aemkei / jsfuck

JSFuck JSFuck is an esoteric and educational programming style based on the atomic parts of JavaScript. It uses only six different characters to write and execute code. It does not depend on a browser, so you can even run it on Node.js. Demo: jsfuck.com By @aemkei and friends. Example The following source will do an : Basics false => ![] true => !![] undefined => [][[]] NaN => +[![]] 0 => +[] 1 => +!+[] 2 => !+[]+!+[] 10 => +[[+!+[]]+[+[]]] Array => [] Number => +[] String => []+[] Boolean => ![] Function => []["filter"] run => []["filter"]"constructor"() eval => []["filter"]"constructor"()( CODE ) window => []["filter"]"constructor"() See the full list here. How it Works **Note:** Feel free to join the discussion here: https://gitter.im/aemkei/jsfuck – Brackets Let's start with the opening and closing brackets and see what is possible here. They are super useful for this project and are considered as a core element because they provide a way to: • deal with arrays • access properties and methods. – Array Literals Create new arrays: – Array / Object Access Later we will be able to do this: • Array wrapping trick By wrapping an expression in an array and then getting the element at index zero, we can apply several operators on one expression. This means brackets can replace parenthesis to isolate expressions: – Plus Sign This symbol is useful, because it allows us to: • create numbers • add two values • concatenating strings • create strings The current version of JSFuck uses it a lot but we not sure if they are fundamental. Cast to Number Increment Numbers Using the array wrapping trick mentioned above: Getting Getting an element by index in an empty array will return : Getting Casting to Number will result in not-a-number: Add Numbers A shorter way using ++: Using this technique, we are able to access all digits: , , , , , , , , , – Casting to String Combining the plus sign and brackets will turn other values into strings: – Get Single Characters As we have strings, we can also get single characters: Since we have "NaN" and "undefined", we got the following characters: , , , , , , , . – Combine Characters Now we can concat characters to new words. – Numbers in exponential notation As we have the character "e" from "undefined", we can use exponential notation to construct very big numbers and get a reference to : Resulting chars: , , , , , , , , . – Access Methods Newly combinded characters can form method names. These can be accessed using the square brackets notation: *Note*: With the characters from "undefined", "NaN" and "Infinity", the only method we are able to find in the objects we have is . – Get Method Definitions We can cast a method to a String and get its definition as a String: This will return the following String: *Note*: String representations of native functions are not part of the ECMAScript standard and differ between browsers. For example, Firefox will output a slightly different string with additional line breaks using . Resulting characters: • , , , , , , , , , , • , , , , , , Resulting methods: • • . – Logical NOT operator This is the fourth character in the original JSFuck set and used to create booleans. Note: This symbol could also be replaced by others, like or . See the section "Alternatives" below. – Cast to Boolean The logical "Not" operator can be used to create booleans and : – Get "true" and "false" Booleans can be casted to string: This will give us access to more characters: , , , , , , , . Together with the set above, we will have with access to these methods: • • • • • • • • • • • • • • • *Important:* We might use another symbols like to create booleans, because they are more powerful (see section "Alternatives" below). – Primitive wrappers names With we have a reference to the function that created the instance. For primitives values, it returns the corresponding built-in wrappers: Use to convert them to strings and retrieve their function name in order to get more chars: New chars available : , , , , , , . … and more methods and properties: • • • • • • • • • • • • – Parenthesis Calling Methods Since we have access to methods, we can call them to get more power. To do this we need to introduce two more symbols and here. Example without arguments: New characters: , , , , , Calling method with more than one argument Calling a method with more than one argument is non trivial - to do it you can use the following technique (discovered by trincot) - for example: calling string method can be written as and finally: calling array method can be written as and finally: Calling string method with more than one argument in "flow way" To be able to call a method (with multiple arguments) in right side on results of previous method you can use this technique (discovered by trincot) - for example: can be written as and finally: Calling array method with more than one argument in "flow way" To call array methods in righthand side (flow) way" we use similar technique like for strings but with additional tricks (details here) presented in following example: can be written as (similar like for strings) but now we need to find right-hand side way to wrap array and get which can be done as follows so we get and finally (after remove dots and commas) – Getting any lowercase letter Number's method has an optional argument specifying the base to use (between 2 and 36). With base 36 we can retrieve any *lowercase* letter: Exposed characters: – Evaluate Code The Function constructor is the master key in JSFuck: It takes a String as an argument and returns a new anonymous function with this string as the function body. So it basically lets you evaluate any code as a String. This is like , without the need for a reference to the global scope (a.k.a. ). We can get the Function constructor e.g. with . This is the first major step and an essential part of a JS-to-JSFuck…