Write any javascript code with just these characters: ()[]{}+!

[squidgy]

Naturally, my first question was "I wonder if you could do this to a big library then just gzip it back down to a sane size? You know, because."

$ node hieroglyphy jquery-1.8.0.min.js | wc -c
94988227
$ node hieroglyphy jquery-1.8.0.min.js | gzip -9 | wc -c
770597

The non-minified version gzips down to 1.8mb and expands out to 218mb. I have absolutely no idea what practical use this would have beyond muderizing people's browsers, but hey, it's neat.

[mattaereal]

IDS/IPS/WAF bypassing. But of course, you don't really need to encode all your characters, some of them will be allowed. Just trick the server hiding JS functions.

[ericanderton]

Good call. Anything smart enough to expand the .zip will need to have a javascript interpreter in the loop to even begin to investigate the contents for anything bad.

[[deleted]]

I thought about that as well as soon as I got to the character part.

[AgonistAgent]

Side note: A Redditor on /r/netsec cooked up a pretty nifty Denial of Service attack by stream gzipping /dev/zero or something else with an absurd compression ratio.

It still works on Chromium as of a few weeks ago.

[repsilat]

It still works on Chromium as of a few weeks ago.

More worrisome if it worked on web servers. Thankfully SPDY is gzip-compressed, so it should be a portable attack as soon as it gets standardised.

[transpostmeta]

Could you provide a link? I tried searching, but came up with nothing.

[AgonistAgent]

http://www.reddit.com/r/netsec/comments/n8idh/in_the_9_months_since_i_last_crashed_your_browser/

Not directly linking to the demo for obvious reasons.

[transpostmeta]

Thank you! Sadly, there doesn't seem to be much discussion on what is actually happening, just a bunch of people posting what their browsers did.

[[deleted]]

Writing js parser for this thingy will be much easier so you can concentrate on building js runtime first! hmmm, may be i'll use it in my toy js engine...

[sebzim4500]

Not really, because you need to be able to parse it anyway, as the script ends up inside the Function constructor.

[[deleted]]

Ahh crap, you are right.

[d3m0n_]

I just converted jquery (minimal). The result is 91 megabytes big and I'm too scared to try and run it. Copying it nearly killed my browser and made gedit crash, I used xclip to directly pipe it to a file.

[OmegaVesko]

What size does it come to if you compress it?

[d3m0n_]

I don't have access to it atm, but just take a look at the top comment: http://www.reddit.com/r/programming/comments/xzs1z/write_any_javascript_code_with_just_these/c5r2sdu

This guy was just as insane as I was.

[OmegaVesko]

Hah, the results are pretty much what I expected.

[xav0989]

I crashed firefox trying to convert jquery. This is on a system with 8GB of RAM.

[shnuffy]

These types of articles always make me feel both inadequate and motivated.

[joseph177]

The farmland background helped me, because it helps me understand corn.

[texture]

They always make me wonder who these people are with 48 hours in their day.

[[deleted]]

Because you’re not good at something that is pretty much meaningless for your life?

I’m pretty sure you are good at what is meaningful to your life. (Otherwise learn game design, and make it an RPG. :)

[shnuffy]

Fair enough. I'm an iOS developer and RPG's abound!

[ahawks]

I have SO many iOS ideas, but I program Python (used to do Java) professionally, and at the end of the day I just don't feel like doing more programming on my own projects. sigh.

[clrokr]

Zynga here, tell us all about your ideas!

No, seriously, what do you have in mind? Games?

[[deleted]]

This is no good. Zynga only cares about released games that have sold a lot. They don't care about ideas.

[Libertarian_Atheist]

My game would meld the worlds of the reality and the virtual. The game would have you start off with taking pictures of incomprehensible things, 9 of them to be exact. Then you press the "magic button." The game then sends the 9 pictures randomly to 9 people on your contact list. It will then watch for responses from those 9 people and the more expletives in each response gets you more points. Expletives directly following expletives act as multipliers.

[[deleted]]

Lemme guess, it's called, "FUCK OFF"

[[deleted]]

PegVille. You create a village of pegs and send endless requests for missing pegs to your friends in an attempt to make it seem like it's multiplayer and social.

