// 注意义郑,在Chrome瀏覽器中打印
[[][0] + []][0][5]+[[][[[][0] + []][0][4]+[[][0] + []][0][5]+[[][0] + []][0][1]+[[][0] + []][0][2]] + []][0][8]+[[[] == []][0] + []][0][2]+[[][[[][0] + []][0][4]+[[][0] + []][0][5]+[[][0] + []][0][1]+[[][0] + []][0][2]] + []][0][6]+[[][[[][0] + []][0][4]+[[][0] + []][0][5]+[[][0] + []][0][1]+[[][0] + []][0][2]]+[]][0][23]+[[][0] + []][0][3]+[[][[[][0] + []][0][4]+[[][0] + []][0][5]+[[][0] + []][0][1]+[[][0] + []][0][2]] + []][0][8]+[+[1 + [[][0] + []][0][3] +309][0] + []][0][7]+[[][[[][0] + []][0][4]+[[][0] + []][0][5]+[[][0] + []][0][1]+[[][0] + []][0][2]] + []][0][6]+[[][0] + []][0][0]
//執(zhí)行完的結(jié)果很神奇的是一段話
//"i love you"
親測了一下,不得不感嘆js的神奇丈钙,于是去探究其中的原理非驮,就會發(fā)現(xiàn)充分運(yùn)用了JavaScript 隱式類型轉(zhuǎn)換原理。
可以任意輸出數(shù)字
let zero = +[];//0
let one = +(![]==![]);//1
let two = +(![]==![])+(![]==![]);//one+one=2
let three = +(![]==![])+(![]==![])+(![]==![]);//one+one+one=3
let four = +(![]==![])+(![]==![])+(![]==![])+(![]==![]);//one+one+one+one+one=4
let five = +(![]==![])+(![]==![])+(![]==![])+(![]==![])+(![]==![]);//one+one+one+one+one=5
let ten = +(+(![]==![])+[]+(+[]));//10
let hundred = +(+(![]==![])+[]+(+[]))*+(+(![]==![])+[]+(+[]));//ten*ten=100
let thousand = +(+(![]==![])+[]+(+[]))*+(+(![]==![])+[]+(+[]))*+(+(![]==![])+[]+(+[]));//ten*hundred=1000
最初的字母來源
let voidStr = []+[];
//""
let trueStr = (![]==![])+[];
//"true"
let falseStr = ([]==[])+[];
//"false"
let undefinedStr = [][+[]]+[];
//"undefined"
let nanStr = +[][+[]]+[];
//"NaN"
//["true"][0][3]獲得字母e
Infinity
//[]+one+[trueStr][zero][three]+three+zero+(ten-one) = "1e309"
let InfinityNum = []+(+(![]==![]))+[(![]==![])+[]][+[]][+(![]==![])+(![]==![])+(![]==![])]+(+(![]==![])+(![]==![])+(![]==![]))+(+[])+(+(+(![]==![])+[]+(+[]))-(+(![]==![])));//"1e309"
//+("1e309")轉(zhuǎn)成數(shù)字后雏赦,相當(dāng)于 1 乘以 10 的 309 次方劫笙,大于 JavaScript 最大的數(shù),所以結(jié)果會是 Infinity
//+(InfinityNum)+[]="Infinity"
let InfinityStr = +([]+(+(![]==![]))+[(![]==![])+[]][+[]][+(![]==![])+(![]==![])+(![]==![])]+(+(![]==![])+(![]==![])+(![]==![]))+(+[])+(+(+(![]==![])+[]+(+[]))-(+(![]==![]))))+[];
//"Infinity"
Function
//[]["find"]會顯示數(shù)組的find函數(shù)星岗,結(jié)果為:function find() { [native code] }
//[undefinedStr][zero][four]+[undefinedStr][zero][five]+[undefinedStr][zero][ten-four]+[undefinedStr][zero][two] = "find"
let funStr = [][ [[][+[]]+[]][+[]][+(![]==![])+(![]==![])+(![]==![])+(![]==![])] + [[][+[]]+[]][+[]][+(![]==![])+(![]==![])+(![]==![])+(![]==![])+(![]==![])] + [[][+[]]+[]][+[]][+(+(![]==![])+[]+(+[]))-(+(![]==![])+(![]==![])+(![]==![])+(![]==![]))] + [[][+[]]+[]][+[]][+(![]==![])+(![]==![])]]+[];
//"function find() { [native code] }"
constructor
//constructor 是一個神奇的屬性填大,因?yàn)橥ㄟ^它,我們可以獲得各種類型的值對象的構(gòu)造函數(shù)俏橘!
