JavaScript Deobfuscator defeated ?

The forum for all discussion related to JavaScript Deobfuscator extension. It might not be as busy as the other forums but don't hesitate to come in and ask your question.

JavaScript Deobfuscator defeated ?

Postby Noggie » Thu Aug 13, 2015 2:53 am

Seems to be yet another popunder script.

URL:
Code: Select all
https://www (dot) monova (dot) org/


Specific javascript code:
Code: Select all
var k4C = {
    'Z': (function() {
        var B = {}
          , K = function(j, L) {
            var M = L & ((40.,
            3.6E1) >= 0x18 ? (0x178,
            0xffff) : (0x188,
            74));
            var y = L - M;
            return ((y * j | (0x10E < (3.38E2,
            1.205E3) ? (1.1440E3,
            0) : 1.33E3 < (43.,
            25) ? 118.2E1 : (51.0E1,
            87.))) + (M * j | ((49,
            0x1E5) > 0x4A ? (1.078E3,
            0) : (131.,
            0x14D)))) | (76.5E1 > (101.,
            13.17E2) ? 25 : (0x104,
            73.) > (0x20B,
            0x5F) ? (0x227,
            0x172) : 0x1B <= (0x16D,
            145) ? (0x204,
            0) : (0xD8,
            65.4E1));
        }
          , N = function(j, L, M) {
            if (B[M] !== undefined) {
                return B[M];
            }
            var y = ((118.,
            0x170) <= (0x1A9,
            43.) ? 'V' : 0x1D8 <= (116.,
            5.520E2) ? (11.52E2,
            0xcc9e2d51) : 0 >= (24.3E1,
            14.780E2) ? "V" : (0x211,
            0x1DF))
              , g = ((0x11D,
            0x1F0) > (2.95E2,
            0x209) ? (0x4,
            1024) : (0x1CE,
            15.) > 0x182 ? (0x105,
            1024) : (0x1AE,
            31.0E1) <= 1.3960E3 ? (1.7E2,
            0x1b873593) : (0x37,
            78));
            var C = M;
            var u = L & ~((87,
            1.74E2) <= (133.,
            66) ? 'd' : 0x155 >= (109,
            0x2D) ? (137.,
            0x3) : (0xDC,
            62.) > (70.,
            38.0E1) ? (8.16E2,
            0x1DD) : (23.,
            0x196));
            for (var F = (1.168E3 <= (0x77,
            1.315E3) ? (30,
            0) : (28.,
            0x169)); F < u; F += ((0xA7,
            133.) >= (1.288E3,
            124.30E1) ? 123. : 30.20E1 <= (7.58E2,
            6.23E2) ? (10.68E2,
            4) : (1.0090E3,
            48.))) {
                var Y = (j[("char" + ((98.,
                0x76) >= 52 ? (3.84E2,
                "C") : (10.,
                134.) < (104.,
                23) ? "b" : 0x33 >= (0x1E3,
                98.80E1) ? (124,
                'b') : (143.,
                144.)) + ((4.07E2,
                122.) < (14.620E2,
                9.74E2) ? (141,
                "o") : 3.5E1 > (0x1D2,
                107.) ? 1 : (7.810E2,
                49.) >= (14.20E1,
                49.2E1) ? (93,
                1) : (92,
                0x178)) + (67. >= (0xB4,
                86) ? 'Y' : (43.6E1,
                95.) >= (60.,
                42) ? (0xB8,
                "d") : (4.18E2,
                0x81) > 84.60E1 ? (96.,
                'Y') : (1.880E2,
                60)) + ((58.,
                0xB8) >= (0x64,
                6.60E1) ? (1.433E3,
                "e") : (9.38E2,
                86)) + "A" + ((104.,
                0x18E) >= 32.5E1 ? (40,
                "t") : (92,
                74)))](F) & ((0x5A,
                0x6F) < (13.24E2,
                107.) ? (0x28,
                0) : (14,
                3) <= 0x199 ? (33.2E1,
                0xff) : (0xD5,
                36))) | ((j[(((0x177,
                144.) >= 139. ? (1.016E3,
                "c") : (125.30E1,
                18)) + ((34,
                85.) <= 58. ? 0x2A : 101 >= (6.44E2,
                1.247E3) ? (1.216E3,
                "") : (100.,
                0x7F) < (0x236,
                4.05E2) ? (51.,
                "h") : (86.0E1,
                40.)) + ((16,
                0x72) <= (141.,
                0x185) ? (0x208,
                "a") : (3.33E2,
                0x18A)) + "rC" + (13.19E2 > (134.,