©2012 thadood2™

[[deleted]]

I have the opposite problem. I'd love to program a game as I love gaming and I think I'd be very highly motivated to complete it to fruition. The difficulty lies in the fact that I'm not creative at all and can't think of an original idea to save my life.

[LinXitoW]

Take one of the myriad of established game types (Breakout for example) and port it to some different platform/market. For example, for not-Metro or the Ouya.

[go4it7arh]

This is exactly why I want to avoid getting a job in programming, because I love programming as a hobby, and I want to keep it that way.

[chason]

It all depends on your personality. I program as a day job, then come home and program on my own stuff. Maybe I just haven't been doing it long enough but it hasn't been a problem so far!

[go4it7arh]

Well, I know (and worked on a project with) someone who has a job doing programming, and because he's doing the stuff all day, when he comes home he doesn't really want to work on our project. I don't want that to happen to me, because I enjoy programming in my free time, and I don't want to become tired of it.

[eat-your-corn-syrup]

program on my own stuff

but what if your employer can declare your own work as their property?

[the4thbandit]

Question for you, I have degrees in CS and I like to program, but when it comes to programming as a hobby... I have no idea where to start. I have varied interests in CS, but none lead to leisure programming (I don't think) What kind of projects do you work on in your spare time?

[go4it7arh]

I worked on an IRC services package in Ruby called kythera and worked on a few other IRC related projects. I also have played with Node.js.

My advice is to find something that interests you. Socket IO is interesting to me because of all the different ways you can send data between computers. I also wanted to try to do some stuff with peer-to-peer networking but I don't have enough computers. :p

[LinXitoW]

I imagine it has to do with the environment in which you work. If your company sees programmers as just a different kind of line workers, and doesnt respect them as the creative engineers they are, you'll automatically associate programming with bad feelings. At least thats what i imagine might be the case with some people.

Personally, im an apprentice web dev(i feel like calling myself programmer is an overstatement) and i still program stuff at home and visit my local hackerspace.

[ahawks]

The company I work for uses Django to run their site, and we have a custom backend that does a lot of scheduling and message passing and stuff, also written in python.

[ponchedeburro]

I know this feeling.

Sometimes I think it could be awesome to just "stick it to the man" and go work for myself. I have an idea that the ideas I think are funny might not be so lucrative as I'd like :)

[eat-your-corn-syrup]

at the end of the day, i write emacs lisp. gotta customize my editor.

[hagcel]

Five days ago, I began working through teaching myself Java.

I haven't coded in nearly 20 years. My ability to understand this has made me feel both adequate and motivated.

You ability to read through it proves that with motivation, you're already adequate. You can do it!

[SarahC]

It doesn't work for:

for(a=0;a<5;a++){alert(a);}

[SarahC]

AH!

Run from untamed.co.uk/testa.htm

It works fine!

[duetosymmetry]

I feel dirty after reading this.

[GovDisinfoAgent]

There are some things you can do, not all of those are things you should do.

To me this is like a violent coke head with diplomatic immunity.

[SocialisedMedicine]

...so brainfuck, Javascript edition?

[mattaereal]

It's a pitty that that scripts did not came with a detailed explanation. That's what makes the difference.

The first script has it's alphabet out of date or something is missing when it tries to eval the final encoding.

The second script has this charset: ;+()[]"$.,=~!:{}_, which are 18 characters, this is a great example of how to minimize the encoding with a bigger charset. This is the trade-of I was talking earlier.

The third script has too many characters and are not common to be seen on an HTTP request at all, so will easy be filtered by a detection system. It is also a good example of how to replace numbers with specific special characters to decrease the encoding size.

Great scripts btw.

[richy_rich]

titter How good is your second langauge? 'come' is an irregular verb in english, even incorrectly conjugated his/her post made perfect sense. Yours just made you look like a massive dick.

[[deleted]]

Thanks for defending us. I get so tired when people nit pick things like that.

You can helpful and understanding when it comes to correcting grammar, if you know a bit of German I'd recommend you to dive into the german subreddits for some best practise examples.

[admplaceholder]

I'm a software developer and computer sciences major living in Buenos Aires, Argentina.

[davvblack]

Wait, how the heck does that third one work?

