Reverse Engineering Obfuscated JavaScript

[@specki5101]

Great vid! But why are PDFs allowed to execute JavaScript code? This just seems like a huge no-no to me.

[@yesthatsam]

specki there is so many softwares that allows it. On another hand we don't hear of hacks using that door that often so it must be a dead end.

[@LiveOverflow]

oh you are soooo wrong :D javascript in PDFs has ben abused many many times ;) example: insert-script.blogspot.de/2014/12/multiple-pdf-vulnerabilites-text-and.html

[@yesthatsam]

LiveOverflow thanks for the link ! I guess I have had too much up to date version ;) Edit : haha ! Wrong again :/ Seems like it still vulnerable. Well that makes me think of PDF reader differently.

[@AgentM124]

*injects PDF with JS to do very evil things, mwhahaha*

[@GegoXaren]

specki Depends on the viewer. Adobe Reader (and Chrome, it seems) is one of the few viewers that supports JS.

[@cyancoyote7366]

After coming home from work, it's such a great feeling to just sit back with a cold beer and watch some reversing :D

[@ikbenwelthuis]

3:15 My technique would be to copy it, paste it on stackoverflow and ask if someone knows what it does.

[@andersenzheng]

A better technique is post it, provide a wrong answer, watch people give you the best answer in desperation to correct you. People tend to give you more information in correcting than answering.

[@BUFFDOENUT950]

I actually do that. lmao

[@DarkOverFlowOverflow]

Script kiddie

[@Lunascaped]

DarkOverFlow Overflow its a joke

[@michaelepica3564]

@@DarkOverFlowOverflow sometimes you need to ask for help

[@ruroruro]

Damn. I remember, that I had extremely weird Chromium PDF Viewer "Please wait..." pop-ups on certain web sites, that would quickly close. I was extremely freaked out by them, but now everything makes sense.

[@angelcaru]

Popunders: exist Tiling window managers: *I don't have such weaknesses*

[@celesteartley8473]

This video was awesome, I am a newbie to Js and code in general but not only did I learn a lot it was a cool idea no matter how nefarious it could be.

[@brianchandler3346]

Enjoying vids like these and admire your thinking. I often learn some technique I never thought of trying. Keep'em up. :)

[@rabbitdrink]

"please disable your ad blocker we promise not to bug you"

[@voidnull3192]

but which link I have to download to hackard that so I make sure i can get not any popunders?!

[@JBlongz]

This is not the video I was looking for, but it was extremely interesting. I had to watch the whole thing. Hate those pop unders, but see the value for marketing. thank you

[@dabbopabblo]

This has to be the BEST coding related JavaScript video Ive seen on KZbin in awhile, omg!

[@jonasls]

You just ruined this guy's business.

[@reijin90]

Not really. His business is to provide a uniform API for all browsers where the advertisers do not have to take care of making the bypasses themselves. As you saw on the video, some functionality will be deprecated in september. They need to create a new bypass until then.

[@jonasls]

Benedikt Tröster true

[@fission1110]

Yea, but fuck that guy.

[@logan_makes_games]

Well we all know how to reverse engineer his code which is cool.

[@xorinzor]

I totally approve of ruining that guy. Fuck him for ruining the internet.

[@dextergerig]

Wow, I remember seeing that Please wait... Loading PDF. Message on sites over the past few months and always wondered what it was for. Guess I have my answer from a completely unexpected source.

[@DavidGilbertson]

I think this is the funniest and most interesting JS video I've ever watched.

[@patrick1020000]

I just blogged about this very script 2 weeks ago! Glad we came to the same conclusion. I went a little further looking at the encoded data. Just mentioned you in a tweet with the link

[@patrick1020000]

I don't think it is courteous to self-promote on someone else's video

[@dKonstructed]

Well, you should add one to your KZbin profile at least. I'm always looking for good sources of this type of information.

[@maulanaiskandar1058]

Quality content as always

[@mychemicaljojo]

Really nice video! One of my tips when going through obfuscated code: they always eval. No matter what, most of the obfuscated code I’ve seen always converts some arbitrary data structure through arbitrary functions into a nice string that will then get eval’d. Try looking for that call and you’ll be able to alert whatever it is that goes through eval, and you’ll get clean source.