//[funStr][zero][three]+[funStr][zero][ten-four]+[undefinedStr][zero][one]+[falseStr][zero][three]+[trueStr][zero][zero]+[trueStr][zero][one]+[trueStr][zero][two]+[funStr][zero][three]+[trueStr][zero][zero]+[funStr][zero][ten-four]+[trueStr][zero][one] = constructor
let constructorStr = [ [][ [[][+[]]+[]][+[]][+(![]==![])+(![]==![])+(![]==![])+(![]==![])] + [[][+[]]+[]][+[]][+(![]==![])+(![]==![])+(![]==![])+(![]==![])+(![]==![])] + [[][+[]]+[]][+[]][+(+(![]==![])+[]+(+[]))-(+(![]==![])+(![]==![])+(![]==![])+(![]==![]))] + [[][+[]]+[]][+[]][+(![]==![])+(![]==![])]]+[] ][+[]][+(![]==![])+(![]==![])+(![]==![])] +
[ [][ [[][+[]]+[]][+[]][+(![]==![])+(![]==![])+(![]==![])+(![]==![])] + [[][+[]]+[]][+[]][+(![]==![])+(![]==![])+(![]==![])+(![]==![])+(![]==![])] + [[][+[]]+[]][+[]][+(+(![]==![])+[]+(+[]))-(+(![]==![])+(![]==![])+(![]==![])+(![]==![]))] + [[][+[]]+[]][+[]][+(![]==![])+(![]==![])]]+[] ][+[]][ +(+(![]==![])+[]+(+[])) - (+(![]==![])+(![]==![])+(![]==![])+(![]==![])) ] +
[ [][+[]]+[] ][+[]][+(![]==![])] +
[ ([]==[])+[] ][+[]][+(![]==![])+(![]==![])+(![]==![])] +
[ (![]==![])+[] ][+[]][+[]] +
[ (![]==![])+[] ][+[]][+(![]==![])] +
[ (![]==![])+[] ][+[]][+(![]==![])+(![]==![])] +
[ [][ [[][+[]]+[]][+[]][+(![]==![])+(![]==![])+(![]==![])+(![]==![])] + [[][+[]]+[]][+[]][+(![]==![])+(![]==![])+(![]==![])+(![]==![])+(![]==![])] + [[][+[]]+[]][+[]][+(+(![]==![])+[]+(+[]))-(+(![]==![])+(![]==![])+(![]==![])+(![]==![]))] + [[][+[]]+[]][+[]][+(![]==![])+(![]==![])]]+[] ][+[]][+(![]==![])+(![]==![])+(![]==![])] +
[ (![]==![])+[] ][+[]][+[]] +
[ [][ [[][+[]]+[]][+[]][+(![]==![])+(![]==![])+(![]==![])+(![]==![])] + [[][+[]]+[]][+[]][+(![]==![])+(![]==![])+(![]==![])+(![]==![])+(![]==![])] + [[][+[]]+[]][+[]][+(+(![]==![])+[]+(+[]))-(+(![]==![])+(![]==![])+(![]==![])+(![]==![]))] + [[][+[]]+[]][+[]][+(![]==![])+(![]==![])]]+[] ][+[]][ +(+(![]==![])+[]+(+[])) - (+(![]==![])+(![]==![])+(![]==![])+(![]==![])) ] +
[ (![]==![])+[] ][+[]][+(![]==![])];
// "constructor"
//0["constructor"] => function Number() { [native code] } 可以獲取字母m允华,g
toString
constructor 可是一個神奇的屬性,因?yàn)橥ㄟ^它,我們可以獲得各種類型的值對象的構(gòu)造函數(shù)靴寂!
//0["constructor"] // function Number() { [native code] }
""["constructor"] // function String() { [native code] }
//"to" + ""["constructor"]["name"] => "toString"
toString 這個方法可以表示出 26個 字母!
NumberObject.toString(radix)
radix:表示數(shù)字的基數(shù)磷蜀,使 2 ~ 36 之間的整數(shù)。若省略該參數(shù)榨汤,則使用基數(shù) 10蠕搜。但是要注意,如果該參數(shù)是 10 以外的其他值收壕,則 ECMAScript 標(biāo)準(zhǔn)允許實(shí)現(xiàn)返回任意值
10['toString'](36)
//a
35['toString'](36)
//Z