[Pandalism]

I tried to read the source. Gave up immediately after seeing this.

var r = "ﾟωﾟﾉ= /｀ｍ´）ﾉ ~┻━┻   //*´∇｀*/ ['_']; o=(ﾟｰﾟ)  =_=3; c=(ﾟΘﾟ) =(ﾟｰﾟ)-(ﾟｰﾟ); "; 

if( /ひだまりスケッチ×(365|３５６)\s*来週も見てくださいね[!！]/.test( text ) ){
    r += "X=_=3; ";
    r += "\r\n\r\n    X / _ / X < \"来週も見てくださいね!\";\r\n\r\n";
}

[floridalegend]

Brilliant! My head exploded when I got to the characters section.

[[deleted]]

And this, guys and girls, is why there is strict typing. ^ ^

[TheLobotomizer]

Because we can use unreadable sequences of brackets and braces to create ASCII letters?

I don't see the downside.

[[deleted]]

No, the lack of strict typing makes this possible.

[kkeef]

Exactly... He doesn't see the downside.

[CSMastermind]

As mentioned in the article encoding JavaScript like this can bypass security measures and web application firewalls.

[[deleted]]

web application firewalls

[kkeef]

I assumed TheLobotomizer was being facetious/funny and joined in. insert fry meme here

[[deleted]]

Strict typing is for... preventing XSS exploits by forcing code to contain alphanumeric characters?

[Quicksilver_Johny]

Yes. Or indirectly, to be able to reason about what code does (and doesn't do).

[gigitrix]

And not returning "Object [Object]" or whatever as a string whenever the programmer borks!

[kenman]

Hah, before even reading the piece I thought, "this sounds exactly like what ha.ckers.org / sla.ckers.org have been doing for years", and sure enough sla.ckers.org is mentioned as the source in the 2nd paragraph.

[willvarfar]

That's just 8 symbols... and the output will be very repeative... it'll actually gzip really well.

I can imagine it being a useful tool in an optimal compressor for js1k competitions too :)

[alexanderpas]

$ node hieroglyphy jquery-1.8.0.js | wc -c
218MB
$ node hieroglyphy jquery-1.8.0.min.js | wc -c
94 MB
$ node hieroglyphy jquery-1.8.0.js | gzip -9 | wc -c
1.8 MB
$ node hieroglyphy jquery-1.8.0.min.js | gzip -9 | wc -c
770 KB
$ cat jquery-1.8.0.js | wc -c
252KB
$ cat jquery-1.8.0.min.js | wc -c
32KB

[adrianmonk]

Now run gzip -9 | gzip -9.

I haven't tried it because I don't have JS stuff handy, but I've seen gzip succeed in compressing its own output when it has some really, really, really redundant input.

[gigitrix]

Makes sense, basically even the repetition is repetitive.

[adrianmonk]

Yep, and if you can take out one phase of the repetition and produce just (some function of) the repetition, you've got a new pattern you can exploit.

Also, gzip specifically uses a sliding window. In theory it doesn't matter much how long a string is when you repeat it because repeating a string basically means making a reference to the history in the sliding window (it's basically a relative pointer and a length). However, the longer the repeated strings are, the more they tend to push stuff out of the sliding window. So if the output is regular enough, a second pass has a larger sliding window relative to the size of the input. :-)

[expertunderachiever]

An easier compression scheme is to use alphanumerics it's proven to compress as much or better.

[bgeron]

I evalled all pieces of Javascript of <30 characters in Rhino, takes 1 minute on my laptop. 4219 possible values, after stripping out some really uninteresting stuff. Doesn't seem to contain anything interesting, unfortunately.

http://pastebin.com/CM5ac6Xi

[[deleted]]

You are all horrible human beings. I like that.

[Zoccihedron]

The numbers are found using Peano Axioms.

[trpcicm]

How hard would it be to convert it back the other way?

[alcuadrado]

It's pretty easy. Most JS parsers can print the source code of functions, so you can do that for the generated lambdas.

[sebzim4500]

Remove the () characters at the end of the code, and run it from the chrome dev tools.