                10.47E2) ? (0x10,
                "o") : (60.6E1,
                69.60E1) <= (0x251,
                63.0E1) ? (0x115,
                1024) : (2.73E2,
                0xBF)) + "de" + (0x1D7 >= (10.8E1,
                37.6E1) ? (0x16D,
                "A") : (0x6B,
                2.52E2)) + "t")](F + ((6.7E2,
                33) > (9.11E2,
                0x16B) ? (0x5F,
                0xB0) : (63.,
                0x6B) < 137. ? (16,
                1) : (5.89E2,
                5.83E2))) & (97.30E1 > (10,
                7.19E2) ? (1.41E3,
                0xff) : (2.1E1,
                0x244) <= 37 ? 0 : (8.06E2,
                129))) << ((94,
                44) < 0x10E ? (130,
                8) : (0x5A,
                48))) | ((j[(((67.,
                0x172) < 123 ? (18.8E1,
                1024) : (98.9E1,
                1.48E2) >= 0x4 ? (0x1AB,
                "c") : 87 <= (0x176,
                7.30E1) ? "F" : (0x173,
                111)) + "harC" + "od" + "eAt")](F + 2) & ((138.,
                0x210) >= 11 ? (129,
                0xff) : (0x4D,
                0x8A) >= 7.03E2 ? 0x172 : (0x1,
                138))) << ((0x174,
                70.) > 9. ? (134,
                16) : (0x1B9,
                4.43E2))) | ((j[(((108,
                0x1BB) > (9,
                1.20E1) ? (1.6E1,
                "c") : (0x3E,
                101.60E1)) + "harC" + "od" + ((0x184,
                67) > 0x22 ? (0x15A,
                "e") : (1.22E2,
                80.)) + "At")](F + (139 < (11.73E2,
                0x83) ? (0x1C9,
                43) : (149,
                30.8E1) <= (15.,
                128.8E1) ? (123.,
                3) : (0x1F0,
                0x1E3))) & ((0x239,
                100) > 49 ? (0x111,
                0xff) : (4.01E2,
                66))) << (51.5E1 < (123.,
                4.03E2) ? 130 : (0xA8,
                0x243) >= 0xD0 ? (12.76E2,
                24) : (0x1C7,
                1.029E3)));
                Y = K(Y, y);
                Y = ((Y & ((0x89,
                127) <= 0xCE ? (0x4A,
                0x1ffff) : 0xE >= (0x1D4,
                0xAB) ? (50,
                111.) : (67.,
                61.))) << ((0x20B,
                115) < 147.8E1 ? (78,
                15) : 0x23C <= (0x125,
                1.99E2) ? (16,
                67.0E1) : (89,
                5.97E2))) | (Y >>> ((129,
                65) > 61 ? (7.80E1,
                17) : (59,
                0x189)));
                Y = K(Y, g);
                C ^= Y;
                C = ((C & ((28.5E1,
                0x84) > 2.40E1 ? (0x161,
                0x7ffff) : (8.0E1,
                22.40E1))) << 13) | (C >>> ((36.2E1,
                28.) > 0x2 ? (86.0E1,
                19) : (0x1FA,
                100)));
                C = (C * ((26.8E1,
                107) < 12. ? 'E' : (1.84E2,
                4.810E2) >= (0x102,
                135.) ? (92.9E1,
                5) : (71,
                4.310E2)) + ((0xCA,
                0x138) > 108. ? (0x224,
                0xe6546b64) : (3.,
                12.8E1))) | 0;
            }
            Y = (55.30E1 >= (0x115,
            13.4E2) ? 0x16A : (80.,
            79.60E1) >= 12.70E1 ? (0x186,
            0) : (0x249,
            0x233));
            switch (L % (141.9E1 > (1.475E3,
            36) ? (1.137E3,
            4) : (0x37,
            137))) {
            case ((97.5E1,
            1.068E3) > 0x247 ? (0x1D5,
            3) : (59.0E1,
            6.770E2)):
                Y = (j[("charC" + (80.10E1 > (3.23E2,
                0x1F5) ? (0x32,
                "o") : (116,
                11.) >= (9.70E1,
                0xE9) ? 13. : (12.530E2,
                8.52E2) < 0xAC ? 0x16B : (58.,
                0x220)) + "de" + "A" + (99.0E1 < (2.95E2,
                59.6E1) ? 1.6E1 : (0x8F,
                100.5E1) <= 1.243E3 ? (147.,
                "t") : (8.64E2,
                0x12) > (12.01E2,
                0x257) ? 1 : (2,
                50)))](u + ((100,
                7) < 64.7E1 ? (7.63E2,
