Diminutive NoAlNum JS Contest

Posted by: holiman

Date: June 09, 2009 04:05AM

Another stab at the discontinued (?) non-alnum alert(1) contest from http://sla.ckers.org/forum/read.php?2,15812,page=16 . Got it down to 86!

(Å=[],[Ç=!!Å+Å,µ=!Å+{}][µ[ª=Ç[++Å]+Ç[+!Å],È=Å+Å+Å]+µ[È+È]+ª])()[µ[Å]+µ[Å+Å]+Ç[È]+ª](Å)

Diminutive NoAlphanumeric JS Contest!

This is a contest that aims to make the smallest JavaScript with no alphanumeric chars that could execute: alert(1) on latest firefox.

The winner is LeverOne.. (for now..)

Contest Record:

Quote

Yosuke HASEGAWA, 472 bytes {first one, original idea}
_=[]|[];$=_++;__=(_<<_);___=(_<<_)+_;____=__+__;_____=__+___;$$=({}+"")[_____]+({}+"")[_]+({}[$]+"")[_]+(($!=$)+"")[___]+(($==$)+"")[$]+(($==$)+"")[_]+(($==$)+"")[__]+({}+"")[_____]+(($==$)+"")[$]+({}+"")[_]+(($==$)+"")[_];$$$=(($!=$)+"")[_]+(($!=$)+"")[__]+(($==$)+"")[___]+(($==$)+"")[_]+(($==$)+"")[$];$_$=({}+"")[_____]+({}+"")[_]+({}+"")[_]+(($!=$)+"")[__]+({}+"")[__+_____]+({}+"")[_____]+({}+"")[_]+({}[$]+"")[__]+(($==$)+"")[___]; ($)[$$][$$]($$$+"('"+$_$+"')")()

Andrea Giammarchi, 224 bytes cross browser
$=''|'',_=$+!"",__=_+_,___=__+_,($)[_$=($$=(_$=""+{})[__+__+_])+_$[_]+(""+_$[-__])[_]+(""+!_)[___]+($_=(_$=""+!$)[$])+_$[_]+_$[__]+$$+$_+(""+{})[_]+_$[_]][_$]((_$=""+!_)[_]+_$[__]+_$[__+__]+(_$=""+!$)[_]+_$[$]+"("+_+")")();

Gareth Heyes, 170 bytes
$=[][(!~''+'')[(+!'')+(+!'')+(+!'')]+({}+'')[+!'']+($$=(!+''+'')[+!''])+(_=(!''+'')[+''])],$()[(!!''+'')[+!'']+(!!''+'')[+!''+!'']+(!!''+'')[+!''+!''+!''+!'']+$$+_](+!'')

Matt Presson, 150 bytes
$=[];$=[][(!$+'')[-~-~-~[]]+({}+'')[+!'']+ ($$=(!''+'')[+!'']) + (_=(!+''+'')[+''])],$(),[(!$+'')[+!'']+(!$+'')[-~-~[]]+(!''+'')[-~-~-~[]]+$$+_](+!'')

Gareth Heyes, 137 bytes
$=[];$=[][(!$+'')[-~-~-~$]+({}+$)[+!'']+($$=(!''+$)[+!''])+(_=(!+$+$)[+$])],$()[(!$+$)[+!'']+(!$+'')[-~-~$]+(!''+'')[-~-~-~$]+$$+_](+!'')

Gareth Heyes, 136 bytes
$=[$=[]][(!$+'')[-~-~-~$]+({}+$)[+!'']+($$=(!''+$)[+!''])+(_=(!+$+$)[+$])],$()[(!$+$)[+!'']+(!$+'')[-~-~$]+(!''+'')[-~-~-~$]+$$+_](+!'')