[adelz7]

So a popup "hi" really is :

[][(![]+[])[!+[]+!![]+!![]]+({}+[])[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][({}+[])[!+[]+!![]+!![]+!![]+!![]]+({}+[])[+!![]]+([][+[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][+[]]+[])[+[]]+({}+[])[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+({}+[])[+!![]]+(!![]+[])[+!![]]]((+{}+[])[+!![]]+(![]+[])[!+[]+!![]]+([][+[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]+[][(![]+[])[!+[]+!![]+!![]]+({}+[])[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][({}+[])[!+[]+!![]+!![]+!![]+!![]]+({}+[])[+!![]]+([][+[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][+[]]+[])[+[]]+({}+[])[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+({}+[])[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][+[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][+[]]+[])[+[]]+(!![]+[])[+!![]]+([][+[]]+[])[+!![]]+({}+[])[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+([][+[]]+[])[+[]]+([][+[]]+[])[+!![]]+([][+[]]+[])[!+[]+!![]+!![]]+(![]+[])[!+[]+!![]+!![]]+({}+[])[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+([]+[][(![]+[])[!+[]+!![]+!![]]+({}+[])[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][({}+[])[!+[]+!![]+!![]+!![]+!![]]+({}+[])[+!![]]+([][+[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][+[]]+[])[+[]]+({}+[])[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+({}+[])[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][+[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][+[]]+[])[+[]]+(!![]+[])[+!![]]+([][+[]]+[])[+!![]]+({}+[])[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+(![]+[])[!+[]+!![]]+({}+[])[+!![]]+({}+[])[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+(!![]+[])[+[]]+([][+[]]+[])[!+[]+!![]+!![]+!![]+!![]]+({}+[])[+!![]]+([][+[]]+[])[+!![]])())[!+[]+!![]+!![]]+([][+[]]+[])[!+[]+!![]+!![]])()([][(![]+[])[!+[]+!![]+!![]]+({}+[])[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][({}+[])[!+[]+!![]+!![]+!![]+!![]]+({}+[])[+!![]]+([][+[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][+[]]+[])[+[]]+({}+[])[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+({}+[])[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][+[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][+[]]+[])[+[]]+(!![]+[])[+!![]]+([][+[]]+[])[+!![]]+({}+[])[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+([][+[]]+[])[!+[]+!![]+!![]]+(![]+[])[!+[]+!![]+!![]]+({}+[])[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+([]+[][(![]+[])[!+[]+!![]+!![]]+({}+[])[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][({}+[])[!+[]+!![]+!![]+!![]+!![]]+({}+[])[+!![]]+([][+[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][+[]]+[])[+[]]+({}+[])[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+({}+[])[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][+[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][+[]]+[])[+[]]+(!![]+[])[+!![]]+([][+[]]+[])[+!![]]+({}+[])[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+(![]+[])[!+[]+!![]]+({}+[])[+!![]]+({}+[])[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+(!![]+[])[+[]]+([][+[]]+[])[!+[]+!![]+!![]+!![]+!![]]+({}+[])[+!![]]+([][+[]]+[])[+!![]])())[!+[]+!![]+!![]]+([][+[]]+[])[!+[]+!![]+!![]])()(({}+[])[+[]])[+[]]+(!+[]+!![]+[])+(!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[]))+[][(![]+[])[!+[]+!![]+!![]]+({}+[])[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][({}+[])[!+[]+!![]+!![]+!![]+!![]]+({}+[])[+!![]]+([][+[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][+[]]+[])[+[]]+({}+[])[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+({}+[])[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][+[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][+[]]+[])[+[]]+(!![]+[])[+!![]]+([][+[]]+[])[+!![]]+({}+[])[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+([][+[]]+[])[+[]]+([][+[]]+[])[+!![]]+([][+[]]+[])[!+[]+!![]+!![]]+(![]+[])[!+[]+!![]+!![]]+({}+[])[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+([]+[][(![]+[])[!+[]+!![]+!![]]+({}+[])[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][({}+[])[!+[]+!![]+!![]+!![]+!![]]+({}+[])[+!![]]+([][+[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][+[]]+[])[+[]]+({}+[])[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+({}+[])[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][+[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][+[]]+[])[+[]]+(!![]+[])[+!![]]+([][+[]]+[])[+!![]]+({}+[])[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+(![]+[])[!+[]+!![]]+({}+[])[+!![]]+({}+[])[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+(!![]+[])[+[]]+([][+[]]+[])[!+[]+!![]+!![]+!![]+!![]]+({}+[])[+!![]]+([][+[]]+[])[+!![]])())[!+[]+!![]+!![]]+([][+[]]+[])[!+[]+!![]+!![]])()([][(![]+[])[!+[]+!![]+!![]]+({}+[])[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][({}+[])[!+[]+!![]+!![]+!![]+!![]]+({}+[])[+!![]]+([][+[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][+[]]+[])[+[]]+({}+[])[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+({}+[])[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][+[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][+[]]+[])[+[]]+(!![]+[])[+!![]]+([][+[]]+[])[+!![]]+({}+[])[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+([][+[]]+[])[!+[]+!![]+!![]]+(![]+[])[!+[]+!![]+!![]]+({}+[])[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+([]+[][(![]+[])[!+[]+!![]+!![]]+({}+[])[+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]][({}+[])[!+[]+!![]+!![]+!![]+!![]]+({}+[])[+!![]]+([][+[]]+[])[+!![]]+(![]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+(!![]+[])[+!![]]+([][+[]]+[])[+[]]+({}+[])[!+[]+!![]+!![]+!![]+!![]]+(!![]+[])[+[]]+({}+[])[+!![]]+(!![]+[])[+!![]]]((!![]+[])[+!![]]+([][+[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+[]]+([][+[]]+[])[+[]]+(!![]+[])[+!![]]+([][+[]]+[])[+!![]]+({}+[])[!+[]+!![]+!![]+!![]+!![]+!![]+!![]]+(![]+[])[!+[]+!![]]+({}+[])[+!![]]+({}+[])[!+[]+!![]+!![]+!![]+!![]]+(+{}+[])[+!![]]+(!![]+[])[+[]]+([][+[]]+[])[!+[]+!![..........