[@Sejiko]

U helped me a bit for this challange btw www.hackthebox.eu //sing in xD

[@123tobiiboii123]

Damn I wonder how much of just trying weird shit it took the original creator to make the bypass. I guess if the money is there they don't care how long it takes

[@omaryahia]

this is just amazing! thank you so much I really like these adventures of reverse engineering

[@ccarniver]

I would never have figured this out in a million years, thanks

[@nnm35]

Bravo! The finale, with the base64 pdf calling a JS alert made me laugh out loud. You got im! Subscribing.

[@m42uko]

Thanks for this video! I've been wondering for ages what this weird PDF-Viewer message was all about. I kinda already suspected that it was some kind of scam, but I would not have guessed for it to be that elaborate.

[@LiEnby]

single handedly destroyed this guys carrier xD

[@MrUllala1]

As usual your videos are very explicative! Good Job!

[@Nomnomkun]

Great re way, really cool video, I really enjoyed watching and learning

[@Anas-gi9tn]

wow, every line is pure art

[@MarKac9090]

very nice as always! would be great if you could also put your code snippets for download

[@VegaDW]

I'm legitimately worried this comany will sue you or try to get a strike on your videos, even if they have no solid legal standing.

[@ligius3]

Reverse engineering is legal in EU, AFAIK, and no damages were done. The business model cannot be argued here, they are attempting to sell something that circumvents usual behavior and has a very short shelf life. They don't have any basis to argue on: no code was copied or distributed, no copyright infringement. And no libel, he never said 'this company sucks, don't buy from them'. But you can sue and C&D on any grounds, doesn't mean you'll win. I'm more worried about possible exploits every time I use my browser for important stuff. Especially with the trend of some companies buying established chrome extensions and adding adware/spyware to them.

[@zyrohnmng]

Think of it like a very detailed product review...

[@JM-Games]

There's nothing illegal with what he did, he didn't steal any of the code, he reverse engineered the programme for learning purposes and created a video that showcased his workflow. The initial code he created was not profitted upon, It's similar to somebody opening a console to see how it ticks and documenting it, big companies probably want this illegalised but that doesn't mean it is.

[@r.pizzamonkey7379]

A really good lawyer could make the case that it was a trade secret, and it could probably get _into_ court, but it would ultimately be frivolous since reverse-engineering is a legal method of acquiring trade secrets. That being said, since I'm in the future I can say with confidence that didn't happen.

[@NiquelBones]

@@zyrohnmng lmfao that made my day

[@ndm13]

I love your reverse engineering videos!

[@saloperie]

Then everything else is just obfuscation and license checks ? You just reversed 700$ worth of license rofl

[@LiveOverflow]

well the licensed code is much more optimized and works way better than my simple PoC. And the code also has options for Edge and Firefox, as well as support. So I did not reverse engineer the whole library or the licensing. My PoC is worthless in comparison ;)

[@r.pizzamonkey7379]

Well, and even knowing the secret building and maintaining a custom solution is probably more expensive than just buying it outright

[@AnoNymous-ie3wc]

several thousand lines of code refined on 10 lines. i love it ^^

[@juri14111996]

not realy. the original works cross platform.

[@hakunamata_tuh]

wow... what a tricky! awesome content keep it up! subbed!

[@JM-Games]

The title hurt my head, JavaScript thats more obfuscated than JavaScript.. o.o Mind blown.

[@romanemul1]

very good. You should spend some time to develop some ad block chrome,mozilla plugin with your skills. But be careful evil lurks everywhere and reverse engineer hunting game is everywhere. Hope one day youll get some credit on reddit.

[@BluecoreG]

romanemul1, Lol You do know he pays his bills with the money he gets from KZbin ads. Why in the world would he make an Ad Blocker??

[@LiveOverflow]

I don’t earn anything from YT. And I encourage you to use an Ad Blocker!

[@mysirg133]

LiveOverflow i love good teachers thx:) aloot

[@Nodeagent]

reverse engineer hunting?

[@kublermdk]

That was awesome. Great work!

[@123Jeffdude]

Awesome video. Any idea why the pop under demo site had the small window opening and closing in the bottom right of your screen?

[@LiveOverflow]

you have to open the popup window before doing the trick with the alert boxes. So that the user doesn't notice the opening of this window, it's hidden in the bottom right. And the size is changed back after the popunder was successful.

[@123Jeffdude]

Oh I see. Thanks for sharing!

[@DanielLiNeutrinos]

3 years later... Chrome seems to be fixed but Edge still allowed the popunder

[@Towzlie]

hidden s are used in CSRF injections too great video

[@nathanmack10]

Proxy was pretty smart, I would probably have just launched my vpn server on my phone, I have a few tools on that... But overall really good channel, subscribing! I'll finish the video, however this could make some decent dough

[@LiveOverflow]

+Nathan Mack wat? VPN? We are using here a javascript proxy object. It has nothing to do with network proxies. Just used it as a comparison.