                2) : (0E0,
                4.33E2))) & (0x237 >= (49.30E1,
                32.) ? (14.,
                0xff) : 8 > (0x37,
                14.60E1) ? (113.60E1,
                0) : (0x16F,
                0x89))) << (0xC3 >= (0x1C6,
                81.5E1) ? 1024 : 0x1EC < (0x137,
                10.540E2) ? (138.1E1,
                16) : 11.85E2 <= (112.9E1,
                0xBF) ? (99,
                148.5E1) : (78,
                0x1B5));
            case 2:
                Y |= (j[((9.59E2 >= (52.30E1,
                0x1B0) ? (109.,
                "c") : (5.560E2,
                102.)) + (65. < (1.099E3,
                1.02E2) ? (0x47,
                "h") : (135,
                145.)) + "ar" + "Co" + ((78,
                1.0130E3) >= (0x64,
                2.59E2) ? (1.58E2,
                "d") : (0x6B,
                0x91)) + "eAt")](u + ((114.,
                1.07E2) < 0x5D ? (38,
                0xEC) : (54.1E1,
                122.) >= 130.5E1 ? 'O' : (0x1AA,
                136) > 98 ? (66,
                1) : (14.,
                1.216E3))) & ((10.,
                107) >= 11. ? (0xCD,
                0xff) : (46,
                0xE7))) << ((10.200E2,
                72.) >= (0x79,
                0x21C) ? 'E' : 0x3E < (7.45E2,
                8.72E2) ? (0x1FA,
                8) : (1.377E3,
                8.99E2));
            case 1:
                Y |= (j[("c" + "ha" + ((26.,
                138.) <= (63.,
                32.80E1) ? (0x153,
                "r") : (114.,
                0x1C1)) + "C" + "o" + ((59,
                1.213E3) >= (91.30E1,
                57) ? (0x2C,
                "d") : (123,
                115) > (87.,
                128) ? (0x1A9,
                'F') : (7.60E1,
                5.59E2) > (0x23E,
                10.28E2) ? (108,
                0x1F4) : (0x24E,
                105.9E1)) + (8.05E2 < (0xEF,
                5.10E1) ? 1.423E3 : 1.1440E3 <= (116,
                14.74E2) ? (10.9E1,
                "e") : (0x7,
                67.)) + "A" + "t")](u) & (67. > (5.69E2,
                4) ? (36,
                0xff) : (7.03E2,
                66.) >= (45.,
                113.) ? (0x61,
                0xCA) : (19.,
                149.)));
                Y = K(Y, y);
                Y = ((Y & ((1.484E3,
                90.0E1) > (40.,
                0x252) ? (118,
                0x1ffff) : (0xE7,
                57.1E1))) << ((0x157,
                145.) >= (80,
                0x1A5) ? (7.78E2,
                84.0E1) : (17.,
                7.15E2) >= (11,
                16.8E1) ? (111,
                15) : (0x1E4,
                91.5E1) <= (9.4E2,
                3.820E2) ? 34 : (143.,
                68))) | (Y >>> 17);
                Y = K(Y, g);
                C ^= Y;
            }
            C ^= L;
            C ^= C >>> (86. >= (0xF1,
            0) ? (72.0E1,
            16) : (0x52,
            5.30E1));
            C = K(C, (147.4E1 >= (0xDE,
            0x1BE) ? (86.,
            0x85ebca6b) : 5.0E1 >= (14.030E2,
            0xF5) ? (144.,
            'X') : (0x12E,
            5.3E2) < 26.70E1 ? 0xE0 : (40.,
            0x25)));
            C ^= C >>> ((22.0E1,
            18.) >= (86.,
            0x111) ? 'q' : 0xB8 <= (138.20E1,
            13.040E2) ? (0x227,
            13) : 3.94E2 < (27,
            0xC7) ? "q" : (14.60E1,
            49.));
            C = K(C, 0xc2b2ae35);
            C ^= C >>> ((107.,
            0xDB) > (9.3E1,
            71.) ? (96,
            16) : (0xB8,
            41.));
            B[M] = C;
            return C;
        }
        ;
        return {
            H: K,
            r: N
        };
    }
    )(),
    'u8': "o",
    'c1': "od",
    'd1': 0,
    'o1': "e",
    'u1': "C",
    'l1': "d",
    'C8': "c",
    'n1': 2,
    'o': "h",
    'y1': "t",
    'B1': "a",
    'V1': 1,
    'S1': "r"
};
ixesb = function() {
    var f = (0xF7 <= (0x104,
    10.60E1) ? 40.6E1 : (116.,
    0x210) >= (108,
    0x1C2) ? (75,
    "g") : (0x23A,
