I love you(jsbin.com)
jsbin.com
I love you
http://jsbin.com/OhisIQAW/1/edit
33 comments
ILOVEYOU source code:
http://www.cexx.org/loveletter.htm
I remember playing with this for hours. Also, having to fix my box when it hit. :)
I remember playing with this for hours. Also, having to fix my box when it hit. :)
Thank you kind internet stranger. Now, how does it work?
It's actually understandable, just tedious. Lot of dynamic typing/casting tricks.
First, we set var '$' to bitwise NOT of [], which is -1 ([] casts to 0 or false depending on the operator):
First, we set var '$' to bitwise NOT of [], which is -1 ([] casts to 0 or false depending on the operator):
$ = ~[];
$ = {___: ++$,
$$$$: (![]+"")[$],
...
$.___ == 0 // ($ was still -1, now it's 0)
$.$$$$ == "f" // I think
![] == false
(![]+"") == "false"
(![]+"")[$] is an index on the string, and $ is now 0
I'm puzzled as to how he got an alert to appear without alert anywhere in the script.
If he can get a reference to the window or 'this' at any point (which I haven't yet figured out), he can presumably use his string-building tricks to build the string "alert", then use:
window["alert"]("hello")(it's lucky that all of the letters in "alert" can be found in "true" and "false", although "undefined", "NaN" and "[object Object]" could probably be used too.)
It's quite clever, the script gets a reference to the function prototype by making the string "constructor" and calling (0)["constructor"]["constructor"]. Calling Function on a string returns a new function with the string as the body, which you can then execute.
Partially deobfuscated: http://jsbin.com/qiwib/1/edit?js,output
Partially deobfuscated: http://jsbin.com/qiwib/1/edit?js,output
Just tried to understand the last bit myself.
So he's doing 0["constructor"] which gives the constructor of a number, Number. Then he's 0["constructor"]["constructor"] gives the constructor of Number, which is like a function, so he gets Function.
I don't know why they didn't make it:
Function ("alert('I love you');")();
Maybe they needed more chars for the heart. That was a good little crash course in javascript Function constructors!
So he's doing 0["constructor"] which gives the constructor of a number, Number. Then he's 0["constructor"]["constructor"] gives the constructor of Number, which is like a function, so he gets Function.
var y = (0)["constructor"]["constructor"];
y == Function; // true
Function(
Function(
"return \"alert('I love you');\""
)()
)();
I don't know why they didn't make it:
Function ("alert('I love you');")();
Maybe they needed more chars for the heart. That was a good little crash course in javascript Function constructors!
I was a bit confused by the double Function call too. The string input to the first Function is:
"return"ale\162t(\"\111\40lo\166e\40\171ou.\"\40)""
"alert("I love you." )"
Oh, thank you. I did not notice there was an alert because I did not run the page.
I thought it was just cleverly shaped code that did nothing, decidedly less impressive.
I thought it was just cleverly shaped code that did nothing, decidedly less impressive.
Nothing says "I love you" like a valentine made of dollars signs.
I've used similar tricks to build this hideous creature:
http://jsbin.com/yecuh/1/edit?js,console
(click run)
http://jsbin.com/yecuh/1/edit?js,console
(click run)
does anyone know what kind of obfuscator is used here? or is this hand crafted?
It's almost certainly hand crafted.
[deleted]
Good way to start the morning. Love me some loving code.
More horrible things you can do with javascript.
How romantic! <3 <3 <3
How much time did this take?
I don't even know you!.
Very cute.
a java script code for valentine for geeks are ok with valentine:)
That was pretty neat!
I love you too :-)
I love you more.
I love you too.
Aaaaaaaaaaaaw!
Awwww
Aliens.
hahah, awesome.
http://en.wikipedia.org/wiki/ILOVEYOU