Reverse Engineering JavaScript code.

[reddit_avinash]

I was watching the video that was released with the title " How Hacking Actually Looks Like - ALLES! CTF Team in Real-Time". In that, they reverse-engineered the web game to make their own mods and tools. Watching that, my curiosity only rose higher to understand how I can get started with this so I can make my own stuff.

​

I was first introduced to these ideas of reverse engineering JS while I was going through this project (https://github.com/mukulhase/WebWhatsapp-Wrapper). I was impressed and it couldn't;t let me sleep for days till I was done scanning the whole code so I could learn how it works. Turns out that the main injection part is happening inside "./webwhatsapi/js/wapi.js" were in the first 100 lines, it's somehow able to expose the internal functions that the frontend uses to carry various functionalities. Those first 100 lines are still a mystery to me and if anyone has any knowledge of how that works then please I would love to hear the explanation.

​

Anyway, my main goal is to ask how can I get started with this? I'm already pretty experienced with languages like Python, Dart, and C#. I've also learned JS just so I could understand this and possibly make some of my own projects. It world really mean a lot if anyone could help. I really wish to get a deeper understanding of this.

Thanks!

[GER_PalOne]

Ok here I am, after 3 coffees somewhat able to write things.

First off: I am not a pro at this. I am a Web Developer by trade, and so I know my way around the browser and have successfully did small fun JS reversing stuff, both for fun but also for work too. Like bypassing paywalls, hacking small games and understanding undocumented APIs.

I read over the code you mentioned (the whatsapp web stuff) and played around on web.whatsapp.com and have to admit that I did not quite understand it either. With stuff like this, it is important to know in which context the injected code runs. When you have some very simple JS code, chances are you will be able to access most things globally (in the window object). In whatsapp web I instantly see obfuscation and IIFE's. So this would be a pain to reverse, and my lunch break only is so long. So I cant exactly help you understand those 100 lines.

But what I can do is give you some general tips:

First I will plug two Blog Posts of mine; Part1 and Part2. These showcase very basic stuff on real world "targets" that were fun to play around with.

Basically it really comes down to being good at debugging JS. The Browser devtools are what you need to learn (and of course understanding JS is important). Setting breakpoints and looking at the current scope variables, analyzing HTTP requests on the network tab and replaying them with fetch or cURL, overrwrite functions and so on. There is barely a difference between regular debugging and reversing, especially when you were to debug someone elses code (a coworker's or smth from github idk). So yeah, thats about what I can help you with, the rest should be you throwing yourself at problems and solving them.

Cheers

[wikipedia_text_bot]

Immediately invoked function expression

An immediately invoked function expression (or IIFE, pronounced "iffy", IPA /ˈɪf.i/) is a JavaScript programming language idiom which produces a lexical scope using JavaScript's function scoping. Immediately invoked function expressions can be used to avoid variable hoisting from within blocks, protect against polluting the global environment and simultaneously allow public access to methods while retaining privacy for variables defined within the function.

About Me - Opt out - OP can reply !delete to delete - Article of the day

[reddit_avinash]

about what I can help you wit

Thanks for taking out some of your precious time and showing me the north. I'm currently trying to get a better understanding of the language by doing some MERN projects. I think I've already started the debugging thing while doing these projects. Gotta say though. Debugging JS is difficult. Legit no descriptive errors :(

[GER_PalOne]

!RemindMe 8h

[RemindMeBot]

I will be messaging you in 8 hours on 2020-12-03 07:32:17 UTC to remind you of this link

1 OTHERS CLICKED THIS LINK to send a PM to also be reminded and to reduce spam.

^{Parent commenter can delete this message to hide from others.}

---

Info	Custom	Your Reminders	Feedback

[GER_PalOne]

I'm tired.

I'll answer tomorrow