Matt Presson, 135 bytes
$=[$=[]][(!$+$)[-~-~-~$]+({}+$)[+!'']+($$=(!''+$)[+!''])+(_=(!+$+$)[+$])],$()[(!$+$)[+!'']+(!$+$)[-~-~$]+(!''+'')[-~-~-~$]+$$+_](+!'')

sirdarckcat, 114 bytes
$=[$=[]][(__=!$+$)[_=-~-~-~$]+({}+$)[_/_]+($$=($_=!''+$)[_/_]+($_)[+$])],$()[(__)[_/_]+(__)[_+~$]+($_)[_]+$$](_/_)

.mario, 106 bytes
($=[$=[]][(__=!$+$)[_=-~-~-~$]+({}+$)[_/_]+($$=($_=!''+$)[_/_]+$_[+$])])()[__[_/_]+__[_+~$]+$_[_]+$$](_/_)

Gareth Heyes, 101 bytes
($=[$=[]][(µ=!$+$)[_=-~-~-~$]+({}+$)[_/_]+(ª=($_=!''+$)[_/_]+$_[+$])])()[µ[_/_]+µ[_+~$]+$_[_]+ª](_/_)

.mario, 101 bytes no quotes works in firebug
(µ=[µ=[]][(ø=!µ+µ)[ª=-~-~-~µ]+({}+µ)[ª/ª]+(æ=(µª=!!ª+µ)[ª/ª]+µª[+µ])])()[ø[ª/ª]+ø[ª+~µ]+µª[ª]+æ](ª/ª)

Gareth Heyes, 94 bytes
($=[$=[]][(µ=!$+$)[_=-~-~-~$]+({}+$)[Å=_/_]+(ª=(Ç=!''+$)[Å]+Ç[+$])])()[µ[Å]+µ[_+~$]+Ç[_]+ª](Å)

sirdarckcat, 94 bytes, bypasses /\w/ filter
(É=[É=[]][(µ=!É+É)[È=-~-~-~É]+({}+É)[Å=È/È]+(ª=(Ç=!!È+É)[Å]+Ç[+É])])()[µ[Å]+µ[È+~É]+Ç[È]+ª](Å)

Gareth Heyes, 93 bytes
($=[$=[]][(µ=!$+$)[_=-~-~-~$]+({}+$)[Å=_/_]+(º=(Ç=!''+$)[Å]+Ç[+$])])()[µ[Å]+µ[Å+Å]+Ç[_]+º](Å)

sirdarckcat, 91 bytes
(É=[Å=É=[]][(µ=!É+É)[È=++Å+Å+Å]+({}+É)[Å]+(ª=(Ç=!!È+É)[Å]+Ç[+É])])()[µ[Å]+µ[Å+Å]+Ç[È]+ª](Å)

sirdarckcat, 90 bytes
(É=[Å=[],µ=!Å+Å][µ[È=-~-~++Å]+({}+Å)[Ç=!!Å+µ,ª=Ç[Å]+Ç[+!Å],Å]+ª])()[µ[Å]+µ[Å+Å]+Ç[È]+ª](Å)

Gareth Heyes, 88 bytes
(Å=[],[µ=!Å+Å][µ[È=++Å+Å+Å]+({}+Å)[Ç=!!Å+µ,ª=Ç[Å]+Ç[+!Å],Å]+ª])()[µ[Å]+µ[Å+Å]+Ç[È]+ª](Å)

holiman, 86 bytes
(Å=[],[Ç=!!Å+Å,µ=!Å+{}][µ[ª=Ç[++Å]+Ç[+!Å],È=Å+Å+Å]+µ[È+È]+ª])()[µ[Å]+µ[Å+Å]+Ç[È]+ª](Å)

sirdarckcat, 85 bytes
(Å=[],[Ç=!!Å+Å,µ=!Å+{}][µ[ª=Ç[++Å]+Ç[+!Å],È=Å-~Å]+µ[È+È]+ª])()[µ[Å]+µ[Å+Å]+Ç[È]+ª](Å)

.mario, 84 bytes
(Å='',[Ç=!(µ=!Å+Å)+{}][Ç[ª=µ[++Å]+µ[Å-Å],È=Å-~Å]+Ç[È+È]+ª])()[Ç[Å]+Ç[Å+Å]+µ[È]+ª](Å)