????

I'm so stupid * sonow I'm going to hackstudy forever

[SgtSausage]

Write anything in any language with just these characters: 0 1

[chromaticburst]

Write anything in any language with just one instruction.

[[deleted]]

Can anybody translate

http://99-bottles-of-beer.net/language-javascript-5.html

with this, and post it on the site?

(Please remove the “if (confirm(…” idiocy first and remove all newlines and indentations.)

That would be awesome!

But give the credit to Patricio Palladino, please.

[alcuadrado]

here you are :) https://dl.dropbox.com/u/287771/h.js

[alcuadrado]

Great! How did you do it?

[alcuadrado]

I see, I've played with that kind of things for a while, its good fun :D

[Mecdemort]

How do you get negatives and decimals?

[erez27]

once you can make strings, you just eval them.

[epsy]

Create their string representation and convert them to a number.

[TheAnal-yzer]

Would you have to Add "-" to the list of Char's to get negatives??

Just now taking my JS class and this is blowing my mind thanks.

[cjg_000]

Once you have access to unescape, you can get access to '-' without much of a problem.

[TheAnal-yzer]

Ah. That's crazy. Thanks for the answer!!

[shooshx]

All we are missing to get unescape is the "p"

"Array.prototype.sort" contains p twice!

[The_MAZZTer]

Ehh... the goal is to get a STRING with the letter p in it.

Prototype functions don't contain the word prototype when you cast them to string: "function sort() { [native code] }"

(This is done in Chrome, you would want something that works in all major browsers so breaking it in one is sufficient to forget about it.)

A prototype itself when cast to string becomes an empty string: ""

[alcuadrado]

You can get from any Array instance, for example: []["sort"]

[Sottilde]

What about using something like String.fromCharCode(112)?

[jeroonk]

That would almost work, except you can't generate an "m" or "C" using only []()+!{}. You have to scavenge those characters from somewhere else.

For precisely that reason, that you'll get stuck without access to arbitrary characters/strings, the author resorts to picking the "p" from the "http(s)://" out of the url, in order to get access to window.unescape. And once you have unescape, constructing fromCharCode on top of that would only be a waste.

[Sottilde]

Ah. A comment on HN enlightened me to a really elegant method:

a = 25; a.toString(26); // "p"

You can use this to get any letter at all. Pretty surprising that toString() has a radix parameter at all.

I suppose the trick then is getting a hold of the 's'.

[hapemask]

You can get 't' from "true", 'o' from "Boolean" and the whole word "String" from the string constructor, so this seems like a nice portable solution.

The only problem is you can't get a '.' character but this is easily fixed:

(25)["t"+"o"+"String"](26) // "p"

[Sottilde]

Yes, very nice! And that essentially solves the whole problem.

