How to explain such esoteric JS code

Question

This code is equal to alert(1), but how does it work ? I don't see eval here.

/ㅤ/-[ㅤ=''],ﾠ=!ㅤ+ㅤ,ㅤㅤ=!ﾠ+ㅤ,ㅤﾠ=ㅤ+{},ﾠㅤ=ﾠ[ㅤ++],ﾠﾠ=ﾠ[ﾠㅤㅤ=ㅤ
],ﾠㅤﾠ=++ﾠㅤㅤ+ㅤ,ㅤㅤㅤ=ㅤﾠ[ﾠㅤㅤ+ﾠㅤﾠ],ﾠ[ㅤㅤㅤ+=ㅤﾠ[ㅤ]+(ﾠ.ㅤㅤ+ㅤﾠ)[ㅤ]+ㅤㅤ[ﾠㅤﾠ]+ﾠㅤ+ﾠﾠ+ﾠ
[ﾠㅤㅤ]+ㅤㅤㅤ+ﾠㅤ+ㅤﾠ[ㅤ]+ﾠﾠ][ㅤㅤㅤ](ㅤㅤ[ㅤ]+ㅤㅤ[ﾠㅤㅤ]+ﾠ[ﾠㅤﾠ]+ﾠﾠ+ﾠㅤ+"(ㅤ)")()

This is known as `JSFuck` (that's the actual name), and there's a pretty good write-up on [**Wikipedia**](https://en.wikipedia.org/wiki/JSFuck). — Obsidian Age, Nov 27 '17 at 21:47
@ObsidianAge That, plus a bunch of weird unicode variable names — Bergi, Nov 27 '17 at 22:35

Matias Cicero · Accepted Answer · 2017-11-27T23:19:04.090

This is JSFuck, an esoteric programming language, that is actually valid JavaScript, so you don't need any special interpreter/compiler to run it.

The most popular one involves the use of just 6 characters ([]()!+), but yours is a bit different since it also uses /, =, ", ', ,, {, } and (blank).

It works by taking advantage of some nice features of JavaScript.

For instance, we know that [] is a truthy value, therefore ![] yields false.

With that same logic, we can get true by executing !![].

Numbers can be achieved too. We know that false is equal to 0, so the following expression makes sense: 0 + false == 0, right ? And it does. We know that false can be written as ![], and we know that we can omit the 0 on the left-side of the expression: +![] == 0.

Same can be said with true and 1: +!![]

The number 2 can be achieved by adding up two 1s: (+!![])+(+!![]), and so on.

With logic like these you can do pretty much anything.

For instance, a popular way to get the letter "a" is by producing a NaN result, converting it to string ("NaN"), and then getting the letter at index 1, which is "a".

Ok so.. We know we can get "alert(1)", but how do we execute this?

We can't use eval, because that will require to use characters not allowed on JSFuck.

Well, the way most people do it is like this:

Identify a well-known function of Array.prototype, let's say indexOf
Obtain its constructor instance
Pass in stringified code to this constructor
Execute the result

So, as a summary:

// You can try this on your browser!
[]["indexOf"]["constructor"]("alert(1)")()

We know that we can generate alphabetic characters on JSFuck, and we also know we can generate numbers, so that line of code up there is actually very possible.

How to explain such esoteric JS code

1 Answers1