如果您注意到,在立即给
$
(
$
变成整数)分配一个值后,实际上代码中从未使用jQuery。
// ~ is bitwise not, so this set $ = -1
$ = ~ [];
以下代码创建了一个JavaScript对象。由于
![]
是
false
,所以
(![] + "")
将布尔值转换为字符串
"false"
。每个
[$]
都会在字符串
"false"
或其他返回值中的指定索引
$
处抓取一个字母。该代码将一系列整数和字母存储在一个对象中,然后将其赋值给
$
。
$ = {
___: ++$, // 0 since $ was -1
$$$$: (![] + "")[$], // "f"
__$: ++$, // 1
$_$_: (![] + "")[$], // "a"
_$_: ++$, // 2
$_$$: ({} + "")[$],
$$_$: ($[$] + "")[$], // "b"
_$$: ++$, // see the patter when ++$ is assigned?
$$$_: (!"" + "")[$], // see the pattern with the letters?
$__: ++$,
$_$: ++$,
$$__: ({} + "")[$],
$$_: ++$,
$$$: ++$,
$___: ++$,
$__$: ++$
};
以下的想法与上述类似。每个被加号分隔开的部分都返回一个基于返回值的字母,然后这些字母会组合成一个字符串。
// "constructor"
$.$_ = ($.$_ = $ + "")[$.$_$] + ($._$ = $.$_[$.__$]) + ($.$$ = ($.$ + "")[$.__$]) + ((!$) + "")[$._$$] + ($.__ = $.$_[$.$$_]) + ($.$ = (!"" + "")[$.__$]) + ($._ = (!"" + "")[$._$_]) + $.$_[$.$_$] + $.__ + $._$ + $.$;
下面的代码分配了
"return"
和
function Function() { [native code] }
。
$.$$ = $.$ + (!"" + "")[$._$$] + $.__ + $._ + $.$ + $.$$;
$.$ = ($.___)[$.$_][$.$_];
在最后几行中,
$.$$ + "\"" + $.$_$_ + (![] + "")[$._$_] + $.$$$_ + "\\" + $.__$ + $.$$_ + $._$_ + $.__ + "(\\\"\\" + $.__$ + $.__$ + $.___ + "\\" + $.__$ + $.$_$ + $.__$ + "!\\\");" + "\""`
等同于
"return"ale\162t(\"\110\151!\");""
当传递给
$.$()
时,它变成了一个函数。
function anonymous() { return "alert(\"Hi!\");"; }
然后是最终执行警告的语句。
$.$($.$($.$$ + "\"" + $.$_$_ + (![] + "")[$._$_] + $.$$$_ + "\\" + $.__$ + $.$$_ + $._$_ + $.__ + "(\\\"\\" + $.__$ + $.__$ + $.___ + "\\" + $.__$ + $.$_$ + $.__$ + "!\\\");" + "\"")())();
为了更易于理解整个概念,我提供了半去混淆代码。
obj = {
___: ++index, // = 0
$$$$: (![] + "")[index], // = "f" from 'f'alse
__$: ++index, // = 1
$_$_: (![] + "")[index], // = "a" from f'a'lse
_$_: ++index, // = 2
$_$$: ({} + "")[index], // = "b" from [o'b'ject Object]
$$_$: (index[index] + "")[index], // = "d" from un'd'efined
_$$: ++index, // = 3
$$$_: (!"" + "")[index], // = "e" from tru'e'
$__: ++index, // = 4
$_$: ++index, // = 5
$$__: ({} + "")[index], // = "c" from [obje'c't Object]
$$_: ++index, // = 6
$$$: ++index, // = 7
$___: ++index, // = 8
$__$: ++index // = 9
};
// obj.$_ = "c" + "o" + "n" + "s" + "t" + "r" + "u" + "c" + "t" + "o" + "r";
obj.$_ = (obj.$_ = obj + "")[obj.$_$] + (obj._$ = obj.$_[obj.__$]) + (obj.$$ = (obj.$ + "")[obj.__$]) + ((!obj) + "")[obj._$$] + (obj.__ = obj.$_[obj.$$_]) + (obj.$ = (!"" + "")[obj.__$]) + (obj._ = (!"" + "")[obj._$_]) + obj.$_[obj.$_$] + obj.__ + obj._$ + obj.$;
// obj.$$ = "r" + "e" + "t" + "u" + "r" + "n"
obj.$$ = obj.$ + (!"" + "")[obj._$$] + obj.__ + obj._ + obj.$ + obj.$$;
// obj.$ = function Function() { [native code] } <- a function constructor
obj.$ = (obj.___)[obj.$_][obj.$_];
// If you don't know what Function() is, read
// https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function to learn about Function()
// before continuing. It'll make more sense.
// body1 = "return"ale\162t(\"\110\151!\");"";
body1 = obj.$$ + "\"" + obj.$_$_ + (![] + "")[obj._$_] + obj.$$$_ + "\\" + obj.__$ + obj.$$_ + obj._$_ + obj.__ + "(\\\"\\" + obj.__$ + obj.__$ + obj.___ + "\\" + obj.__$ + obj.$_$ + obj.__$ + "!\\\");" + "\"";
// body2 = "alert("Hi!");" since \162 = "r", \"\110\151\!" = "Hi!"
body2 = obj.$(body1)();
// calls "alert("Hi!");"
obj.$(body2)();
// This works because the last argument to Function() becomes the
// body of that function.