    100.) > (48.2E1,
    108.) ? 57. : (5.60E1,
    5.72E2))
      , w = "rin"
      , l = (126 <= (6.38E2,
    1.33E2) ? (1.151E3,
    "S") : 121. > (95,
    140) ? 1024 : (64,
    140.) < 26. ? (34,
    0x122) : (54.40E1,
    0x24F))
      , W = "to"
      , E = "eO"
      , s = (135 < (100,
    1.082E3) ? (121,
    "u") : (0xCD,
    9.01E2) <= 12. ? (0xBF,
    1) : (58.,
    135.))
      , T = (0x132 <= (0x4B,
    0x181) ? (61,
    "l") : (77.,
    0x8))
      , q = ((0x124,
    0xE5) < 8.38E2 ? (9.21E2,
    "v") : (97.,
    0xCE))
      , i = (1.53E2 < (0x1E,
    5.46E2) ? (6.88E2,
    5203994) : (6.26E2,
    0x13B))
      , k = (0x73 <= (4.310E2,
    58.5E1) ? (14.14E2,
    4925010) : (0x38,
    0x12C) <= 65 ? (45.,
    "") : (0x1D4,
    0x2))
      , x = (4.3E1 < (0x5F,
    0x165) ? (135.20E1,
    191170054) : (0x72,
    13.5E1))
      , e = ((112.30E1,
    1.315E3) > 7E0 ? (126.10E1,
    519691726) : (85.7E1,
    0x221) > (0x1A9,
    0x230) ? (9.68E2,
    0x4D) : (0x20B,
    9.20E1))
      , V = ((1.428E3,
    0x61) > (0x1C,
    76.3E1) ? (0x66,
    0x189) : (37.,
    0xC8) <= (41.,
    11.25E2) ? (0x23A,
    "f") : (0x1B2,
    65.5E1))
      , U = (0x232 < (0x1F1,
    7.62E2) ? (76.10E1,
    "n") : (0x218,
    0x1F2))
      , Q = "b";
    function P(F) {
        var Y = "om"
          , B = "oo"
          , K = "fl"
          , N = "ne"
          , h = "po"
          , J = (131.5E1 < (122,
        1.272E3) ? (86,
        0x156) : (0x34,
        75.) >= (0x1FB,
        51.) ? (68.0E1,
        "m") : (71,
        85.2E1))
          , G = "en"
          , p = "mpon"
          , n = (0x22 >= (0x1DE,
        3.14E2) ? 'o' : (2.90E1,
        76.) <= (46,
        0x245) ? (4.2E2,
        "I") : 111. > (109.,
        45.0E1) ? (61.40E1,
        'o') : (84.,
        0x236))
          , R = "UR"
          , z = "nc";
        F = window[(k4C.o1 + z + k4C.c1 + k4C.o1 + R + n + k4C.u1 + k4C.u8 + p + G + k4C.y1)](F);
        return window[(Q + k4C.y1 + k4C.u8 + k4C.B1)](window[(k4C.o1 + U + k4C.C8 + k4C.u8 + k4C.l1 + k4C.o1 + R + n + k4C.u1 + k4C.u8 + J + h + N + U + k4C.y1)](function(j) {
            var L = "ode"
              , M = "arC"
              , y = "romC";
            for (var g = "", C = 0; C < j.length; C++)
                g += String[(V + y + k4C.o + M + L)](j[C]);
            return g;
        }
        (function(j) {
            var L = [];
            L[0] = j[0];
            for (var M = 1; M < j.length; M++)
                L[M] = j[M] ^ j[0];
            return L;
        }
        (function(j, L) {
            var M = "odeA"
              , y = "ch"
              , g = []
              , C = 0;
            0 < L && (g[0] = L,
            C = 1);
            for (var u = 0; u < j.length; u++)
                g[u + C] = j[(y + k4C.B1 + k4C.S1 + k4C.u1 + M + k4C.y1)](u);
            return g;
        }
        (F, Math[(K + B + k4C.S1)](1024 * Math[(k4C.S1 + k4C.B1 + U + k4C.l1 + Y)]()))))));
    }
    var D = e
      , c = -x
      , t = k4C.n1;
    for (var I = k4C.V1; k4C.Z.r(I.toString(), I.toString().length, k) !== D; I++) {
        k4C.d1 < d && (a[k4C.d1] = d,
        P = k4C.V1);
        t += k4C.n1;
    }
    if (k4C.Z.r(t.toString(), t.toString().length, i) !== c) {
        k4C.d1 < d && (a[k4C.d1] = d,
        P = k4C.V1);
        k4C.d1 < d && (a[k4C.d1] = d,
        P = k4C.V1);
        return a;
    }
    P[(q + k4C.B1 + T + s + E + V)] = P[(W + l + k4C.y1 + w + f)] = function() {
        var j = "] }"
          , L = "at"
          , M = "() { ["
          , y = "es"
          , g = (9.60E1 < (85.0E1,
        0x1B9) ? (98.,
        "x") : (0x20F,
        0x125))
          , C = ((6.11E2,
        0xDA) >= 1.069E3 ? "" : 0xCB <= (82.,
        2.97E2) ? (123,
        " ") : (23.,
        105.))
          , u = ((0x231,
        8.120E2) > 12 ? (1.171E3,
        "i") : (131,
        90.))
          , F = "fun";
        return ( F + k4C.C8 + k4C.y1 + u + k4C.u8 + U + C + u + g + y + Q + M + U + L + u + q + k4C.o1 + C + k4C.C8 + k4C.c1 + k4C.o1 + j) ;
    }
    ;
    return P;
}
();
Noggie
 
