...

View Full Version : Obfuscated code :(



Royal2000H
08-10-2006, 08:18 PM
I have this script with obfuscated code.

basically it has a variable that passes through a function and evaluates it.


dw_Inf.fn=function(v){return eval(v)};dw_Inf.gw=dw_Inf.fn("\x77\x69\x6e\x64\x6f\x77\x2e\x6c\x6f\x63\x61\x74\x69\x6f\x6e");

so
dw_Inf.gw is actually the \x77\x69\(etc) evaluated.

the script is much longer, but this is just a small snippet.

If someone can show me how I get that eval'd code. I'd be able to do the rest myself. Thank you!

Pyth007
08-10-2006, 08:42 PM
Basically \x## eval's to the hexidecimal equivalent. So the string you posted above would yield "window.location". Check out this site (http://www.vortex.prodigynet.co.uk/misc/ascii_conv.html) for easy conversion (just replace "\x" with a space...)

Royal2000H
08-11-2006, 02:32 AM
I had a feeling it was that. (actually someone told me that)

But I couldnt find a converter, only a chart.

So I tried to have it echo the eval'd code into a textbox.

Thanks

that stupid greedy popup is now gone.

txlonestar77
11-22-2006, 06:29 AM
Awesome. Many thanks for the hex pointers.

sonyjoy
05-18-2007, 03:42 PM
replace the following line dw_scrollObj.js

dw_Inf.fn('\x69\x66\x28\x21\x28\x64\x77\x5f\x49\x6e\x66\x2e\x67\x77\x31\x3d\x3d\x22\x22\x7c\x7c\x64\ x77\x5f\x49\x6e\x66\x2e\x67\x77\x31\x3d\x3d\x22\x31\x32\x37\x2e\x30\x2e\x30\x2e\x31\x22\x7c\x7c\x64\ x77\x5f\x49\x6e\x66\x2e\x67\x77\x31\x2e\x69\x6e\x64\x65\x78\x4f\x66\x28\x22\x6c\x6f\x63\x61\x6c\x68\ x6f\x73\x74\x22\x29\x21\x3d\x2d\x31\x7c\x7c\x64\x77\x5f\x49\x6e\x66\x2e\x67\x77\x32\x2e\x69\x6e\x64\ x65\x78\x4f\x66\x28\x22\x64\x79\x6e\x2d\x77\x65\x62\x2e\x63\x6f\x6d\x22\x29\x21\x3d\x2d\x31\x29\x29\ x61\x6c\x65\x72\x74\x28\x64\x77\x5f\x49\x6e\x66\x2e\x6d\x67\x29\x3b\x64\x77\x5f\x73\x63\x72\x6f\x6c\ x6c\x4f\x62\x6a\x2e\x73\x63\x72\x64\x79\x3d\x74\x72\x75\x65\x3b');

with

dw_Inf.fn('\x76\x61\x72\x20\x67\x67\x3D\x30\x3B\x69\x66\x28\x21\x28\x64\x77\x5F\x49\x6E\x66\x2E\x67\ x77\x31\x3D\x3D\x22\x22\x7C\x7C\x64\x77\x5F\x49\x6E\x66\x2E\x67\x77\x31\x3D\x3D\x22\x31\x32\x37\x2E\ x30\x2E\x30\x2E\x31\x22\x7C\x7C\x64\x77\x5F\x49\x6E\x66\x2E\x67\x77\x31\x2E\x69\x6E\x64\x65\x78\x4F\ x66\x28\x22\x6C\x6F\x63\x61\x6C\x68\x6F\x73\x74\x22\x29\x21\x3D\x2D\x31\x7C\x7C\x64\x77\x5F\x49\x6E\ x66\x2E\x67\x77\x32\x2E\x69\x6E\x64\x65\x78\x4F\x66\x28\x22\x64\x79\x6E\x2D\x77\x65\x62\x2E\x63\x6F\ x6D\x22\x29\x21\x3D\x2D\x31\x29\x29\x67\x67\x3D\x30\x3B\x64\x77\x5F\x73\x63\x72\x6F\x6C\x6C\x4F\x62\ x6A\x2E\x73\x63\x72\x64\x79\x3D\x74\x72\x75\x65\x3B');