[@fuanka1724]

awesome video, love reverse-engeneering!

[@ItsGravix]

RIP that guy's company

[@david-tracy]

At around 1:35 you mentioned that the debugger statement triggers a breakpoint & that we can't simply continue because it's constantly being called on a timer. I see that each time you try to continue past the current breakpoint that it then goes on to the next breakpoint immediately, but what does it mean when you said that we can't simply continue because the breakpoint is constantly "called on a timer"?

[@LiveOverflow]

It gets called so much, that we are not able to debug anything else. It’s too annoying

[@david-tracy]

@@LiveOverflow I agree. What do they do to make it get invoked so often?

[@user-cz9ss4yq4x]

redstar-os, nice touch 😂

[@JohnNorrbin]

Testing it out with the link you added in the description does not work in Version 60.0.3112.90 (Official Build) (64-bit)

[@LiveOverflow]

It should work. It's a timing thing and I did not spend the time to optimise it. If the notification permission request and the alert are shown at the same time it should work.

[@JohnNorrbin]

Ok i just tested it without changing anything :D

[@over00lordunknown12]

1:03 Wait, did I already see how it does it?!... XD It first makes a notification permission request on the first website, then it opens the chrome pdf viewer on the first website to close the permission request for notifications... And uses the dismissal of the permission request to shift focus off of the popup, and onto the main window? (I doubt it... but still! :D)

[@over00lordunknown12]

Woah! :D I got it pretty good! :D

[@alexnezhynsky9707]

Wow that was master class. Sehr gut!

[@davidabba7663]

Enjoyed Thank you 🎉

[@CZghost]

John Hammond would head out and straight just deobfuscate the Javascript code in order to see how the code has been made in the first place. You decided to hack under the hood secretly by sniffing used methods and constructing your own code that does the same thing. Great :)

[@disruptive_innovator]

Ok magnificent wizard, I shall subscribe to your channel!

[@hasnieking]

How did he add an anti-debugger?

[@A.D.G]

hasnieking you can do this: window.setInterval(function () { debugger(); }, 1); That calls the debugger function every 1 millisecond, but only has an affect on a browser when the devtools are open.

[@victornpb]

debugger is not a function tho its just debugger;

[@TheInfi]

@@victornpb Some keywords are also functions, like typeof, instanceof, and debugger.

[@justadam3536]

I can imagine the faces of these who bought the popunder lisence after seeing this video lol

[@geoffl]

this is freakin brilliant

[@danielsalloum3006]

Too awesome man!

[@BrandNewByxor]

Can you still get popunders with a tiling window manager? I'm on i3, so if anything opens it'll probably open in a gigantic window beside my browser

[@voidnull3192]

3:47 i think you could try changing broadcast host from 0 to enough room for 1 connection and 11:24, never seen a url with the delimiters /?'$variable_Popup_orYadaYada' usually just, www.'/'.DOM/sql?a= so probably the forward slash.

[@小张同学-v6i]

thanks for this video.. i learn a lot!

[@MartinRys]

By the time you released this video Chromium 60 was already live for a day or two, does this still happen in Chrome 60?

[@vert3x560]

I don't understand one thing. Why do someone even bother to "display" an ad UNDER th window, away from the user sight XD? Isn't it the oposite of what ads are ment for?

[@TheGH0STmzpelf]

> "obfuscated javascript" > implying javascript code isn't necessarily obfuscated by its very existence

[@neithanm]

It's not. Next!

[@TheGH0STmzpelf]

a) the typing system b) semicolons after curly brackets c) implied globals d) the _this_ keyword e) typeof NaN and null JS has an ambiguous and counterintuitive syntax and behaviour for many basic things. Obfuscation consists in making code as ambiguous and counterintuitive as possible. I was joking saying JS is actually obfuscated in nature, but it remains true that it's not because you're used to its shortcomings that they aren't there.

