TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Reverse engineering the obfuscated TikTok VM

412 点作者 xfeeefeee23 天前

17 条评论

kleiba23 天前
I&#x27;ve been using a shitty streaming website whose player interrupts the playback of a video in irregular intervals and presents a cryptic error message. I&#x27;ve started looking into the JavaScript code to see if I can&#x27;t code up a work-around mechanism (basically debugging their garbage implementation), and of course (why actually?) their player code is also obfuscated.<p>And I&#x27;ve gotta say, emplying an AI assistant has proven to be an invaluable help in trying to understand obfuscated code. It&#x27;s actually really cool to take a function of gobbledegook JavaScript and ask the AI to rewrite it in a more canonical and easily understandable way, with inline comments. Of course, there are flaws every now and then, but the ability to do this has been such a game changer for reverse engineering, IMO.<p>I can even ask to take a guess at finding better variable&#x2F;function names and the AI can infer from the code (maybe has seen the unobfuscated libraries during training?) what this code is actually doing on a high-level and turn something like e.g(e.g) into player.initialize(player.state) which is nothing short of amazing.<p>So for anyone doing similar work, I cannot recommend highly enough to have an AI agent as another tool in your tool belt.
评论 #43750771 未加载
评论 #43750153 未加载
评论 #43758666 未加载
评论 #43749332 未加载
SoKamil23 天前
&gt; As this is a Javascript file executed on the web, it is actually possible to replace the normal webmssdk.js with the deobfuscated file and use TikTok normally.<p>&gt; This can be achieved by using two browser extensions known as Tampermonkey for executing custom code and CSP to disable CSP so I can fetch files from blocked origins. This is so I can put latestDeobf.js in my own file server and have it be fetched each time, this is so I can easily edit the file and let the changes take effect each time I refresh. This makes it much easier to bebug when reversing functions.<p>I believe you can achieve the same effect without any 3rd party extensions. You can use Local Overrides in Chrome DevTools.<p>Great work!
评论 #43751595 未加载
godelski23 天前
This seems like quite a lot of work to hide the code. What would the legitimate reasons for this be? Because it looks like it would make the program less optimized and more complexity just leads to more errors.<p>I understand the desire to make it harder for bots, but 1) it doesn&#x27;t seem to be effective and bots seem to be going a very different route 2) there&#x27;s got to be better ways that are more effective. It&#x27;s not like you&#x27;re going to stop clones through this because clones can replicate by just seeing how things work and reverse engineer blackbox style.
评论 #43748712 未加载
评论 #43748681 未加载
评论 #43749282 未加载
评论 #43748741 未加载
评论 #43750130 未加载
评论 #43749167 未加载
评论 #43752385 未加载
评论 #43748839 未加载
davidsojevic23 天前
Very impressive work! I always enjoy a good write up about reverse engineering efforts and yours was really simple to follow.<p>Many popular&#x2F;large websites and bot protection services usually have environment checking as a baseline and mouse-movement tracking in some of the more aggressive anti-bot checks.<p>It&#x27;s always interesting to see how long it takes from when the measures have been defeated&#x2F;publicised until the service ends up making changes to their mechanism to make you start over (hopefully not from scratch).
评论 #43752388 未加载
mrkramer23 天前
In my bookmarks I found this RE examples as well: <a href="https:&#x2F;&#x2F;www.nullpt.rs&#x2F;reverse-engineering-tiktok-vm-1" rel="nofollow">https:&#x2F;&#x2F;www.nullpt.rs&#x2F;reverse-engineering-tiktok-vm-1</a><p><a href="https:&#x2F;&#x2F;ibiyemiabiodun.com&#x2F;projects&#x2F;reversing-tiktok-pt2&#x2F;" rel="nofollow">https:&#x2F;&#x2F;ibiyemiabiodun.com&#x2F;projects&#x2F;reversing-tiktok-pt2&#x2F;</a>
