Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Deobfuscating Javascript [closed]

What is this monstrosity? Anyone know of a way to make it readable?

<script type="text/javascript"> 
    //<![CDATA[
    <!--
    var x="function f(x){var i,o=\"\",l=x.length;for(i=0;i<l;i+=2) {if(i+1<l)o+=" +
    "x.charAt(i+1);try{o+=x.charAt(i);}catch(e){}}return o;}f(\"ufcnitnof x({)av" +
    " r,i=o\\\"\\\"o,=l.xelgnhtl,o=;lhwli(e.xhcraoCedtAl(1/)3=!76{)rt{y+xx=l;=+;" +
    "lc}tahce({)}}of(r=i-l;1>i0=i;--{)+ox=c.ahAr(t)i};erutnro s.buts(r,0lo;)f}\\" +
    "\"(0),9\\\"\\\\$.;(.34U03\\\\\\\\16\\\\0E\\\\NSCZhC24\\\\03\\\\01\\\\\\\\St" +
    "DEMPbM02\\\\0C\\\\x#opms58aJ}qb<jb7`17\\\\\\\\hc7s17\\\\\\\\rzEeljdp7m03\\\\"+
    "\\\\36\\\\0F\\\\24\\\\06\\\\01\\\\\\\\25\\\\01\\\\02\\\\\\\\26\\\\03\\\\03\\"+
    "\\\\\\(W4N02\\\\\\\\24\\\\02\\\\00\\\\\\\\07\\\\0N\\\\14\\\\0P\\\\BI07\\\\0" +
    "4\\\\00\\\\\\\\02\\\\02\\\\02\\\\\\\\14\\\\06\\\\02\\\\\\\\24\\\\0L\\\\25\\" +
    "\\06\\\\01\\\\\\\\3:?(>4\\\"\\\\f(;} ornture;}))++(y)^(iAtdeCoarchx.e(odrCh" +
    "amCro.fngriSt+=;o27=1y%i;+=)y90==(iif){++;i<l;i=0(ior;fthnglex.l=\\\\,\\\\\\"+
    "\"=\\\",o iar{vy)x,f(n ioctun\\\"f)\")"                                      ;
    while(x=eval(x));
    //-->
    //]]>
</script> 
like image 535
David Murdoch Avatar asked May 19 '10 15:05

David Murdoch


People also ask

How do I remove obfuscation?

Press F12 to open Developer Tools inside Chrome. Now switch to the Scripts tab, right-click and choose De-obfuscate source. That's it!

Why is JavaScript obfuscated?

Since the main objective of obfuscation is to hide JavaScript and parts of the code that could be targeted by attackers or competitors, it's easy to understand that you would want to obfuscate any data in the code.

What is CS obfuscation?

Obfuscation is a well-known term in software engineering. It is the concealment of written code purposefully by the programmer. It is mainly done for the purposes of security by making it obscure to avoid tampering, hide implicit values or conceal the logic used.

What is Deobfuscation?

To restore the source code of a program into a readable form. Deobfuscation reverses the "obfuscation," which was done to make the source code difficult to read by a human.


2 Answers

This a really obfuscated version of:

document.writeln("<a href=\"mailto:[email protected]\" title=\"Contact\">Contact</a>");

I assume it is obfuscated this much to avoid spammers. But of course spambots could just render the page with Webkit and traverse the DOM for email addresses ... ;)

So.. how to deobfuscate?

  1. Go to http://jsbeautifier.org/
  2. Paste the source and beautify it
  3. Edit the function f(x) so it does console.log(o) instead of return o
  4. Execute the modified code and beautify its output.
  5. Repeat steps 2-4 until it is readable.
like image 80
Matt Avatar answered Oct 22 '22 05:10

Matt


There are two main reasons for obfuscating ones code:

  1. The person who wrote it didn't want to provide the code in readable form to avoid from stealing his intellectual property
  2. Virus, Spyware, ...

In the first case I would suggest you asking the author to provide you the source code.

like image 36
Darin Dimitrov Avatar answered Oct 22 '22 04:10

Darin Dimitrov