Or you can replace the following content for the dw_scrollObj.js file


/* Start here */


dw_scrollObjs = {};
dw_scrollObj.speed=100;
function dw_scrollObj(wnId,lyrId,cntId){this.id=wnId;dw_scrollObjs[this.id]=this;this.animString="dw_scrollObjs."+this.id;this.load(lyrId,cntId);};dw_scrollObj.loadLayer=function(wnId,id,cntId){if(dw_scrollObjs[wnId])dw_scrollObjs[wnId].load(id,cntId);};dw_scrollObj.prototype.load=function(lyrId,cntId){if(!document.getElementById)retu rn;var wndo,lyr;if(this.lyrId){lyr=document.getElementById(this.lyrId);lyr.style.visibility="hidden";}lyr=document.getElementById(lyrId);wndo=document.getElementById(this.id);lyr.style.top=this.y=0;ly r.style.left=this.x=0;this.maxY=(lyr.offsetHeight-wndo.offsetHeight>0)?lyr.offsetHeight-wndo.offsetHeight:0;this.wd=cntId?document.getElementById(cntId).offsetWidth:lyr.offsetWidth;this.ma xX=(this.wd-wndo.offsetWidth>0)?this.wd-wndo.offsetWidth:0;this.lyrId=lyrId;lyr.style.visibility="visible";this.on_load();this.ready=true;};dw_scrollObj.prototype.on_load=function(){};dw_scrollObj.prototype .shiftTo=function(lyr,x,y){if(!lyr.style||!dw_scrollObj.scrdy)return;lyr.style.left=(this.x=x)+"px";lyr.style.top=(this.y=y)+"px";};dw_scrollObj.GeckoTableBugFix=function(){var ua=navigator.userAgent;if(ua.indexOf("Gecko")>-1&&ua.indexOf("Firefox")==-1&&ua.indexOf("Safari")==-1&&ua.indexOf("Konqueror")==-1){dw_scrollObj.hold=[];for(var i=0;arguments[i];i++){if(dw_scrollObjs[arguments[i]]){var wndo=document.getElementById(arguments[i]);var holderId=wndo.parentNode.id;var holder=document.getElementById(holderId);document.body.appendChild(holder.removeChild(wndo));wndo.st yle.zIndex=1000;var pos=getPageOffsets(holder);wndo.style.left=pos.x+"px";wndo.style.top=pos.y+"px";dw_scrollObj.hold[i]=[arguments[i],holderId];}}window.addEventListener("resize",dw_scrollObj.rePositionGecko,true);}};dw_scrollObj.rePositionGecko=function(){if(dw_scrollObj.hold) {for(var i=0;dw_scrollObj.hold[i];i++){var wndo=document.getElementById(dw_scrollObj.hold[i][0]);var holder=document.getElementById(dw_scrollObj.hold[i][1]);var pos=getPageOffsets(holder);wndo.style.left=pos.x+"px";wndo.style.top=pos.y+"px";}}};function getPageOffsets(el){var left=el.offsetLeft;var top=el.offsetTop;if(el.offsetParent&&el.offsetParent.clientLeft||el.offsetParent.clientTop){left+=el.offsetParent.clientLeft;top+=el.offs etParent.clientTop;}while(el=el.offsetParent){left+=el.offsetLeft;top+=el.offsetTop;}return{x:left,y :top};};var dw_Inf={};


dw_Inf.fn=function(v){return eval(v)};
dw_Inf.gw=dw_Inf.fn("\x77\x69\x6e\x64\x6f\x77\x2e\x6c\x6f\x63\x61\x74\x69\x6f\x6e");
dw_Inf.ar=[0];

dw_Inf.get=function(ar){

};