Sergio Maffeis, 66 bytes
($=!'',[[Ç,µ,,É,,Á,È,ª,,,Ó]=''+$+!$+{}][ª+Ó+µ+Ç])()[Á+È+É+µ+Ç](+$)

sirdarckcat, 65 bytes
($=!'',[[Ç,µ,,É,,Á,È,ª,,,Ó]=[$]+!$+{}][ª+Ó+µ+Ç])()[Á+È+É+µ+Ç](+$)

barbarianbob 64 bytes
([Ç,µ,,É,,Á,È,ª,,,Ó]=[$=!'']+!$+{},[][ª+Ó+µ+Ç])()[Á+È+É+µ+Ç](+$)

LeverOne 63 bytes
([,Á,È,ª,É,,Ó]=!{}+{},[[Ç,µ]=!!Á+Á][ª+Ó+µ+Ç])()[Á+È+É+µ+Ç](-~Á)

Edited 13 time(s). Last edit at 02/02/2010 01:38AM by sirdarckcat.

Options: Reply•Quote

Re: No alnums

Posted by: Gareth Heyes

Date: June 09, 2009 09:28AM

Nice! I give up haha :)

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Options: Reply•Quote

Re: No alnums

Posted by: holiman

Date: June 10, 2009 06:01AM

Sweet, I won!
Seriously though, you guys did all the cool work (Gareth, sdc, mario, presson and Hasegawa)! I urge anyone to look into how it works, it was a real learning experience for me. The actual javascript executed is :
([],"sort")()["alert"](1)
Where "sort" and "alert" are generated from "true", "false" and "[object Object]".

Gareth pointed out that ([],"sort") === window, which is pretty interesting. How did you discover that ? Any idea why that is so?

Edited 1 time(s). Last edit at 06/10/2009 06:17AM by holiman.

Options: Reply•Quote

Re: No alnums

Posted by: Gareth Heyes

Date: June 10, 2009 06:35AM

@holiman

Jeff Walden inspired the find. He showed how windows are leaked on Firefox when passing null arguments to native function. I found that sort leaked also when passing nothing as a argument. The trick to getting the window object like x=[].sort,x() without the assignment like so (1,[].sort)() was found while I was using Hackvertor to come up with a shorter version.

Who says you won? :) I think sdc said he had one to 85. So maybe you'll be beaten yet sniper :P

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Options: Reply•Quote

Re: No alnums

Posted by: holiman

Date: June 10, 2009 06:52AM

True, it's not over yet...

Options: Reply•Quote

Re: No alnums

Posted by: sirdarckcat

Date: June 10, 2009 10:54AM

sorry for the delay, but the FW/FW-OP banned my ip by mistake.. (or maybe it was a plot to avoid me posting this.. haha)

(Å=[],[Ç=!!Å+Å,µ=!Å+{}][µ[ª=Ç[++Å]+Ç[+!Å],È=Å-~Å]+µ[È+È]+ª])()[µ[Å]+µ[Å+Å]+Ç[È]+ª](Å)

85

Greetz!!

--------------------------------
http://sirdarckcat.blogspot.com/ http://www.sirdarckcat.net/ http://foro.elhacker.net/ http://twitter.com/sirdarckcat

Edited 1 time(s). Last edit at 06/10/2009 11:01AM by sirdarckcat.

Options: Reply•Quote

Re: No alnums

Posted by: sirdarckcat

Date: June 10, 2009 11:24AM

just for the purpose of learning which optimisations were made, I've recolected the steps the code was minified.

this of course is work of everyone together.. teamwork rocks :D

Quote

I moved the record to the first post

We have managed to reduce to less than half (84) of the original payload (170). =D

Greetz!!

--------------------------------
http://sirdarckcat.blogspot.com/ http://www.sirdarckcat.net/ http://foro.elhacker.net/ http://twitter.com/sirdarckcat

Edited 5 time(s). Last edit at 06/10/2009 09:28PM by sirdarckcat.

