valentine for geeks are ok with valentine:)