Skip to content

Comment on JavaScript ( (__ = $ + $)[+$] + ({} + $)[_/_] +({} + $)[_/_] )parent

Comments

Ok here's the best I can do:

(lines are numbered in order of execution, with explanations of each line)

    ($=[                // 14: $ = Array.prototype.sort ([]["sort"] = Array.prototype.sort)
        $=[]            // 1: $ = []
    ][
        (__= !$+$ )[    // 2: __= "false" (![]+[] = false+[] = "false")
            _=-~-~-~$   // 3: _= 3 (-~-~-~[] = -~-~-(-1) = -~-~(1) = -~-(-2) = -~(2) = -(-3) = 3)
        ]+              // 4: "s" ("false[3]" = "s")
        ({}+$)[         // 5: "[object Object]" ({}+[] = "[object Object]")
            _/_         // 6: 1 (3/3 = 1)
        ]+              // 7: "o" ("[object Object]"[1] = "o")
        ($$=            // 12: $$ = "rt"
            ($_=        // 9: $_ = "true"
                !''+$   // 8: "true" (!''+[] = true+[] = "true")
            )[_/_]+     // 10: "r" ("true"[3/3] = "true"[1] = "r")
            $_[+$]      // 11: "t" ("true"[+[]] = "true"[0] = "t")
        )               // 13: "rt"
    ])()[               // 15: window (sort() = window)
        __[_/_]+        // 16: "a" ("false"[3/3] = "false[1]" = "a")
        __[_+~$]+       // 17: "l" ("false"[3+(~$)] = "false"[3+(-1)] = "false"[2] = "l")
        $_[_]+          // 18: "e" ("true"[3] = "e")
        $$              // 19: "rt"
    ](_/_)              // 20: alert(1) (window["alert"](3/3) = alert(1))
[] is assigned to "$" in step one. Several of the steps between 2 and 11 reference "$" to save one character rather than typing

If you wanted to remove the a=[] you'd have to include a bunch of "[]"s inline, e.x.:

    ($=[][
        (__= ![]+[] )[
            _=-~-~-~[]
        ]+
        ({}+[])[
            _/_
        ]+
        ($$=
            ($_=
                !''+[]
            )[_/_]+
            $_[+[]]
        )
    ])()[
        __[_/_]+
        __[_+~$]+
        $_[_]+
        $$
    ](_/_)
Replacing the no-alpha variable names with letters might help:
    (F=[
        A=[]
    ][
        (B= !A+A )[
            C=-~-~-~A
        ]+
        ({}+A)[
            C/C
        ]+
        (D=
            (E=
                !''+A
            )[C/C]+
            E[+A]
        )
    ])()[
        B[C/C]+
        B[C+~F]+
        E[C]+
        D
    ](C/C)
Notice both "A" and "F" were "$". The original code reused "$" to save a character.

I'm not sure I can make it any clearer.

wow that was sure detailed.

but i'm still not convinced of the steps :)

($=[][(__=!$+$)[_=-~-~-~$]+({}+$)[_/_]+ ($$=($_=!''+$)[_/_]+$_[+[]])])()[__[_/_]+__ [_+~$]+$_[_]+$$](_/_)

here i kept $, only step 11 required [] instead of $

i'm guessing step 14 is actually executed earlier... or that undefined has the same effects as [] for most of those stringfying hacks. Update: no, undefined trhows an error. so step 14 is earlier... let me replace all that with a eval function that also stores the run order. then i will post the correct ordering.

No, step 14 is definitely executed after the rest of that expression. Steps 2, 3, 5, 8, and 10 assume that $ equals [].

If you still refuse to believe me, I give up.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.