> For the complete documentation index, see [llms.txt](https://elijahchia.gitbook.io/ctf-blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://elijahchia.gitbook.io/ctf-blog/hkcert-ctf-24/void-rev.md).

# Void (rev)

As the name suggests, this challenge requires us to reverse engineer some front-end javascript code. However, upon viewing the code via inspector, the script appears to have many blank lines and ends with a weird function.

<figure><img src="/files/gqJvSC7hzuGLGjBU2ALo" alt="" width="375"><figcaption></figcaption></figure>

As you can see, there are approximately 800 lines of seemingly invisible javascript. On copy-pasting into Visual Studio Code, however, we are warned that there are invisible unicode characters.&#x20;

Following the URL linked in the code, we see aemkei's post on `invisible.js`, which is a method of encoding used to make javascript scripts invisible.&#x20;

<figure><img src="/files/L8PXW6g9e8KCZmJnupWn" alt=""><figcaption></figcaption></figure>

On closer inspection of the script, it first accumulates all the human-readable code inside a variable `f`, then when the code is ready it does `eval(f)`.&#x20;

To reverse engineer and obtain the human-readable code, we can simply add `console.log` into the javascript function to make it print the code before running it. Below is my modified `\u3164` function:

```javascript
function \u3164(){
    return f="",p=[],new Proxy({},{
        has:(t,n)=>(p.push(n.length-1),2==p.length&&(p[0]||p[1]||
            (console.log(f) && eval(f)),
            f+=String.fromCharCode(p[0]<<4|p[1]),p=[]),!0)})}
```

This prints the javascript code just before it is executed (I ran the code on `programiz.com`)

<figure><img src="/files/UJS94GEtc008rhnRdckb" alt=""><figcaption></figcaption></figure>

Which gives us the flag!