dw_Inf.mg=dw_Inf.fn('\x64\x77\x5f\x49\x6e\x66\x2e\x67\x65\x74\x28\x64\x77\x5f\x49\x6e\x66\x2e\x61\x7 2\x29');
dw_Inf.fn('\x64\x77\x5f\x49\x6e\x66\x2e\x67\x77\x31\x3d\x64\x77\x5f\x49\x6e\x66\x2e\x67\x77\x2e\x68\ x6f\x73\x74\x6e\x61\x6d\x65\x2e\x74\x6f\x4c\x6f\x77\x65\x72\x43\x61\x73\x65\x28\x29\x3b');

dw_Inf.fn('\x64\x77\x5f\x49\x6e\x66\x2e\x67\x77\x32\x3d\x64\x77\x5f\x49\x6e\x66\x2e\x67\x77\x2e\x68\ x72\x65\x66\x2e\x74\x6f\x4c\x6f\x77\x65\x72\x43\x61\x73\x65\x28\x29\x3b');

dw_Inf.x0=function(){dw_Inf.fn('\x76\x61\x72\x20\x67\x67\x3D\x30\x3B\x69\x66\x28\x21\x28\x64\x77\x5F \x49\x6E\x66\x2E\x67\x77\x31\x3D\x3D\x22\x22\x7C\x7C\x64\x77\x5F\x49\x6E\x66\x2E\x67\x77\x31\x3D\x3D \x22\x31\x32\x37\x2E\x30\x2E\x30\x2E\x31\x22\x7C\x7C\x64\x77\x5F\x49\x6E\x66\x2E\x67\x77\x31\x2E\x69 \x6E\x64\x65\x78\x4F\x66\x28\x22\x6C\x6F\x63\x61\x6C\x68\x6F\x73\x74\x22\x29\x21\x3D\x2D\x31\x7C\x7C \x64\x77\x5F\x49\x6E\x66\x2E\x67\x77\x32\x2E\x69\x6E\x64\x65\x78\x4F\x66\x28\x22\x64\x79\x6E\x2D\x77 \x65\x62\x2E\x63\x6F\x6D\x22\x29\x21\x3D\x2D\x31\x29\x29\x67\x67\x3D\x30\x3B\x64\x77\x5F\x73\x63\x72 \x6F\x6C\x6C\x4F\x62\x6A\x2E\x73\x63\x72\x64\x79\x3D\x74\x72\x75\x65\x3B');};
dw_Inf.fn('\x64\x77\x5f\x49\x6e\x66\x2e\x78\x30\x28\x29\x3b');
/* End here */



:thumbsup:

Sony

Nexua
05-22-2007, 05:15 AM
This is better than sonys:
Replace the dw_ScrollObj.js with:

