Comment by paulirish | Hacker News Reader

Comment by paulirish | Hacker News Reader

There are a couple DevTools features that make this kind of reverse-engineering much easier.

Oftentimes, the obfuscation relies on turning strings into functions. You can watch all this happen with:

`monitor(eval); monitor(Function)`

That'll log out the arguments passed to eval and the Function constructor. https://imgur.com/hMbKQZA You can also use `debug()` to breakpoint on invocation. (Yes, this works with native fns as well as user-land fns)

Then, comparing memory snapshots can help illuminate the work that happened. Take a snapshot of about:blank, then another after evaluating the ips.js payload. Select comparison. Then look through the results, especially (string). This appears to be the same "VM's strings" called out in the post: https://imgur.com/2v58VM5

Can also see heavy use of WebGL and wasm based on allocations.

Hey! My friend linked me this comment. This is super dope, I used to RE more dynamically and knowing about monitor() and debug() would have helped me a lot haha.

Also the memory snapshots, I've used that to try to debug memory leaks in the past but never thought about using it to RE. Super cool that you can also get the string that way.

You can definitely get the same results a lot faster via dynamic RE for most obfuscation methods, but what attracted me to Kasada was the challenge of writing a disassembler from a static RE perspective. I also don't think dynamic RE methods are super easy to apply here once you get into the VM logic though, as I've discovered while working on part 2.

If you want to chat with me about this more my socials are linked in the post, or you can message me on discord (umasi#3301) :)

Most advanced javascript developers don't know about these features, so no worries at all. :)

(We're chatting now)

Out of curiosity are monitor and debug (or equivalents) available on non-Chromium browsers?

As far as I know, nope. This set of methods used to be called the "command line api" but now its got a few names:

https://developer.chrome.com/docs/devtools/console/utilities... https://firefox-source-docs.mozilla.org/devtools-user/web_co... https://developer.apple.com/library/archive/documentation/Ap...

The most commonly used are copy(), $(), and $0.

Love these suggestions. Definitely makes dynamic analysis heaps easier. A lot of our blog posts tend to focus on static analysis but it may be worth mentioning these techniques going forward.

Reply on news.ycombinator.com