Options: Reply•Quote

Re: No alnums

Posted by: Anonymous User

Date: June 10, 2009 12:28PM

(Å='',[Ç=!(µ=!Å+Å)+{}][Ç[ª=µ[++Å]+µ[Å-Å],È=Å-~Å]+Ç[È+È]+ª])()[Ç[Å]+Ç[Å+Å]+µ[È]+ª](Å)

84

Edited 1 time(s). Last edit at 06/10/2009 12:30PM by .mario.

Options: Reply•Quote

Re: No alnums

Posted by: sirdarckcat

Date: June 10, 2009 10:06PM

I hereby declare I have lost this contest haha..

Sweet trick .mario!!

--------------------------------
http://sirdarckcat.blogspot.com/ http://www.sirdarckcat.net/ http://foro.elhacker.net/ http://twitter.com/sirdarckcat

Options: Reply•Quote

Re: No alnums

Posted by: Matt Presson

Date: June 11, 2009 12:16PM

I also admit defeat.

-Matt

Options: Reply•Quote

Re: No alnums

Posted by: rvdh

Date: June 11, 2009 12:55PM

82.

(Å='',[Ç=!(µ=!Å+Å)+{}][Ç[µ[++Å]+µ[Å-Å],È=Å-~Å]+Ç[È+È]+ª])()[Ç[Å]+Ç[Å+Å]+µ[È]+ª](Å)

edit: rats, i got it down to 82 but copy/pasted the wrong vector. I'll try to ding back what I did. discard this one.

edit: wow that was retarded, got it working did a length check and it pasted a vector I was toying with before :S fuck!

Edited 3 time(s). Last edit at 06/12/2009 06:23AM by .mario.

Options: Reply•Quote

Re: No alnums

Posted by: holiman

Date: June 12, 2009 03:24AM

I give up. Well done all!

Options: Reply•Quote

Re: No alnums

Posted by: Gareth Heyes

Date: June 12, 2009 03:37AM

Yeah great contest :) I think we all learned a lot. Lets have more! rsnake c'mon contests please

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Options: Reply•Quote

Re: No alnums

Posted by: rvdh

Date: June 12, 2009 05:31PM

Ok, how about creating a self propagating vector (read: worm) with a source as payload. Mixing u the contest from a year ago (or was it two...) with this one, but it has to work in most browsers, so not only in Firebug.

Hah, thatall'keepya busy!

Options: Reply•Quote

Re: No alnums

Posted by: holiman

Date: June 14, 2009 02:22PM

@rvdh
hmm... meh... something less done:ish...?

I have been thinking of putting together a list of strings available in this fashion we have used them. This is what I come up with, and their shortest* non-alnum declaration:

!''/''+'' //Infinity 9
+{}+'' //NaN 6
!''+'' //true 6
![]+'' //false 6
''+{} //[object Object] 5
''[+'']+'' //undefined 10 omg

*shortest: work in progress, contribute please

These also exist, but cannot be accessed as easily "string", "array". You need something like "typeof", and then you may aswell use other ways of producing letters.

Using the ones above, the following letters can be created :
a,b,c,d,e,f,i,j,l,n,o,r,s,t,u,y

but not these:
g,h k,m,p,q,v,w,x,z

So, what have I missed?

Edited 8 time(s). Last edit at 06/15/2009 01:31AM by holiman.

Options: Reply•Quote

Re: No alnums

Posted by: holiman

Date: June 14, 2009 03:27PM

@.mario: Great, I'll just go ahead and paste yours into my original post..

Edited 1 time(s). Last edit at 06/14/2009 03:29PM by holiman.

Options: Reply•Quote

Re: No alnums

Posted by: Anonymous User

Date: June 14, 2009 03:37PM

Should type always be string? If yes we might want ad +'' to most of them.

Maybe we can add some numbers

+'' //0
+!'' //1
-~!'' //2
~'' //-1
~!'' //-2

Edited 2 time(s). Last edit at 06/14/2009 03:46PM by .mario.

