...

View Full Version : Obfuscated?



cantthinkofanic
02-06-2009, 02:16 PM
I have a js file that looks like this:

//MooTools, My Object Oriented Javascript Tools. Copyright (c) 2006 Valerio Proietti, <http://mad4milk.net>, MIT Style License.
eval(function(A,G){return A.replace(/(\w+)/g,function(a,b){return G[parseInt(b,36)]})}("0 1=2(3){0 4=2(){5 (0 6 7 8){9 (8[6]) 8[6].a=8;}\n9 (b[c]....

and ends like this:

...llTop,pageYOffset,getScrollLeft,scrollLeft,pageXOffset,onDomReady,init,state,readyState,childNode s,all,navigator,taintEnabled,loaded,complete,script,_ie_ready_,write,id,defer,src,readystatechange,m yInit,callee,done,load,DOMContentLoaded".split(",")));

I want to get at the js to modify the behaviour and what it puts into the page. Is this code coded in some way?

What are my options for decoding it? (I have tried one deobfuscation tool which just repeated it back to me as is!

The file is called mootools.js and is the only file apart from slimbox.js which is a js file.

_Aerospace_Eng_
02-06-2009, 08:27 PM
You can try downloading the uncompressed version of mootools.
http://mootools.net/download
Older versions are still there as well.

http://mootools.net/download/get/mootools-x.x.x-core-nc.js
Where x.x.x is the version number. You currently have 1.1.1 so you can download the uncompressed version.

rnd me
02-06-2009, 09:32 PM
you can view it by changing "eval" to "alert".

if you want to extract it, one way is to remove "eval", and assign the expression to the .value of a textarea.

cantthinkofanic
02-07-2009, 02:14 PM
I tried the uc version but when clicking the image the lightbox did not open, just a new page with the larger image. The other js file is slimbox.js. Is this relevant? Any further advice on getting the uc 1.1.1 version working welcome.

_Aerospace_Eng_
02-07-2009, 03:29 PM
Attach your mootools.js file. You may need to put it in a zip file or link us directly to it if you can.

cantthinkofanic
02-07-2009, 04:07 PM
Thanks, I've volunteered for a local group which I'm a member. It's better if you see the page it's on and the js file is inline. The page is:

http://www.newsite.lulworthsociety.org.uk/index.php?option=com_content&view=article&id=48&Itemid=58

Click Quiz and then on the first image. Hope it's all there. PS I have copied across a mootools 1.11 version (they all fail). If you want to see the obfuscated one I will have to put it back. I would like to get a source one working.

PS2 the idea of this quiz is to enable people to answer by printing the page as a PDF (config. later). If there was a form version where the answers could be submited as well that would be great.

_Aerospace_Eng_
02-08-2009, 07:10 AM
Please put the obfuscated one back up. You could also try using this.

http://javascript.about.com/library/blformat.htm

cantthinkofanic
02-08-2009, 08:59 AM
OK, I have put the old one back.

_Aerospace_Eng_
02-08-2009, 05:07 PM
Attached are two versions of your original code from two different code formatters.

cantthinkofanic
02-09-2009, 08:16 AM
Thanks for your efforts I will have a good look at those.



EZ Archive Ads Plugin for vBulletin Copyright 2006 Computer Help Forum