something similar eval(atob('ZnVuY3Rpb24gdXBkYXRlKCkgewogIGlmICghdGlja3MpIHsKICA...

tlrobinson · 2024-01-03T07:19:04.000000Z

Not sure why you obfuscated it but here's the code for anyone curious:

    function update() {
      if (!ticks) {
        player = { x: 40, vx: 1 };
        enemy = { x: 100, eyeVx: 0 };
        multiplier = 0;
        addDots();
        powerTicks = animTicks = 0;
      }
      animTicks += difficulty;
      color("black");
      text(`x${multiplier}`, 3, 9);
      if (input.isJustPressed) {
        player.vx *= -1;
      }
      player.x += player.vx * 0.5 * difficulty;
      if (player.x < -3) {
        player.x = 103;
      } else if (player.x > 103) {
        player.x = -3;
      }
      color("blue");
      rect(0, 23, 100, 1);
      rect(0, 25, 100, 1);
      rect(0, 34, 100, 1);
      rect(0, 36, 100, 1);
      color("green");
      const ai = floor(animTicks / 7) % 4;
      char(addWithCharCode("a", ai === 3 ? 1 : ai), player.x, 30, {
        // @ts-ignore
        mirror: { x: player.vx },
      });
      remove(dots, (d) => {
        color(
          d.isPower && floor(animTicks / 7) % 2 === 0 ? "transparent" : "yellow"
        );
        const c = char(d.isPower ? "g" : "f", d.x, 30).isColliding.char;
        if (c.a || c.b || c.c) {
          if (d.isPower) {
            play("jump");
            if (enemy.eyeVx === 0) {
              powerTicks = 120;
            }
          } else {
            play("hit");
          }
          addScore(multiplier);
          return true;
        }
      });
      const evx =
        enemy.eyeVx !== 0
          ? enemy.eyeVx
          : (player.x > enemy.x ? 1 : -1) * (powerTicks > 0 ? -1 : 1);
      enemy.x = clamp(
        enemy.x +
          evx *
            (powerTicks > 0 ? 0.25 : enemy.eyeVx !== 0 ? 0.75 : 0.55) *
            difficulty,
        0,
        100
      );
      if ((enemy.eyeVx < 0 && enemy.x < 1) || (enemy.eyeVx > 0 && enemy.x > 99)) {
        enemy.eyeVx = 0;
      }
      color(
        powerTicks > 0
          ? powerTicks < 30 && powerTicks % 10 < 5
            ? "black"
            : "blue"
          : enemy.eyeVx !== 0
          ? "black"
          : "red"
      );
      const c = char(
        enemy.eyeVx !== 0 ? "h" : addWithCharCode("d", floor(animTicks / 7) % 2),
        enemy.x,
        30,
        {
          // @ts-ignore
          mirror: { x: evx },
        }
      ).isColliding.char;
      if (enemy.eyeVx === 0 && (c.a || c.b || c.c)) {
        if (powerTicks > 0) {
          play("powerUp");
          addScore(10 * multiplier, enemy.x, 30);
          enemy.eyeVx = player.x > 50 ? -1 : 1;
          powerTicks = 0;
          multiplier++;
        } else {
          play("explosion");
        }
      }
      powerTicks -= difficulty;
      if (dots.length === 0) {
        play("coin");
        addDots();
      }
    }

hoseja · 2024-01-03T09:00:37.000000Z

Why would anyone even consider pasting obfuscated JS into their console, on HN of all places, is beyond me.

jessekv · 2024-01-03T17:10:20.000000Z

No different than clicking on the links, right?

(Admittedly I typically browse with JS disabled...)

rane · 2024-01-03T09:07:21.000000Z

Theoretically, what's the worst thing that could happen - given it's a pacman game's console and not your online bank's?

cangeroo · 2024-01-03T09:14:25.000000Z

I recall manually entered commmands have access to some APIs that are not normally accessible. Maybe timing related? So in the theoretical extreme, a timing attack to access something in your entire system memory and upload it via HTTP... while you watch the game play :)

londons_explore · 2024-01-03T14:54:16.000000Z

Do they? It's easy enough to 'give' any API accessible to the console to the page by setting a variable from the page to point to a console-only accessible function.

Given there aren't many sites that say "just open the console and paste this command to win the big prize", I suspect that any console-only API's aren't very powerful if they exist at all.

cangeroo · 2024-01-03T18:58:54.000000Z

Browsers now require you to manually type 'allow pasting':

https://developer.chrome.com/blog/new-in-devtools-120#self-x...

fennecfoxy · 2024-01-04T15:43:46.000000Z

Because normies are extremely susceptible to things like "hack Facebook, see the PMs of any hot girl u want!111 just right-click and paste this into your browser console trust me bro"

As well as the usual engagement driving "challenges" like "Omg did you know there's no country starting with Z! Bet you can't think of one!" meanwhile comments are filled with "duuuuh Zanzibaaaar!" and post engagement is >>>>>>>>>>>>

supriyo-biswas · 2024-01-03T08:52:22.000000Z

This seems to make it possible for Pac-man to stick with the ghosts while still consuming pellets, so maybe still evading the rules of the game :)