Options: Reply•Quote

Re: No alnums

Posted by: sirdarckcat

Date: June 15, 2009 12:41AM

[].$+'' //smaller undefined 7

You should know that lowercase/uppercase does matter in this case.

So, we have:
a,b,c,d,e,f,i,j,l,n,o,r,s,t,u,y,O,N,I

about the rest of the letters:
g,h,k,p,q,v,x,z

We also miss:
m,w

And almost all uppercase (I know .toUpperCase, but in that case we would miss the p, U, and C).

So for that reason we used "constructor.constructor" on the automatic-sourcecode generation algorithms.. Since not all chars are available.

Anyway, I'm thinking that maybe we can get them with a hack =D

This is only going to work on FF..

probably the char we need the most is the "v" (for eval), so:

Supposing this is the shortest way to get "window":

$=(Å='',[Ç=!(µ=!Å+Å)+{}][Ç[È=++Å-~Å]+Ç[È+È]+µ[Å]+µ[Å-Å]])()

we fetch btoa("\xBE"): // for example, this is true for all chars we want

_=$[Ç[È+È+Å]+µ[Å-Å]+Ç[È+È]+Ç[Å]]("¾")

and we have "v" on _[+[]]

About the numbers:

When working on the source code generator, I concluded that the shortest way of making numbers (with the least chars possible) is the following:

We need 4 variables:
$$=-~!'',$=-~$$,$$$$=$$<<$$,$$$=$$$$+~[];

["($-$)","$/$","$$","$","$$*$$","($$+$)","$*$$","$$$","$$$$","$*$"]

Anyway, at that time I was on a policy of just using $ and no _ nor weird chars (>\x7F), so probably there's a better way.

The way I use to measured the smallest 0-9 char sequence was by comparing the length of a count 0-9 like this:

["($-$)","$/$","$$","$","$$*$$","($$+$)","$*$$","$$$","$$$$","$*$"]

So, the conclusion was:
Being $=3,$$=2,$$$=7,$$$$=8, we can make all numbers from 0-9 with
["($-$)","$/$","$$","$","$$*$$","($$+$)","$*$$","$$$","$$$$","$*$"]

(the parenthesis are needed in + and - because if we want to make 50 for example, we need:
''+($$+$)+($-$)

($-$) is prefered over +[] because +[] also needs parenthesis in the general case (for example: ''++[] makes no sense, and you cannot erase the "+" because then [] is an empty string..)

anyway, that's all I know about no-alnums, now that you know.. go to hack some filters heh :P

--------------------------------
http://sirdarckcat.blogspot.com/ http://www.sirdarckcat.net/ http://foro.elhacker.net/ http://twitter.com/sirdarckcat

Edited 1 time(s). Last edit at 06/15/2009 12:55AM by sirdarckcat.

Options: Reply•Quote

Re: No alnums

Posted by: hoshikuzu

Date: June 17, 2009 11:20PM

how about this?
!_+[] //false (5)
...Sorry, only tested on FF(ver 1.5.0.8).

===

I am thinking about this type, when $$$$$$$$$$='constructor',

(/_/)[$$$$$$$$] + ''

this code retruns ,

[string object]
function RegExp() {
[native code]
}
[/string object]

Then, we can get nati[*v*]e , Re[*g*]E[*x*][*p*]...can we?
Sorry, tested on Firefox (1.5.0.8). ;p

IMHO, e[*v*]al, esca[*p*]e and unesca[*p*]e will be allowed....I think.

Edited 1 time(s). Last edit at 06/17/2009 11:21PM by hoshikuzu.

Options: Reply•Quote

Re: Diminutive NoAlNum JS Contest

Posted by: holiman

Date: June 18, 2009 12:38AM

@hoshikuzu:
I don't know what you have in your DOM, but !_+[] gives me errors that _ is not defined (FF 3.0.10).
The Regexp-trick is nice!
Still you need to create "constructor"-string though, so it is not as quick as the other tricks - and as sirdarckcat mentions, there are other ways of getting any character we want, if we dont mind writing a bit more code...But I like it!

