Khoa Nguyen cocoastorm

Reverse Engineering Webpack Apps

Some notes and techniques for reverse engineering Webpack (and a little bit about React/Vue/Angular) apps.

News

EOL (2024-07-21)

I'm not going to be maintaining this document anymore. I'm leaving it as-is since much of the FAQ section is still accurate and has yet to be incorporated into other resources.

Use CanI.RootMy.TV to find an exploit for your TV.

New exploit for webOS 3.5+: DejaVuln (2024-04-21)

Twitter allows users to download parts of their data, see How to download your Twitter archive.

But what's not included in that data dump is the usernames/handles of the people that you follow or are following you. All you get is account IDs which is just an internal number and so a bit useless when it comes to archival.

Here's a way to get that data (you need to know how to run stuff in the terminal):

Go to your Twitter profile in a desktop browser (Firefox or Chrome)
Right click on page → Inspect → Network tab
Click on the Following link (e.g. https://twitter.com/{yourusername}/following)

This guide is slightly deprecated as V3 of 7TV's browser add-on now supports 7TV, BetterTTV, and FrankerFaceZ emotes out of the box, and has some great quality of life chat features that are currently not found in any other emote add-on. You should consider going to 7TV's website and downloading their browser add-on from there.

What even is this?

7TV, BetterTTV, and FrankerFaceZ, more commonly stylized as 7TV, BTTV, and FFZ, are 3rd party emote services for Twitch chat, which aim to enhance a viewer's chatting experience on Twitch by allowing for more emotes to be used in chat, free of charge. Think of it like Discord emojis.

If you're wondering what those weird phrases people in chat seem to be spamming are, it's probably an emote from one of the above mentioned 3rd party emote servi

title

description

date

updated

uuid

	/* eslint-disable unicorn/no-null */

	/*
	* Resetting window.location between tests is unfortunately a hard topic with JSDOM.
	*
	* https://gist.github.com/tkrotoff/52f4a29e919445d6e97f9a9e44ada449
	*
	* FIXME JSDOM leaves the history in place after every test, so the history will be dirty.
	* Also its implementations for window.location and window.history are lacking.
	* - https://github.com/jsdom/jsdom/blob/22.1.0/lib/jsdom/living/window/Location-impl.js

	// ==UserScript==
	// @name @chaoticvibing Twitter Blue Nerd - twitter.com
	// @namespace Violentmonkey Scripts
	// @match ://.twitter.com/*
	// @match ://.x.com/*
	// @grant none
	// @version 1.9.2
	// @author @chaoticvibing - GH @busybox11
	// @description 11/9/2022, 11:45:28 PM
	// @updateURL https://gist.githubusercontent.com/busybox11/53c76f57a577a47a19fab649a76f18e3/raw

	#!/usr/bin/env bash

	# Small shell script to more easily automatically download and transcribe live stream VODs.
	# This uses YT-DLP, ffmpeg and the CPP version of Whisper: https://github.com/ggerganov/whisper.cpp
	# Use `./transcribe-vod help` to print help info.

	# MIT License

	# Copyright (c) 2022 Daniils Petrovs

	const ls = window.localStorage;
	// Ensure we're always sending something
	let stringifiedData = '{}';
	// Default to production
	let url = 'https://www.nytimes.com/games/wordle'

	// Don't attempt unless our user has local storage enabled
	if (ls) {
	const errors = [];
	const localData = {

	#!/bin/sh

	# Requires https://formulae.brew.sh/formula/choose
	# Requires https://formulae.brew.sh/cask/mpv
	# Chmod +x lofi.sh and put it somewhere in $PATH
	# May also set global hotkey via https://github.com/koekeishiya/skhd
	# e.g. echo "ctrl + cmd - p : ~/lofi" >> ~/.skhdrc

	notification() {
	terminal-notifier -message 'Now Playing: Lofi Radio ☕️🎶'