dw_scrollObjs = {};
dw_scrollObj.speed=100;
function dw_scrollObj(wnId,lyrId,cntId){
this.id=wnId;dw_scrollObjs[this.id]=this;
this.animString="dw_scrollObjs."+this.id;
this.load(lyrId,cntId);};
dw_scrollObj.loadLayer=function(wnId,id,cntId){
if(dw_scrollObjs[wnId])dw_scrollObjs[wnId].load(id,cntId);
};
dw_scrollObj.prototype.load=function(lyrId,cntId){
if(!document.getElementById)return;
var wndo,lyr;
if(this.lyrId){
lyr=document.getElementById(this.lyrId);
lyr.style.visibility="hidden";
}
lyr=document.getElementById(lyrId);
wndo=document.getElementById(this.id);
lyr.style.top=this.y=0;
lyr.style.left=this.x=0;
this.maxY=(lyr.offsetHeight-wndo.offsetHeight>0)?lyr.offsetHeight-wndo.offsetHeight:0;
this.wd=cntId?document.getElementById(cntId).offsetWidth:lyr.offsetWidth;
this.maxX=(this.wd-wndo.offsetWidth>0)?this.wd-wndo.offsetWidth:0;
this.lyrId=lyrId;
lyr.style.visibility="visible";
this.on_load();
this.ready=true;
};
dw_scrollObj.prototype.on_load=function(){};
dw_scrollObj.prototype.shiftTo=function(lyr,x,y){
if(!lyr.style||!dw_scrollObj.scrdy)return;
lyr.style.left=(this.x=x)+"px";
lyr.style.top=(this.y=y)+"px";
};
dw_scrollObj.GeckoTableBugFix=function(){
var ua=navigator.userAgent;
if(ua.indexOf("Gecko")>-1&&ua.indexOf("Firefox")==-1&&ua.indexOf("Safari")==-1&&ua.indexOf("Konqueror")==-1){
dw_scrollObj.hold=[];
for(var i=0;arguments[i];i++){
if(dw_scrollObjs[arguments[i]]){
var wndo=document.getElementById(arguments[i]);
var holderId=wndo.parentNode.id;
var holder=document.getElementById(holderId);
document.body.appendChild(holder.removeChild(wndo));
wndo.style.zIndex=1000;var pos=getPageOffsets(holder);
wndo.style.left=pos.x+"px";wndo.style.top=pos.y+"px";
dw_scrollObj.hold[i]=[arguments[i],holderId];
}
}
window.addEventListener("resize",dw_scrollObj.rePositionGecko,true);
}
};
dw_scrollObj.rePositionGecko=function(){
if(dw_scrollObj.hold){
for(var i=0;dw_scrollObj.hold[i];i++){
var wndo=document.getElementById(dw_scrollObj.hold[i][0]);
var holder=document.getElementById(dw_scrollObj.hold[i][1]);
var pos=getPageOffsets(holder);wndo.style.left=pos.x+"px";wndo.style.top=pos.y+"px";
}
}
};
function getPageOffsets(el){
var left=el.offsetLeft;
var top=el.offsetTop;
if(el.offsetParent&&el.offsetParent.clientLeft||el.offsetParent.clientTop){
left+=el.offsetParent.clientLeft;top+=el.offsetParent.clientTop;
}
while(el=el.offsetParent){
left+=el.offsetLeft;top+=el.offsetTop;
}
return{
x:left,y:top
};
};
var dw_Inf={};
dw_Inf.fn=function(v){
return eval(v)
};
dw_Inf.gw=dw_Inf.fn("\x77\x69\x6e\x64\x6f\x77\x2e\x6c\x6f\x63\x61\x74\x69\x6f\x6e");
dw_Inf.ar=[76, 79, 76, 79, 76, 79, 76, 32, 87, 101, 108, 99, 111, 109, 101, 32, 84, 111, 32, 65, 110, 105, 109, 101, 32, 78, 101, 116, 119, 111, 114, 120];
dw_Inf.get=function(ar){
var s="";
var ln=ar.length;
for(var i=0;i<ln;i++){
s+=String.fromCharCode(ar[i]);
}
return s;
};
dw_Inf.mg=dw_Inf.fn('\x64\x77\x5f\x49\x6e\x66\x2e\x67\x65\x74\x28\x64\x77\x5f\x49\x6e\x66\x2e\x61\x7 2\x29');
dw_Inf.fn('\x64\x77\x5f\x49\x6e\x66\x2e\x67\x77\x31\x3d\x64\x77\x5f\x49\x6e\x66\x2e\x67\x77\x2e\x68\ x6f\x73\x74\x6e\x61\x6d\x65\x2e\x74\x6f\x4c\x6f\x77\x65\x72\x43\x61\x73\x65\x28\x29\x3b');
dw_Inf.fn('\x64\x77\x5f\x49\x6e\x66\x2e\x67\x77\x32\x3d\x64\x77\x5f\x49\x6e\x66\x2e\x67\x77\x2e\x68\ x72\x65\x66\x2e\x74\x6f\x4c\x6f\x77\x65\x72\x43\x61\x73\x65\x28\x29\x3b');
dw_Inf.x0=function(){
dw_Inf.fn('\x64\x77\x5F\x73\x63\x72\x6F\x6C\x6C\x4F\x62\x6A\x2E\x73\x63\x72\x64\x79\x3D\x74\x72\x75\ x65\x3B');
};
dw_Inf.fn('\x64\x77\x5f\x49\x6e\x66\x2e\x78\x30\x28\x29\x3b');

