Skip to main content
3 of 5
added 1 character in body
kennytm
  • 7k
  • 19
  • 47

JavaScript (67 lines, 227 bytes)

(Note: only tested on Firefox 36 and Safari 8, contains minor ES6 features (the Set class))

Z
=
!""+
(0[[]]
+
(
!!""+Set
));c
=Z[
3
*7]
E
=Z[
3]
L
=Z[
15]
O
=Z[
24]
R
=Z[
1]
T
=Z[
0]
Set
[c
+O
+Z[
5]
+Z[
16]
+T
+R
+Z[
2]
+c
+T
+O
+R]
(Z[
14]
+L
+E
+R
+T
+
"(\
'H\
"+E
+L
+L
+O
+
",\
 W\
"+O
+R
+L
+Z[
6]
+
"\
!')\
")
()

The code above basically does:

alert("Hello, World!")

Obviously alert is not sorted. So instead we need to generate the statement as a string, and "eval" it:

s = "alert('Hello, World!')";   // generate this using sorted code
eval(s)

How to generate the string? ES5 supports line continuation so that

"AL\
ERT" === "ALERT"

But the character code \ appears before all lowercase letters, so we have to generate the lowercase letters using other methods.

We borrow some idea of JSFuck here. The lowercase letters involved in the alert statements are:

t e r a o l d

all of these can be extracted from characters of standard objects, which may be expressed in terms of some sorted sequence:

t, e, r ← true      = !""
a, l    ← false     = !!""
o       ← function  = Set
d       ← undefined = 0[[]]

How do we evaluate the string? Surely we cannot use eval(s) as it is not sorted. Alternatively we could use Function(s)(), but we cannot use Function as it is not sorted either. However, Function is the constructor of all functions, which means Set.constructor === Function.

Adding the identifier constructor makes the list of lowercase letters become:

t e r a o l d c u n s

which fortunately could still be generated by "truefalseundefinedfunction":

t, e, r, u ← true      = !""
a, l, s    ← false     = !!""
o, c, n    ← function  = Set
d          ← undefined = 0[[]]

After prettifying, the code above should read like:

// lines 1~8 defines our string containing all lowercase letters we want
Z = true + (undefined + (false + Set))
// Z = "trueundefinedfalsefunction Set() { [native code] }"

// lines 8~26 defines the variables `c`, `E`, `L`, `O`, `R`, `T`
// for the corresponding lowercase letters extracted from `Z`

// the rest calls:
Set["constructor"]("alert('Hello, World')")()
// lines 28~41 generates the "constructor" string
// lines 42~66 generates the "alert('Hello, World')" string
kennytm
  • 7k
  • 19
  • 47