←back to thread

Reverse engineering the obfuscated TikTok VM

(github.com)
412 points xfeeefeee | 9 comments | 21 Apr 25 01:59 UTC | HN request time: 1.042s | source | bottom
Show context
kleiba ◴[21 Apr 25 07:38 UTC] No.43749288[source]▶
I've been using a shitty streaming website whose player interrupts the playback of a video in irregular intervals and presents a cryptic error message. I've started looking into the JavaScript code to see if I can't code up a work-around mechanism (basically debugging their garbage implementation), and of course (why actually?) their player code is also obfuscated.

And I've gotta say, emplying an AI assistant has proven to be an invaluable help in trying to understand obfuscated code. It's actually really cool to take a function of gobbledegook JavaScript and ask the AI to rewrite it in a more canonical and easily understandable way, with inline comments. Of course, there are flaws every now and then, but the ability to do this has been such a game changer for reverse engineering, IMO.

I can even ask to take a guess at finding better variable/function names and the AI can infer from the code (maybe has seen the unobfuscated libraries during training?) what this code is actually doing on a high-level and turn something like e.g(e.g) into player.initialize(player.state) which is nothing short of amazing.

So for anyone doing similar work, I cannot recommend highly enough to have an AI agent as another tool in your tool belt.

replies(4): >>43749332 #>>43750153 #>>43750771 #>>43758666 #
lukan ◴[21 Apr 25 07:46 UTC] No.43749332[source]▶
Which AI agents did you use?
replies(1): >>43749368 #
1. kleiba ◴[21 Apr 25 07:51 UTC] No.43749368[source]▶
I've tried different ones, they all seem to do a great job.
replies(4): >>43749490 #>>43749664 #>>43752083 #>>43757415 #
2. klabetron ◴[21 Apr 25 08:15 UTC] No.43749490[source]▶
Out of curiosity (as someone disappointingly new to prompt engineering), what’s an example prompt you used with some success?
replies(3): >>43750158 #>>43750239 #>>43753794 #
3. sureIy ◴[21 Apr 25 08:45 UTC] No.43749664[source]▶
Could you name a couple?
4. esseph ◴[21 Apr 25 10:04 UTC] No.43750158[source]▶
Ask questions. Be disappointed in the outcomes.

Ask more questions. Get some right answers. Repeat.

Make question asking muscle get swole.

5. nurettin ◴[21 Apr 25 10:20 UTC] No.43750239[source]▶
Actually knowing the subject and presenting insights gives me much better results than simply asking it to do what I mean.
6. ImPostingOnHN ◴[21 Apr 25 13:58 UTC] No.43752083[source]▶
next up is using AI to obfuscate it better in the first place, and then the terrible code gets scraped and used in further training, with an arms race ensuing, until all code on the internet is unintelligible but somehow works and can only be maintained by a specific AI that has a particularly encoded form of insanity
7. Loughla ◴[21 Apr 25 16:31 UTC] No.43753794[source]▶
For help with prompt engineering, take a graduate level grant writing course. It teaches you how to ask the right questions to get answers from humans and how to break down complicated processes into bite size pieces; really useable for llm's.
replies(1): >>43755274 #
8. specialist ◴[21 Apr 25 19:00 UTC] No.43755274{3}[source]▶
Heh. Probably also useful should a djinn ever grant you three wishes.
9. titaphraz ◴[21 Apr 25 22:57 UTC] No.43757415[source]▶
> they all seem to do a great job

Yeah right.