Copy Code code as follows:
($=[$=[]][(__=!$+$)[_=-~-~-~$]+({}+$)[_/_]+
($$=($_=!'' +$)[_/_]+$_[+$])])()[__[_/_]+__
[_+~$]+$_[_]+$$](_/_)
Note that the seemingly confusing code above is not a line-wrapping, but a three-line (of course, you're not wrong to write on the same line). Write a page to run (it is said that IE is not good), you will find that the function of the code is equivalent to
Alert (1)
Why is that? Let's take this piece of code apart and analyze it.
$=[]//$ is assigned an empty array, so the value of!$ is false.
__ =!$ + $//Plus will convert!$ and $ to strings, so the value of __ becomes the string "false"
_ =-~-~-~$//Here is a ~ operator, which represents-($+1), so the-~$ value is 1. The value of _ is 3.
This can be inferred:
Copy Code code as follows:
(__ = !$ + $ ) [_ =-~-~-~$] => ("false") [_] => ("false") [3] => "false" [3] = "s"
({} + $) [_/_] => ([Object Object]] [_/_] => ("[Object]") [1] => "[Object Object]" [1] = "O"
Next, we'll disassemble $$= ($_=! " +$) [_/_]+$_[+$]:
$_=! " +$//Note,! "is a two single quote, that is, an empty string is not operational. So the variable $_ is assigned the string "true".
This can be pushed:
$$= ($_=! " +$) [_/_]+$_[+$] => $$ = ("true") [1] + "true" [0] => "R" + "T" = "RT"
So (__=!$+$) [_=-~-~-~$]+ ({}+$) [_/_]+ ($$= ($_=!) +$) [_/_]+$_[+$]) is "s" + "O" + "RT", i.e. "sort".
So the original expression
Copy Code code as follows:
($=[$=[]][(__=!$+$)[_=-~-~-~$]+({}+$)[_/_]+
($$=($_=!'' +$)[_/_]+$_[+$])])()[__[_/_]+__
[_+~$]+$_[_]+$$](_/_)
Can be replaced by:
Copy Code code as follows:
($=[[]]["Sort"]) ()[__[_/_]+__
[_+~$]+$_[_]+$$](_/_)
Next we look at what [__[_/_]+__[_+~$]+$_[_]+$$] (_/_) is.
As we have learned before:
__ = "false"
_ = 3
~$ =-1
$_ = "true"
$$ = "RT"
So [__[_/_]+__[_+~$]+$_[_]+$$] (_/_) => ["false" [1] + "false" [3-1] + "true" [3] + "RT"] (3/3) => ["a" + "L" + "E" + "RT "] (1) => [" Alert "] (1)
So the original expression can eventually be replaced by:
($=[[]]["Sort"]) () ["Alert"] (1)
How does this piece of code execute? Let's step through the analysis:
A = [[]]//Create an array
b = a["sort"]//Get the Sort method of an array
c = B ()//Call the Sort method of the array, where B () returns the Window object
D = c["alert"]//Get Window.alert method
D (1)//Call Window.alert method.
So the final result of the seven or eight expression of this mess is Window.alert (1).
For more, please see the original and Reddit discussion.
In the original comments, someone posted a gadget written by a Japanese developer who could encode a piece of JavaScript code into various emoticons and execute it, enjoy it.
BTW, the above code doesn't do much except for XSS attacks, but you can learn a little bit about data type conversions from parsing this code, and you can also enjoy the flexibility of JavaScript.
Detailed Code resolution:
Copy Code code as follows:
(
$=[$=[]] // $ = []
[
(__=!$ + $)//__ = "false"
[_=-~-~-~$]//_ = 3
(__) [3] = "s"
+
({} + $)//({} + $) = [Object Object]
[_/_]//_/_ = 1
+//([Object Object]) [1] = "O"
($$ = //
($_=!'' + $) // !'' + $ = "true"; $_ = "true"
[_/_]//_/_ = 1;
$_[1] = "R"
+
$_[+$]//+$ = 0; $_[0] = "T"
)//$$= "RT"
]//["Sort"]
[[' sort '] = [].sort = function sort () {[native code]}
$ = [[] [' sort ']
) ()//($) () = [Object Window]
[
__[_/_]//__ = "false";
__[1] = "a"
+
__ [_+~$]//_ = 3; ~$ =-1; _ + ~$ = 2
__[2] = "L"
+
$_[_]//$_ = "true"; _ = 3;
$_[3] = "E"
+
$$//$$ = "RT"
](_/_); _/_ = 1
window["Alert"] (1)
Here are a few things to note:
1. JavaScript inside $, _ can be used as variable name
2. Functions can also be called: for example [1,2,4,1,9,1].sort () can be written [1,2,4,1,9,1]["Sort"] ();
3. ~ to the number by position counter
4. Rules for using + time in JavaScript for different types of variables
5. The last method written for some native code, execution returns a Window object, such as
var s = [].sort; T=s (); Then T is window