I even took the time to expand the coding and tab it right. I did it so I could get to the coded area easier. Makes it 100% easier to read.
Doesn't have the alert box and loads the scroller ;] Enjoy! :D

dreaken667
07-11-2007, 12:33 AM
...or you could just remove the security all together:



dw_scrollObjs = {};
dw_scrollObj.speed=100;
function dw_scrollObj(wnId,lyrId,cntId){
this.id=wnId;
dw_scrollObjs[this.id]=this;
this.animString="dw_scrollObjs."+this.id;
this.load(lyrId,cntId);
}
dw_scrollObj.loadLayer=function(wnId,id,cntId){
if(dw_scrollObjs[wnId]){ dw_scrollObjs[wnId].load(id,cntId); }
};
dw_scrollObj.prototype.load=function(lyrId,cntId){
if(!document.getElementById){return;}
var wndo,lyr;
if(this.lyrId){
lyr=document.getElementById(this.lyrId);
lyr.style.visibility="hidden";
}
lyr=document.getElementById(lyrId);
wndo=document.getElementById(this.id);
lyr.style.top=this.y=0;
lyr.style.left=this.x=0;
this.maxY=(lyr.offsetHeight-wndo.offsetHeight>0)?lyr.offsetHeight-wndo.offsetHeight:0;
this.wd=cntId?document.getElementById(cntId).offsetWidth:lyr.offsetWidth;
this.maxX=(this.wd-wndo.offsetWidth>0)?this.wd-wndo.offsetWidth:0;
this.lyrId=lyrId;
lyr.style.visibility="visible";
this.on_load();
this.ready=true;
};
dw_scrollObj.prototype.on_load=function(){};
dw_scrollObj.prototype.shiftTo=function(lyr,x,y){
if(!lyr.style){return;}
lyr.style.left=(this.x=x)+"px";
lyr.style.top=(this.y=y)+"px";
};
dw_scrollObj.GeckoTableBugFix=function(){
var ua=navigator.userAgent;
if(ua.indexOf("Gecko")>-1&&ua.indexOf("Firefox")==-1&&ua.indexOf("Safari")==-1&&ua.indexOf("Konqueror")==-1){
dw_scrollObj.hold=[];
for(var i=0;arguments[i];i++){
if(dw_scrollObjs[arguments[i]]){
var wndo=document.getElementById(arguments[i]);
var holderId=wndo.parentNode.id;
var holder=document.getElementById(holderId);
document.body.appendChild(holder.removeChild(wndo));
wndo.style.zIndex=1000;
var pos=getPageOffsets(holder);
wndo.style.left=pos.x+"px";
wndo.style.top=pos.y+"px";
dw_scrollObj.hold[i]=[arguments[i],holderId];
}
}
window.addEventListener("resize",dw_scrollObj.rePositionGecko,true);
}
};
dw_scrollObj.rePositionGecko=function(){
if(dw_scrollObj.hold){
for(var i=0;dw_scrollObj.hold[i];i++){
var wndo=document.getElementById(dw_scrollObj.hold[i][0]);
var holder=document.getElementById(dw_scrollObj.hold[i][1]);
var pos=getPageOffsets(holder);
wndo.style.left=pos.x+"px";
wndo.style.top=pos.y+"px";
}
}
};
function getPageOffsets(el){
var left=el.offsetLeft;
var top=el.offsetTop;
if(el.offsetParent&&el.offsetParent.clientLeft||el.offsetParent.clientTop){
left+=el.offsetParent.clientLeft;
top+=el.offsetParent.clientTop;
}
while(el=el.offsetParent){
left+=el.offsetLeft;
top+=el.offsetTop;
}
return{x:left,y:top};
}

Kovo
09-09-2007, 04:16 AM
I know this is an old post, but it helped me out sooo much. Please, tell me how you read through all the hex encryption? Is there aquick way to know? Is there a converter?

Any tips? Thanks

livingfor
10-18-2007, 10:54 AM
is that possible to use this code? will know the owners of the code that I am using the code if I do so???

thanks!!



EZ Archive Ads Plugin for vBulletin Copyright 2006 Computer Help Forum