Bug 1562700 Comment 13 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

Well, obfuscated stack overflow code is the culprit here, but according to nbp, our stack is only 8MB on Linux—a reasonable size. I don't know why the same thing doesn't happen in Chrome.

This appears in the script:

```js
function _0x350612(_0x4b463f){function _0x2ef841(_0x5ec3e5){if(typeof _0x5ec3e5===_0x3a6d('0x93d','d0)f')){return function(_0x57572e){}[_0x3a6d('0x93e','qHvK')](_0x3a6d('0x93f','b!8W'))[_0x3a6d('0x940','szhN')](_0x3a6d('0x941','X56f'));}else{if((''+_0x5ec3e5/_0x5ec3e5)[_0x3a6d('0x942','F)Br')]!==0x1||_0x5ec3e5%0x14===0x0){(function(){return!![];}[_0x3a6d('0x943','@x3s')](_0x3a6d('0x944','^lIo')+'gger')[_0x3a6d('0x43e','qHvK')](_0x3a6d('0x945','^lIo')));}else{(function(){return![];}[_0x3a6d('0x946','Vkyn')](_0x3a6d('0x947','NR4[')+_0x3a6d('0x948','jc1*'))[_0x3a6d('0x949','A7K%')]('stateObject'));}}_0x2ef841(++_0x5ec3e5);}try{if(_0x4b463f){return _0x2ef841;}else{_0x2ef841(0x0);}}catch(_0x473c12){}}
```

Many calls to this function are sprinkled throughout the script, including this: `setInterval(function(){_0x350612();},0xfa0)`. So this is called every 4 seconds.

It boils down to this:

```js
function annoy_user(create_function_only) {
  function stay_busy(x) {
    debugger;
    stay_busy(x + 1);
  }

  try {
    stay_busy(0);
  } catch (err) {}
}
```
Well, obfuscated stack overflow code is the culprit here, but according to nbp, our stack is only 8MB on Linux—a reasonable size. I don't know why the same thing doesn't happen in Chrome.

This appears in the script:

```js
function _0x350612(_0x4b463f){function _0x2ef841(_0x5ec3e5){if(typeof _0x5ec3e5===_0x3a6d('0x93d','d0)f')){return
function(_0x57572e){}[_0x3a6d('0x93e','qHvK')](_0x3a6d('0x93f','b!8W'))[_0x3a6d('0x940','szhN')](_0x3a6d('0x941','X56f'));
}else{if((''+_0x5ec3e5/_0x5ec3e5)[_0x3a6d('0x942','F)Br')]!==0x1||_0x5ec3e5%0x14===0x0){(function(){return!![];}
[_0x3a6d('0x943','@x3s')](_0x3a6d('0x944','^lIo')+'gger')[_0x3a6d('0x43e','qHvK')](_0x3a6d('0x945','^lIo')));}else{
(function(){return![];}[_0x3a6d('0x946','Vkyn')](_0x3a6d('0x947','NR4[')+_0x3a6d('0x948','jc1*'))[_0x3a6d('0x949','A7K%')]
('stateObject'));}}_0x2ef841(++_0x5ec3e5);}try{if(_0x4b463f){return _0x2ef841;}else{_0x2ef841(0x0);}}catch(_0x473c12){}}
```

Many calls to this function are sprinkled throughout the script, including this: `setInterval(function(){_0x350612();},0xfa0)`. So this is called every 4 seconds.

It boils down to this:

```js
function annoy_user(create_function_only) {
  function stay_busy(x) {
    debugger;
    stay_busy(x + 1);
  }

  try {
    stay_busy(0);
  } catch (err) {}
}
```
Well, obfuscated stack overflow code is the culprit here, but according to nbp, our stack is only 8MB on Linux—a reasonable size. I don't know why the same thing doesn't happen in Chrome.

This appears in the script:

```js
function _0x350612(_0x4b463f){function _0x2ef841(_0x5ec3e5){if(typeof _0x5ec3e5===_0x3a6d('0x93d','d0)f')){return
function(_0x57572e){}[_0x3a6d('0x93e','qHvK')](_0x3a6d('0x93f','b!8W'))[_0x3a6d('0x940','szhN')](_0x3a6d('0x941','X56f'));
}else{if((''+_0x5ec3e5/_0x5ec3e5)[_0x3a6d('0x942','F)Br')]!==0x1||_0x5ec3e5%0x14===0x0){(function(){return!![];}
[_0x3a6d('0x943','@x3s')](_0x3a6d('0x944','^lIo')+'gger')[_0x3a6d('0x43e','qHvK')](_0x3a6d('0x945','^lIo')));}else{
(function(){return![];}[_0x3a6d('0x946','Vkyn')](_0x3a6d('0x947','NR4[')+_0x3a6d('0x948','jc1*'))[_0x3a6d('0x949','A7K%')]
('stateObject'));}}_0x2ef841(++_0x5ec3e5);}try{if(_0x4b463f){return _0x2ef841;}else{_0x2ef841(0x0);}}catch(_0x473c12){}}
```

Many calls to this function are sprinkled throughout the script, including this: `setInterval(function(){_0x350612();},0xfa0)`. So this is called at least every 4 seconds.

It boils down to this:

```js
function annoy_user(create_function_only) {
  function stay_busy(x) {
    debugger;
    stay_busy(x + 1);
  }

  try {
    stay_busy(0);
  } catch (err) {}
}
```

Back to Bug 1562700 Comment 13