What type of js coding is this ???

[jeddi]

Hi,

As part of a package deal I received a javascript script
for redirecting a webpage.

Now I already have simple redirection but wanted to see
how this one did the redirection.

But it starts off by defining an array with strange sets of characters.

Is this hexadecimal or something ?

Can I convert it into a more readable and understandable form ?


var _0x46d5=["\x67\x65\x74\x54\x69\x6D\x65","\x73\x65\x74\x54\x69\x6D\x65","\x3B\x20\x65\x78\x70\x69\x72\x65\x73\ x3D","\x74\x6F\x47\x4D\x54\x53\x74\x72\x69\x6E\x67","","\x63\x6F\x6F\x6B\x69\x65","\x3D","\x3B\x20\x 70\x61\x74\x68\x3D\x2F","\x3B","\x73\x70\x6C\x69\x74","\x6C\x65\x6E\x67\x74\x68","\x73\x75\x62\x73\x 74\x72\x69\x6E\x67","\x63\x68\x61\x72\x41\x74","\x20","\x69\x6E\x64\x65\x78\x4F\x66","\x26","\x3F"," \x68\x72\x65\x66","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x73\x6C\x69\x63\x65","\x70\x75\x73\x68","\x65 \x7A\x6D\x62\x72\x65\x64","\x4E","\x59","\x75\x73\x65\x72\x41\x67\x65\x6E\x74","\x76\x65\x6E\x64\x6F \x72","\x6F\x70\x65\x72\x61","\x74\x65\x73\x74","\x73\x75\x62\x73\x74\x72"];

function createCookie(_0x810ex2,_0x810ex3,_0x810ex4,_0x810ex5){

...

the script continues using the array elements above.

Thanks for any insights.


.

[devnull69]

This is some kind of obfuscation ... it is a simple list of ASCII values in Hex. If you inspect this in e.g. Firebug you will get this:

["getTime","setTime","; expires x3D","toGMTString","","cookie","=","; path=/",";","split","length","substring","charAt"," ","indexOf","&","?"," href","location","slice","push","e zmbred","N","Y","userAgent","vendo r","opera","test","substr"]

[jeddi]

Thanks for your help

[mjy]

The expressions like \x67 are simply escape sequences, which you can embed in a string to encode characters that would be problematic to type in (or in this case, to obfuscate the text). The following are other common escape sequences (taken from my book "JavaScript: Just the Basics"):
\t tab
\n newline
\" double quote
\' single quote
\\ backslash
\uhhhh Any character in the Unicode character set. hhhh is the four-digit hexadecimal code for the character.

To see the actual contents of the string, you can just display it using alert (I had to delete a few extraneous space characters):

<script>

var _0x46d5=["\x67\x65\x74\x54\x69\x6D\x65","\x73\x65\x74\x54\x69\x6D\x65","\x3B\x20\x65\x78\x70\x69\x72\x65\x73\ x3D","\x74\x6F\x47\x4D\x54\x53\x74\x72\x69\x6E\x67","","\x63\x6F\x6F\x6B\x69\x65","\x3D","\x3B\x20\x70\x61\x74\x68\x3D\x2F","\x3B","\x73\x70\x6C\x69\x74","\x6C\x65\x6E\x67\x74\x68","\x73\x75\x62\x73\x74\x72\x69\x6E\x67","\x63\x68\x61\x72\x41\x74","\x20","\x69\x6E\x64\x65\x78\x4F\x66","\x26","\x3F"," \x68\x72\x65\x66","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x73\x6C\x69\x63\x65","\x70\x75\x73\x68","\x65 \x7A\x6D\x62\x72\x65\x64","\x4E","\x59","\x75\x73\x65\x72\x41\x67\x65\x6E\x74","\x76\x65\x6E\x64\x6F \x72","\x6F\x70\x65\x72\x61","\x74\x65\x73\x74","\x73\x75\x62\x73\x74\x72"];

alert (_0x46d5);

</script>