[@Hati_0x]

You sound like someone who has barely scratched the surface of Javascript and are labeling it bad out of frustration. It's a very dynamic and powerful language if you know it properly. a) Javascript has only 7 data types: Boolean, Null, Undefined, Number, String, Symbol, and Object. Everything else (including Arrays and Functions!) inherits the Object type; This allows you to add properties/methods to any data (inhering Object), which cleans up the variable namespace and makes Javascript dynamic and multi-paradigmatic. The prototype pattern is a keyword here. b) Javascript doesn't require you to have semicolons after curly brackets. In fact, semicolons aren't required anywhere in Javascript except for for-loops afaik. The only reason they're part of Javascript is for extra verbosity and in cases were you want to have multiple statements in one line (look up Javascript minifiers). I myself never write the semicolons because of readability. c) Javascript doesn't have implied globals if you're writing good Javascript code. That means declaring variables before assigning or using them. If this is an issue you should enable strict mode in your code, which requires you to declare variables using the _var_ or _let_ keyword. This set the variable's scope and implicit globals becomes non-existent. I highly recommend you to always enable strict mode because it forces you to write code in a manner that avoids quirky problems like implicit globals. The only reason strict mode isn't on by default is because of backward compatibility, unfortunately. d) The _this_ keyword exists in everything inheriting Object and allows self-reference within methods. If you've done any Object-oriented programming it's very self-explanatory. e) These values exists because Javascript is very fluid and dynamic when it comes to data types. NaN is a Number which doesn't represents a valid number. This occurs when operations expected to return a number fails (e.g. multiplying a Number with a String; 1 * "a"). Null is very self-explanatory, it's simply a value that represents nothing.

[@i_dont_want_a_handle]

Agreed, and also NaN allows JS to handle calculus in a very cool way, like for example, 2^Infinity = Infinity, but 1^Infinity = NaN, which is true and any mathematician would really dig that =)

[@Qbe_Root]

Mostly agree with Hati_ here, although semicolons are actually required to avoid ambiguity, mainly after an expression when the next line starts with '(' (i.e. an IIFE), '[' (i.e. array destructuring), or some other characters like '+' or '-' that could also be the continuation of the previous expression. In those cases I just put a semicolon at the beginning of the next line, it looks a bit weird at first but it avoids refactoring mishaps. Also NaN is defined in IEEE-754, which is used basically everywhere for floating-point numbers, so NaN is also a float and/or a double in C, C++, Java, and so on, not just JS. On the other hand, typeof null === 'object' is a quirk from the early days of JS that many people would like to see fixed, but that likely won’t happen because of backwards compatibility.

[@eVashioNN]

Great video!

[@epkostaring]

Super cool video

[@angryman9333]

Please more of this

[@kevinchen8325]

I was so confused where the please wait alert box came from lol

[@BatteryProductions]

very good job sir!

[@trieulieuf9]

3 year late, but today i learned - We can map any domain name to localhost by editing /etc/hosts - Proxying any Javascript function - Disable that annoying debugger when open Developer Tools - PDF can run Javascript and popup alert - Javascript is kind of mad

[@mariustancredi2192]

WOW, well done!

[@Gukslaven]

This is epic, thanks!

[@brunoais]

I'd have used multiple arguments in the console object's "log()" method. The results are way way more complete.

[@dashdeck4418]

Such a great channel! Thank you very much for this enlightening video. A question though: I re-watched 10 times the sequence about the mkp()/window.open() trick. Still do not get it. As soon as you set a proxy in your experiment, then any window.open() call should get trapped. From anywhere. Why can't you see it? Why has mkp() different from any functions so that the proxy is bypassed?

[@LiveOverflow]

+dash deck because my Proxy is only set on the one page. And the code creates an iFrame, which is a new page. The javascript is separated for that iFrame, do. when they call open from there, my proxy won't catch it

[@BorisMediaProds]

"Ad makers hate this guy!" click here learn his secret!

[@Mechanicel361]

digga du bist ja so krass respekt man #liveoverflow

[@davidtaylor7327]

hahahahahahaha this was the best troll/Informational video I've ever seen! great job

[@amiralmusawi9030]

I respect your skills.

[@HenrryPires]

How did you manage to download the site and make it run on your machine?

[@hinglemccringleberry3881]

The music at the end of the video is way too loud and your mic audio is too low. Also, can this trick be prevented by blocking all notification requests?

[@hostar2]

Nice! On one website I was able to capture the PDF using "Network" tab in Devtools. But I am wondering, how to block this in adblocker...

[@asj3419]

You don't have to, some of the apis that where used are now depricated and will not work.

[@knighToFdemonS]

Could a re-definition of the window.open function prevent you from analyzing the code? I'm thinking of: - You are re-defining the critical functions - JS files get loaded - On loading the the developer puts in a re-defining of the functions to standard (like window.open = window.open) Then your initial re-defining of those functions would be set to normal again before executing the crucial code soooo....in the end your method would not work. Am I right?

