DEV Community πŸ‘©β€πŸ’»πŸ‘¨β€πŸ’»

DEV Community πŸ‘©β€πŸ’»πŸ‘¨β€πŸ’» is a community of 964,423 amazing developers

We're a place where coders share, stay up-to-date and grow their careers.

Create account Log in
Luka Vidaković
Luka Vidaković

Posted on

Escaping the call stack

Let’s look at one way to cover the tracks within injected javascript code. It exploits asynchronous javascript nature to obfuscate the function call stack. This is a continuation of the initial post on code obfuscation.

What are we even talking about?

Call stack is best observed within exceptions, but it’s purpose is to resolve values of the called functions. It β€œrewinds” function calls with resulted values upon completion, but let’s not go into details.

const first = () => {
  throw new Error()
}
const second = () => first()
const third = () => second()

third()

/* pasting this to browser's console will print something like
VM80:1 Uncaught Error
    at first (<anonymous>:1:29)
    at second (<anonymous>:2:22)
    at third (<anonymous>:3:21)
*/
Enter fullscreen mode Exit fullscreen mode

This is an example of a call stack. Execution started at the third() function call and then continued to second() and first() function calls until the exception was thrown.

Breaking free from the call stack

There are reasons you might want to break from the call stack. Most are malicious and try to cover up the tracks. Nonetheless, here is one way of stack escape:

function maliciousStuff() {
  throw new Error()
}

function legitChunkOfCode() {
  // ...
  // code that you don't want people to easily connect with it's caller function
  setTimeout(() => maliciousStuff())
}

legitChunkOfCode()

/* pasting this to browser's console will print something like
Uncaught Error
    at maliciousStuff (<anonymous>:2:9)
    at setTimeout (<anonymous>:7:20)
*/
Enter fullscreen mode Exit fullscreen mode

The easiest way to break off the execution chain is to set up a timeout call. That breaks the synchronicity of a function call and schedules code for some time in the future. You can’t find information about the caller function in the call stack(legitChunkOfCode). We’ve broken the stack and made execution much harder to follow.

Top comments (0)

🌚 Friends don't let friends browse without dark mode.

Sorry, it's true.