Edited 1 time(s). Last edit at 06/18/2009 01:29AM by holiman.

Options: Reply•Quote

Re: Diminutive NoAlNum JS Contest

Posted by: Gareth Heyes

Date: June 18, 2009 04:40AM

I'm sure we could do something with this too:-

'$$$$'[~''] // == 4 :)

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Options: Reply•Quote

Re: Diminutive NoAlNum JS Contest

Posted by: sirdarckcat

Date: June 18, 2009 05:19AM

ya, well..
~[]>>>+!''// == 2147483647

haha, why not

--------------------------------
http://sirdarckcat.blogspot.com/ http://www.sirdarckcat.net/ http://foro.elhacker.net/ http://twitter.com/sirdarckcat

Options: Reply•Quote

Re: Diminutive NoAlNum JS Contest

Posted by: Gareth Heyes

Date: June 18, 2009 05:24AM

Yeah but the length of a string is -1 this is useful ;)

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Options: Reply•Quote

Re: No alnums

Posted by: hoshikuzu

Date: July 08, 2009 10:08PM

@holiman:

Thank you for your help. ;)
I am wrong, sorry.

===

@sirdarckcat:
// without shift of bits;; nor * ;; nor + ;;

~[]/(~[]%(~[]/~-~-~[])) === 18014398509481984 // (23)

Options: Reply•Quote

Re: Diminutive NoAlNum JS Contest

Posted by: Sergio Maffeis

Date: August 28, 2009 05:42AM

(τ=!'',[[Ṫ,Ŕ,,É,,Á,Ĺ,Ś,,,Ó]=''+τ+!τ+{}][Ś+Ó+Ŕ+Ṫ])()[Á+Ĺ+É+Ŕ+Ṫ](+τ)

66

http://jssec.net/semantics

Options: Reply•Quote

Re: Diminutive NoAlNum JS Contest

Posted by: Gareth Heyes

Date: August 28, 2009 05:45AM

@Sergio Maffeis

haha welcome to the crazy club! :)
Nice stuff

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Options: Reply•Quote

Re: Diminutive NoAlNum JS Contest

Posted by: Sergio Maffeis

Date: August 28, 2009 05:49AM

Sergio Maffeis Wrote:
-------------------------------------------------------
> (τ=!'',[[Ṫ,Ŕ,,É,,Á,Ĺ,Ś,,
> ,Ó]=''+τ+!τ+{}][Ś+Ó+Ŕ+Ṫ]
> )()[Á+Ĺ+É+Ŕ+Ṫ](+τ)
>
> 66
>
> http://jssec.net/semantics

($=!'',[[Ç,µ,,É,,Á,È,ª,,,Ó]=''+$+!$+{}][ª+Ó+µ+Ç])()[Á+È+É+µ+Ç](+$)

does it display correctly now?

Options: Reply•Quote

Re: Diminutive NoAlNum JS Contest

Posted by: Gareth Heyes

Date: August 28, 2009 05:58AM

@Sergio Maffeis

Yeah that works, sla.ckers doesn't use UTF-8 for some reason

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

Options: Reply•Quote

Re: Diminutive NoAlNum JS Contest

Posted by: sirdarckcat

Date: August 31, 2009 09:25AM

65
($=!'',[[Ç,µ,,É,,Á,È,ª,,,Ó]=[$]+!$+{}][ª+Ó+µ+Ç])()[Á+È+É+µ+Ç](+$)

woot

--------------------------------
http://sirdarckcat.blogspot.com/ http://www.sirdarckcat.net/ http://foro.elhacker.net/ http://twitter.com/sirdarckcat

Options: Reply•Quote

Re: Diminutive NoAlNum JS Contest

Posted by: barbarianbob

Date: August 31, 2009 12:15PM

Cheap var reordering:

([Ç,µ,,É,,Á,È,ª,,,Ó]=[$=!'']+!$+{},[][ª+Ó+µ+Ç])()[Á+È+É+µ+Ç](+$)

64

Options: Reply•Quote