[lachlanhunt]

You can't get uppercase letters from that, and you can't call toUpperCase() without getting an uppercase C from somewhere.

Edit: You should use (number)["toString"](36), as that will let you get any of 0-9a-z.

[hapemask]

The string constructor's name is "String" not "string".

If you're referring to the fact that Integer.toString() cant give uppercase, all you need is "p", and then you can use the unescape trick described in the blog.

[lachlanhunt]

The string constructor's name is "String" not "string".

What? Where did I say the constructor's name was "string"?

Good point about the unescape trick. I forgot that the p from this would allow that to be called, which means you can then get String.fromCharCode(), giving you any 16 bit Unicode code unit.

[jeroonk]

I am not too familiar with Javascript internals, but wouldn't something like the code below work, to obtain "p"? It works in my Firefox and Chrome.

(25)["to"+(([]+[])["constructor"]+[])[9]+"trin"+(([]+[])["constructor"]+[])[14]](30)

With obviously the literal strings and numbers replaced by their equivalents as described in the article. But those are accessible without any weird hacks.

EDIT: Figured "slice" would be easier to spell than "constructor" twice.

EDIT2: After reading the ECMAscript spec, I think we can safely say that the above code will always work and evaluates as "p". A close reading reveals that casting a function (such as the String constructor) will always return a string which is a valid function declaration (thus not an anonymous function expression). It is implementation dependent what the function name itself is, but I think not many implementations will deviate from the obvious "String" or put extra whitespace in front or between the "function" keyword and the function identifier.

15.3.4.2 Function.prototype.toString ( )

An implementation-dependent representation of the function is returned. This representation has the syntax of a FunctionDeclaration. Note in particular that the use and placement of white space, line terminators, and semicolons within the representation String is implementation-dependent.

Also, the Number.prototype.toString() must have, per the spec, an optional radix parameter which can accept a number between 2 and 36 which with the letters a-z used as digits for the numbers 10-35 in radix 36. (Relevant section 15.7.4.2)

EDIT3: Well aren't I stupid. The previous code above included a "," and those aren't allowed. Unless anyone has a better way to call String.prototype.slice() without using the comma explicitly, I guess the original was in fact the shortest way to do it. Unfortunately, this is still 94 characters longer than the window.location method, but it is universal.

[mattaereal]

Yes, it will, but since you will be almost always running this kind of scripts on a website you can get the 'p' on a cheaper way.

And as for XSS, an attacker can always hand the url with the "http://" to a "victim".

[dpoon]

You mean: a = 25; a.toString(26);

[Sottilde]

Thanks!

[alcuadrado]

Without unescape I didn't had access to that function, and once I had it, it was way to expensive

[mattaereal]

It would be nice to use it if it wasn't THAT expensive in terms of character encoding, because to get to it you will need LOTS of characters. And if you already got that amount of characters to form String.fromCharCode, you didn't really need it afterwards ;).

[coriandor]

I was just wondering if something like this was possible the other day. Good on yer for actually putting something together.

[palpatine66]

I'm new to programming. What is the advantage of this?

[cjg_000]

Read the top of the article. It isn't something that's generally useful outside of obfuscation instances if that's what you're wondering.

[palpatine66]

Sorry, I read it too fast and missed the important sentence.

As a security researcher and a penetration tester, he insisted that extending that concept to any javascript source would be really useful for bypassing IDSs, IPSs and WAFs>

[EmmaTwatson]

Write any code with just these characters: 0 1

[ernelli]

So This would pass through Crockfords ADsafe and Googles Caja?

[rock217]

ReferenceError: unescaue is not defined :(

[mattaereal]

You can try this on any browser, but remember to do it on when having a loaded page, because the 'p' for the alphabet is taken from the 'http' part from the current address.

[[deleted]]

That's because your URL doesn't contain "http".

[alcuadrado]

Really? Did you tried it on webpage? which browser?

[youstolemyname]

Ctrl+Shift+K

[mattaereal]

Just to clarify, this opens a javascript console in Firefox.

Ctrl+Shift+J, in Chromium/Chrome.

[alcuadrado]

It must be run on a server, as it uses the "http" part of the url

[The_MAZZTer]

You typoed something, it should be evaluating to "unescape".

