gcb on JavaScript ( (__ = $ + $)[+$] + ({} + $)[_/_] +({} + $)[_/_] )

Comment on JavaScript ( (__ = $ + $)[+$] + ({} + $)[_/_] +({} + $)[_/_] )parent

it actually increases the number of chars.

inner $=[] will be overwritten by outer $=[$], which is the same as $=[[]]

or am i missing something?

It doesn't get overwritten until the rest of the expression has been evaluated, thus $ == [] for all the uses of $ within the expression.

gcb 15y

still not clear.

the code unobfuscated is: (a=[a=[]]['sort'])()['alert'](1)

my argument is that this is the same, and less chars (a=[]['sort'])()['alert'](1)

I can't see any benefit of the encapsulation of the array assignment there.

edit: also, just noticed that my previous comments i was writting $=[[]] when i was thinking of $=[], but both works the same, and are still less chars :)

tlrobinson 15y

Ok here's the best I can do:

(lines are numbered in order of execution, with explanations of each line)

    ($=[                // 14: $ = Array.prototype.sort ([]["sort"] = Array.prototype.sort)
        $=[]            // 1: $ = []
    ][
        (__= !$+$ )[    // 2: __= "false" (![]+[] = false+[] = "false")
            _=-~-~-~$   // 3: _= 3 (-~-~-~[] = -~-~-(-1) = -~-~(1) = -~-(-2) = -~(2) = -(-3) = 3)
        ]+              // 4: "s" ("false[3]" = "s")
        ({}+$)[         // 5: "[object Object]" ({}+[] = "[object Object]")
            _/_         // 6: 1 (3/3 = 1)
        ]+              // 7: "o" ("[object Object]"[1] = "o")
        ($$=            // 12: $$ = "rt"
            ($_=        // 9: $_ = "true"
                !''+$   // 8: "true" (!''+[] = true+[] = "true")
            )[_/_]+     // 10: "r" ("true"[3/3] = "true"[1] = "r")
            $_[+$]      // 11: "t" ("true"[+[]] = "true"[0] = "t")
        )               // 13: "rt"
    ])()[               // 15: window (sort() = window)
        __[_/_]+        // 16: "a" ("false"[3/3] = "false[1]" = "a")
        __[_+~$]+       // 17: "l" ("false"[3+(~$)] = "false"[3+(-1)] = "false"[2] = "l")
        $_[_]+          // 18: "e" ("true"[3] = "e")
        $$              // 19: "rt"
    ](_/_)              // 20: alert(1) (window["alert"](3/3) = alert(1))

[] is assigned to "$" in step one. Several of the steps between 2 and 11 reference "$" to save one character rather than typing

If you wanted to remove the a=[] you'd have to include a bunch of "[]"s inline, e.x.:

    ($=[][
        (__= ![]+[] )[
            _=-~-~-~[]
        ]+
        ({}+[])[
            _/_
        ]+
        ($$=
            ($_=
                !''+[]
            )[_/_]+
            $_[+[]]
        )
    ])()[
        __[_/_]+
        __[_+~$]+
        $_[_]+
        $$
    ](_/_)

Replacing the no-alpha variable names with letters might help:

    (F=[
        A=[]
    ][
        (B= !A+A )[
            C=-~-~-~A
        ]+
        ({}+A)[
            C/C
        ]+
        (D=
            (E=
                !''+A
            )[C/C]+
            E[+A]
        )
    ])()[
        B[C/C]+
        B[C+~F]+
        E[C]+
        D
    ](C/C)

Notice both "A" and "F" were "$". The original code reused "$" to save a character.

I'm not sure I can make it any clearer.

gcb 15y

wow that was sure detailed.

but i'm still not convinced of the steps :)

($=[][(__=!$+$)[_=-~-~-~$]+({}+$)[_/_]+ ($$=($_=!''+$)[_/_]+$_[+[]])])()[__[_/_]+__ [_+~$]+$_[_]+$$](_/_)

here i kept $, only step 11 required [] instead of $

i'm guessing step 14 is actually executed earlier... or that undefined has the same effects as [] for most of those stringfying hacks. Update: no, undefined trhows an error. so step 14 is earlier... let me replace all that with a eval function that also stores the run order. then i will post the correct ordering.

tlrobinson 15y

No, step 14 is definitely executed after the rest of that expression. Steps 2, 3, 5, 8, and 10 assume that $ equals [].

If you still refuse to believe me, I give up.

gcb 15y

($=[][(__=!$+$)[_=-~-~-~$]+({}+$)[_/_]+ ($$=($_=!''+$)[_/_]+$_[+[]])])()[__[_/_]+__ [_+~$]+$_[_]+$$](_/_)

on the last string trick to write 'sort' it fails if there's no $=[$=[]]

all the other parts just $=[] works just fine. and they are in the same scope as the 't' i can't understand

Comments