[@luphoria]

Not necessarily. One thing I do when proxying base functions is archiving the original function (e.g. `window._open = window.open` before redefining the original window.open), so I can then see what I want first

[@TkrZ]

@LiveOverflow can you revisit this with his new, updated javascript please?

[@My1xT]

I rather wonder why the standard browser pop-up blockers don't react on this? I mean even in an iFrame it is window open

[@LiveOverflow]

because it is tied to a user interaction. A pop-up is allowed if the user intended to open one. For example after a click. So it becomes very complex to build a pop-up blocker that allows that, but prevents malicious popups.

[@My1xT]

LiveOverflow but the iFrame itself never got any interaction, so that pop up should fail basically because of this, which would make this iFrame chaos much harder. I liked it how Firefox in the early days just popped in a yellow bar noting the pop-up, even if it's a click more, it would be awesome to have that as a setting

[@LiveOverflow]

did you watch the video? The popup is opened on the click... The is used for something else. It is used to render a .pdf, which triggers an alert, to get focus back to the main window and leave the popup in the background. So the popup is perfectly legal - triggered by your click.

[@My1xT]

LiveOverflow 8:49 window open is in an iFrame that didn't even exist while the user interaction started but rather was created upon that, so one cant proxy the window open. The thing is while the site got an interaction and might be able to open a pop-up, imo the iFrame should not have that because it didn't get any interaction

[@LiveOverflow]

No... it just defines a function there to call window open. The call to that function is then coming from the user's click. It's basically just a method to get a clean reference to window.open. The call is in a function in the , but the function is called from a user's click coming from the main page. If you look at my minimised PoC at the end, I'm not using that method because it's not necessary to make it work.

[@tcc5750]

1:44 clever!

[@robinebers]

What microphone are you using to record those videos? Pretty good sound!

[@LiveOverflow]

+Robin Ebers thanks! But nothing fancy. Simple AT2020 USB mic on a stand with a pop filter.

[@hakunamata_tuh]

This is how publisher make extra money. Implement this tricky to make user less noticeable.

[@irondsd]

This is pretty smart.

[@desheen5056]

Awesome 👍

[@Overgreen]

So... why is your computer name redstar-os???

[@BUFFDOENUT950]

everytime I try to run php server on my local host after editing the hosts file I keep getting a 404 error

[@BUFFDOENUT950]

nvm got it working

[@anasarkawi4331]

great but why pdfs can execute code?

[@Luca-mit-ca]

How "reverse engineering" works in js: >open file >read it

[@stankojankovic]

Awesome! Danke! :)

[@chaosmagican]

That was very interesting. It also explains the notification permission alert (which goes away after a second) when I visit xhamster... *cough* I mean, I... I ... I don't get any popunders though so I guess thanks google for uninterrupted pr0n? :D

[@balajis1800]

Can u shows how to analyse an API

[@ciriousjoker]

I guess I'd just compile my own version of some OS and insert some GPIO logging to get the machine code that does this

[@miloradowicz]

Why would you have to go that far? Compiling your own version of some browser and hooking APIs would suffice...

[@nope2670]

Just checked, and it no longer seems to work. Now it just opens the new window in another tab.

[@vuufke4327]

How I would have approached this is to save the obfuscated scripts and just use them as they

[@thealgorithm7633]

You are genius

[@szachgr43]

Do you have in yours plans make some video about JSMiner crypto attack. Similar like pop up but there are no ads but script start run mining some cryptocurrency on our computer :D for example coin-hive

[@mrgummage]

14 shovelware marketing company employees dislike this video.

[@ari_archer]

me, using a tiling window manager: haha

[@peterforthewin]

Good video, like always

[@LiveOverflow]

you didn't even have the time to watch it all!

[@justvashu]

LiveOverflow I guess the video is just that good :). Srly thou these type of videos are a great insight into the mindset of problem solving.

[@peterforthewin]

I dont need to see it to know if it is a good video. I learn more watching your videos than in my university, keep up the work its excelent! :)

[@splitpierre]

Juicy!

[@yaj126]

Some quality reverse engineering also you sound like prismo

[@LiveOverflow]

+yaj126 prison? Another voice doppelganger?

[@yaj126]

Prismo bruh from adventure time, the voice actors name is... kumail nanjiani? Not sure if you'll agree but I was pretty baked 23 hrs ago