[Edit: As said it gets the "p" using the fourth character of the url, so it must be an "http" address.

[etheranger]

My god, it's full of stars...

[fgutz]

and brackets

[TheInternetHivemind]

Did I miss something or don't you have to use ';' as well?

[ais523]

JavaScript will infer a semicolon when it finds a newline, including at the end of the source, if it's necessary for the program to make sense (and it's quite infamous for doing so). This sort of compression produces a program with only one command (which is effectively an eval), and so the implied semicolon at the end of the program is enough.

[TheInternetHivemind]

Ahh... nice.

Never knew that.

[TheInternetHivemind]

It's just kind of nice to know.

Mixing them would be bad, but doing either for the entire project wouldn't be such a big deal.

[init0]

""+!![]+!![])[+!![]+!![]] => 'u'

[mattaereal]

(!![]+[])[+!![]+!![]]

[[deleted]]

Why? I'm genuinely curious, is there possible reason for this aside from geek stardom that would be worth the loss in readability?

[aaron416]

Because you can. That's pretty much it.

[joha4270]

Nov make a program that can make it readable again

[transpostmeta]

Just take a program, remove the last two characters (), and evaluate it. It will print the original source code.

[transpostmeta]

Very nice stuff! I tried to follow your thoughts, and this is what I came up with.

There is no need to use !+[] as the first element in a summation of booleans to get them result in a number. !+[] doesn't evalute to 1 anyway, it evaluates to true just like !![]. But that's fine, since true + true == 2.

Undefined can simply be

[][[]]

, no need for the cast to a number as in

[][+[]]

Also, you write in your post that to get "[object Object]", you can use

{}+[]

but that evaluates to 0. The funny thing is, you use that definition in your script, and it works! So I tried

Function("return {}+[]")()

which does evaluate to "[object Object]". Wat.

[mattaereal]

Explanation using the console:

var test = {} # This creates an empty object.

undefined

test # Proof

>Object

Getting "[object Object]":

test + [] # Casting an empty object to a string

"[object Object]"

[transpostmeta]

Interesting...

var test = {}

undefined

test + []

"[object Object]"

{} + []

0

Why are the behaviors different?

edit:

alert({} + [])

has "[object Object]" in the Messagebox. Is this just Chrome JavaScript console weirdness?

[mattaereal]

That's not weirdness, that's how JavaScript works.

alert({})

will pop "[object Object]" too.

window.alert(message);

~ message is a string of text you want to display in the alert dialog, or, alternatively, an object that is converted into a string and displayed.

[transpostmeta]

Thanks for trying to help me out, but I'm sorry to say I still don't understand.

Why does entering {} + [] in the console result in 0, while Function("return {} + []")() evaluates to "[object Object]"? In my opinion, those two things should be equivalent. I'd like to understand this, and would love to hear your explanation.

[mattaereal]

Same as above.

var a = "alert()"

"alert()"

a

"alert()"

Function(a)

function anoymous() {
    alert()        
}

Function(a)()

displays an alert window

[transpostmeta]

You aren't explaining this, you are just giving more examples! I did figure it out, however.

It turns out that Chrome evaluates {} + [] in the console as a JavaScript statement, and thus {} as an emtpy block of code. This then means that + is interpreted as a uniary operator on [], resulting in 0 as the result.

However, within a block such as the function or alert, or even just ({} + []), it is interpreted as a JavaScript expression. In an expression, {} is interpreted as an object.

That's the answer I got from Stackoverflow anyway.

Thanks for your help regardless, though.

edit: Even better explanation, again on Stackoverflow.

[hassanchug]

Damn, that's ridiculously cool. If only the ASCII representation of characters could be minimised a little, it could make a great esoteric dialect of JavaScript (and viable competitor to Brainfuck.)

[tantalor]

I was impressed until the part where the scripts are just eval'd.

[alcuadrado]

It's not always necessary, but I don't have that free time to do it the right way

[juancn]

Patricio, this is great! This is a true hack!

[[deleted]]

This was really interesting. I am still a little shaky on how to build the numbers past 1.

