Solving a JavaScript crackme: JS SAFE 2.0 (web) - Google CTF 2018

Solving a crackme implemented in JavaScript that attempts to obfuscate the algorithm through some anti-debugging.

-=[ ❤️ Support ]=-

-=[ 🐕 Social ]=-

-=[ 📄 P.S. ]=-

All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.

#CTF

[adityavallabh]

The confusion with the x's isn't cuz of the with statement. The parameter х (U+0445 or 1093) isn't the x from the English alphabet. It is a Cyrillic alphabet which only looks like it. And this input variable was never used in the code except for the last eval() which dynamically generated 'х==c(weird_string, h(х))' referring to our input х. THAT was the beauty of the challenge :P

[_JohnHammond]

Thanks so much for the shoutout, Live Overflow! Hopefully we can do more together sometime soon. :)

[LOEVI]

whenever i feel like im getting the hang of coding i just watch one of these videos so i realize i know nothing again

[Anonymous-vhkp]

I love watching these videos. I’m at a stage in life where I kind of understand what is going on, enough to comprehend the logic expressed, but not enough to be able to try this myself.

[THETHPHANTOM]

this some next level thinking and reasoning i am just not ready for. and its scary that there are so many people that can do this and i can barely comprehend it.

[ineedzsleep]

When C++ programmers look at Javascript code:
*wtf*
** googles some stuff **
*wtf intensifies*

[mxxone]

Wow, if you say you're a total noob I don't know what I am

[hopkinskong]

Btw, two "x" are in different encoding.
IDE saves the day :D

[benjaminbrady]

This felt like one of those de-obfuscation of pop-under videos. I loved those!

[stefanopersechino]

I feel incredibly stupid.
This is impressive..who created this is just a genius

[pavankumar]

mean while I'm coding hello world with some hacker music in the background .

[PaprikaX]

1:30 I don't think "JS" and "military grade" are compatible with each other

[soopyc]

You sir said you were a noob at this, then I should be an insect lol

[jankaltenecker]

I just want to thank you for not taking a jab at JS. This Video was really interesting. I was torn between trying it myself first and watching your solution but I'm glad to have watched your video instead.

[alex]

Same here, joined for a few hours and only solved the noob question :p The argument was not an x but a homograph of x as others also mentioned and that took me a bit to figure out. Also I didn't figure out exactly why the browser hanged but it was so annoying, yet I didn't want to spend time on that. I took the same approach for decryption but heard that there was another way based on low redundancy of the internal variables (a and b). I hope I find time and motivation to look into it soon.

[DeepakKumar-ymwr]

I don't know any programming language but love to watch this ;)

[KingJellyfishII]

*The with statement makes it hard for the interpreter to understand how to interpret it* (or something) lmao

[michaelz]

Basically to explain 'with' statement, you enter an object to it like:

with( <object> ) {
// CODE HERE
}


then, basically when you call anything, it first checks the block scope if the variable exists, then, the window. Else, it tries the properties of the object you put in. So in theory, this should work.


with (console) {
log("Hello.");
}

[marsanmarsipan]

Been lurking your chan for months. Started Beginners quest on this google-ctf now. Never done this before.. Thanks for hooking me up!

[userou-igze]

I simply love this channel. Hits just my level of programming skills