ronsor23 天前
There is no legitimate reason for a social media platform to employ this much obfuscation.
评论 #43749815 未加载
评论 #43748917 未加载
评论 #43749090 未加载
评论 #43748995 未加载
评论 #43748881 未加载
评论 #43749354 未加载
Wowfunhappy23 天前
...can I ask a really stupid question? What is a VM in this context?<p>I&#x27;ve used VM&#x27;s for years to run Windows on top of macOS or Linux on top of Windows or macOS on top of macOS when I need an isolated testing environment. I also know that Java works via the &quot;Javascript Virtual Machine&quot; which I&#x27;ve always thought of as &quot;Java code actually runs in its own lightweight operating system on top of the host OS, which makes it OS-agnostic&quot;. The JVM can&#x27;t run on bare metal because it doesn&#x27;t have hardware drivers, but presumably it <i>could</i> if you wrote those drivers.<p>But presumably the VM being discussed in TFA isn&#x27;t that kind of VM, right? Bytedance didn&#x27;t write an operating system in Javascript?<p>I&#x27;ve been seeing &quot;VM&quot; used in lots of contexts like this recently and it makes me think I must be missing something, but it&#x27;s the sort of question I don&#x27;t know how to Google. AIs have not been helpful either, plus I don&#x27;t trust them.
评论 #43753422 未加载
评论 #43750454 未加载
评论 #43753234 未加载
评论 #43754561 未加载
评论 #43754128 未加载
评论 #43750437 未加载
heinternets23 天前
Is TikTok so obfuscated to prevent people from knowing the full extent of data collection and device fingerprinting?
评论 #43751909 未加载
RexM23 天前
Is this VM somehow related to Lynx (their cross platform dev tooling?)<p><a href="https:&#x2F;&#x2F;lynxjs.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lynxjs.org&#x2F;</a><p>Also discussed on HN<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=43264957">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=43264957</a>
0xDEADFED523 天前
this is cool. i briefly worked on a TikTok bot a while back and it was a huge pain in the ass.
weinzierl23 天前
Is there also a VM in their iOS app? I thought a VM would be against Apple&#x27;s policies?
评论 #43749454 未加载
评论 #43750264 未加载
lazyeye23 天前
An oldie but a goodie. A guide to manipulating online comments to hide&#x2F;dilute&#x2F;obsfucate undesirable commentary....<p><a href="https:&#x2F;&#x2F;cryptome.org&#x2F;2012&#x2F;07&#x2F;gent-forum-spies.htm" rel="nofollow">https:&#x2F;&#x2F;cryptome.org&#x2F;2012&#x2F;07&#x2F;gent-forum-spies.htm</a>
sylware23 天前
What&#x27;s terrible are the humans writing such software...<p>But if AI can help to fight those people&#x27;s work, good for humanity I guess.<p>That said... Is AI going to de-obfuscate&#x2F;reverse engineer their obsfuscated AI prompts or web apps?
domfie23 天前
Looks like a lot of work. I recently discovered webcrack and the tool jehna&#x2F;humanify for such deobfuscate tasks
评论 #43749225 未加载
itsthecourier23 天前
this level of obfuscation in a social app is super suspicious
评论 #43755382 未加载
worldsavior23 天前
That&#x27;s a very strong obfuscation. Takes a lot of work to deobfuscate such a thing. Great writeup.
xfeeefeee23 天前
The fascinating process of reverse engineering this VM is detailed here.<p>TikTok uses a custom virtual machine (VM) as part of its obfuscation and security layers. This project includes tools to:<p>Deobfuscate webmssdk.js that has the virtual machine.<p>Decompile TikTok’s virtual machine instructions into readable form.<p>Script Inject Replace webmssdk.js with the deobfuscated VM injector.<p>Sign URLs Generate signed URLs which can be used to perform auth-based requests eg. Post comments.
评论 #43748699 未加载
评论 #43754044 未加载