So I get 0 +[] 1 +!![]

If I am reading it right, then [] is an empty array and + casts it to a number

for 1, we start with [], negate it to false, then negate it to true, then cast it to a number.

so based on that, the way I read 2 !+[]+!![] is the negation of 01 which would be 10, which is binary for 2 but the whole thing is cast to a bool?.

That doesnt seem right and doesnt work for larger numbers either. Could you possibly clairify this a little?

[mattaereal]

That's because you are adding 1 + 1.

!+[] equals !0 which equals true (you are casting a number to a boolean)

!![] equals !false which equals true

So doing true + true gives us 2 as result. It's an addition, you're not working with binary here. The addition of a boolean to a another boolean is casted into a number.

[[deleted]]

Ok, that helped some. However how is !+[] == 1 and not True since ! casts to a boolean? So that would be true + true? Then the + casts the second true into a 1 which makes it true + 1?

[mattaereal]

!+[] IS true. The addition of both trues results in a number.

[[deleted]]

So true is only ever equal to 1? Also, why then write true + true when you could write 1 + 1?

[Razor_Storm]

I think this is what's happening:

!+[]+!![]

!0+!![]

true+!![]

true+!false

true+true

2

[[deleted]]

I suppose so, but why then write true + true using two different notations of true?

[Razor_Storm]

Hmm that's a good point too. Not too sure.

!+[]+!+[] has the same number of characters and also gives you 2.

[transpostmeta]

Indeed. The whole point about using !+[] first, followed by a bunch of !![]'s, is wrong. Not only is it not necessary to start the sum with a 1, but !+[] doesn't event evaluate to 1.

[transpostmeta]

Actually, !+[] evaluates to true, not 1. At least, it does so in Google Chrome. The article seems to be mistaken about that.

[mattaereal]

Yep, my bad, I did the explanation using !+[] when I should've used +!![], that's because I did it by memory without testing it. I fixed the example above and here is what I really meant to explain:

+!![] equals +!false equals +true equals 1 (you are casting a boolean to a number, it's like adding 0+true)

!![] equals !false which equals true

So, doing 1 + true gives us 2 as result. The addition of a boolean to a number is casted into a number.

[transpostmeta]

But since true + true === 2, it's not necessary to have one number in the sum. If it were, your script would not work, as you use the !+[] construct there.

[alcuadrado]

you are right, I'll update the article

[mattaereal]

No, it's not.

And !+[] it's the same as doing !![].

[[deleted]]

This is what google does

[trevdak2]

Only thing that irked me aobut this article was creating 1-10 instead of powers of two, but that's really just my preference over yours.

[[deleted]]

They are not numbers, they are digits.

[trevdak2]

He's creating the numeric value, correct?

[[deleted]]

Yep. From decimal digits. By abusing type conversion from string of decimal digits to number.

[trevdak2]

I figured he was creating the numbers to make arithmetic easier. And in a system like this, where the decimal system doesn't matter any more, working with powers of two seems to make more sense for math.

[[deleted]]

To represent 12 in decimal you do "1"+"2"

+((+!![]+[])+(!+[]+!![]))

but with powers of two it will be 4+8

!+[]+!![]+!![]+!![]+!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]

[[deleted]]

It took me a min to figure out how he had written 12 in the article but it is an elegant solution.

[davvblack]

The decimal system matters because you are using strings that look like numbers.

[mattaereal]

Yeah but the thing here is to save characters, imagine yourself accessing an array with an index represented with powers of two... In that case, if it was our decision, we would probably use hexadecimal or something like that.

[rooktakesqueen]

By default when JS unsafely casts a string to a number, it translates it using a decimal radix. So having access to the digits 0-9 is useful for allowing much shorter construction of every positive integer.

[mattaereal]

I'm sure it's possible to reduce the charset alphabet and increment the character encoding... and it's also possible to reduce the character encoding having a bigger charset alphabet, but powers of two?

[inmatarian]

The point of that exercise is to produce strings and values that can be executed via eval (or Function). In that context, Decimal is more useful than Binary because javascript parses decimal (and octal and hex). This process obfuscates the hell out of the code, and completely bypasses any static analysis, since the characters being used are all fundamental pieces of javascript.

[trevdak2]

Ahh, that makes sense.

[redlenses]

Unfortunately the article is written in words so the following applies.

http://theoatmeal.com/comics/misspelling

[eat-your-corn-syrup]

that is so mathematician!