...

View Full Version : What type of js coding is this ???



jeddi
01-19-2012, 11:41 AM
Hi,

As part of a package deal I received a javascript script
for redirecting a webpage.

Now I already have simple redirection but wanted to see
how this one did the redirection.

But it starts off by defining an array with strange sets of characters.

Is this hexadecimal or something ?

Can I convert it into a more readable and understandable form ?


var _0x46d5=["\x67\x65\x74\x54\x69\x6D\x65","\x73\x65\x74\x54\x69\x6D\x65","\x3B\x20\x65\x78\x70\x69\x72\x65\x73\x3D","\x74\x6F\x47\x4D\x54\x53\x74\x72\x69\x6E\x67","","\x63\x6F\x6F\x6B\x69\x65","\x3D","\x3B\x20\x70\x61\x74\x68\x3D\x2F","\x3B","\x73\x70\x6C\x69\x74","\x6C\x65\x6E\x67\x74\x68","\x73\x75\x62\x73\x74\x72\x69\x6E\x67","\x63\x68\x61\x72\x41\x74","\x20","\x69\x6E\x64\x65\x78\x4F\x66","\x26","\x3F","\x68\x72\x65\x66","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x73\x6C\x69\x63\x65","\x70\x75\x73\x68","\x65\x7A\x6D\x62\x72\x65\x64","\x4E","\x59","\x75\x73\x65\x72\x41\x67\x65\x6E\x74","\x76\x65\x6E\x64\x6F\x72","\x6F\x70\x65\x72\x61","\x74\x65\x73\x74","\x73\x75\x62\x73\x74\x72"];

function createCookie(_0x810ex2,_0x810ex3,_0x810ex4,_0x810ex5){

...

the script continues using the array elements above.

Thanks for any insights.


.

devnull69
01-19-2012, 12:31 PM
This is some kind of obfuscation ... it is a simple list of ASCII values in Hex. If you inspect this in e.g. Firebug you will get this:


["getTime","setTime","; expires x3D","toGMTString","","cookie","=","; path=/",";","split","length","substring","charAt"," ","indexOf","&","?"," href","location","slice","push","e zmbred","N","Y","userAgent","vendo r","opera","test","substr"]

jeddi
01-19-2012, 01:54 PM
Thanks for your help :D

mjy
01-19-2012, 03:34 PM
The expressions like \x67 are simply escape sequences, which you can embed in a string to encode characters that would be problematic to type in (or in this case, to obfuscate the text). The following are other common escape sequences (taken from my book "JavaScript: Just the Basics"):
\t tab
\n newline
\" double quote
\' single quote
\\ backslash
\uhhhh Any character in the Unicode character set. hhhh is the four-digit hexadecimal code for the character.

To see the actual contents of the string, you can just display it using alert (I had to delete a few extraneous space characters):


<script>

var _0x46d5=["\x67\x65\x74\x54\x69\x6D\x65","\x73\x65\x74\x54\x69\x6D\x65","\x3B\x20\x65\x78\x70\x69\x72\x65\x73\ x3D","\x74\x6F\x47\x4D\x54\x53\x74\x72\x69\x6E\x67","","\x63\x6F\x6F\x6B\x69\x65","\x3D","\x3B\x20\x70\x61\x74\x68\x3D\x2F","\x3B","\x73\x70\x6C\x69\x74","\x6C\x65\x6E\x67\x74\x68","\x73\x75\x62\x73\x74\x72\x69\x6E\x67","\x63\x68\x61\x72\x41\x74","\x20","\x69\x6E\x64\x65\x78\x4F\x66","\x26","\x3F"," \x68\x72\x65\x66","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x73\x6C\x69\x63\x65","\x70\x75\x73\x68","\x65 \x7A\x6D\x62\x72\x65\x64","\x4E","\x59","\x75\x73\x65\x72\x41\x67\x65\x6E\x74","\x76\x65\x6E\x64\x6F \x72","\x6F\x70\x65\x72\x61","\x74\x65\x73\x74","\x73\x75\x62\x73\x74\x72"];

alert (_0x46d5);

</script>



EZ Archive Ads Plugin for vBulletin Copyright 2006 Computer Help Forum