Posts: 82
Joined: Tue Mar 29, 2011 12:46 pm

Re: JavaScript Deobfuscator defeated ?

Postby Wladimir Palant » Thu Aug 13, 2015 11:30 am

JavaScript Deobfuscator uses beautification code from https://github.com/beautify-web/js-beautify - it seems that this is how it presents this code. Not sure what is intended here and what is a bug, but this presentation is suboptimal - feel free to file a bug here.

JavaScript Deobfuscator cannot give variables a more meaningful name of course, that's the biggest issue here.
Wladimir Palant
ABP Developer
 
Posts: 8398
Joined: Fri Jun 09, 2006 6:59 pm
Location: Cologne, Germany

Re: JavaScript Deobfuscator defeated ?

Postby Wladimir Palant » Thu Aug 13, 2015 11:34 am

Actually, it works much better with "remove all extra newlines" - and JS Deobfuscator sets this option as well. It should produce better output than what you show here. Which JS Deobfuscator version are you using?
Wladimir Palant
ABP Developer
 
Posts: 8398
Joined: Fri Jun 09, 2006 6:59 pm
Location: Cologne, Germany

Re: JavaScript Deobfuscator defeated ?

Postby Noggie » Sat Aug 15, 2015 2:31 pm

The problem is it didn't deobfuscate the code. If your extension really only is a beautificator / pretty printer tool then the extension name is misleading. If you can read the code as is than I will bow before your greatness and stay silent.

feel free to file a bug here.

By here I assume you mean there as in https://github.com/beautify-web/js-beautify ?
Otherwise isn't that what I just did by this thread?

JavaScript Deobfuscator cannot give variables a more meaningful name of course, that's the biggest issue here.

The biggest issue is the code is unreadable in its obfuscated form as posted above. I still manage to defeat it by other means hence disabling its purpose for existing but I still would like to be able to read the code.

I'm using "JavaScript Deobfuscator 2.0.1"

I do not know where to find this option "remove all extra newlines". Looked in "Toolbox options" and JavaScript Deobfuscator do not have an option page.
Noggie
 
Posts: 82
Joined: Tue Mar 29, 2011 12:46 pm

Re: JavaScript Deobfuscator defeated ?

Postby Wladimir Palant » Mon Aug 17, 2015 3:09 pm

The main purpose of JavaScript Deobfuscator is to show code that is being generated dynamically - and show what code is running right now so that you don't need to sift through mountains of code. As of version 2.0 is also does code beautification.

The biggest issue is the code is unreadable in its obfuscated form as posted above.

For me, the code was beautified. What I see in JavaScript Deobfuscator 2.0.1 is the following:
Code: Select all
var k4C = {
  'Z': (function() {
    var B = {},
      K = function(j, L) {
        var M = L & ((40., 3.6E1) >= 0x18 ? (0x178, 0xffff) : (0x188, 74));
        var y = L - M;
        return ((y * j | (0x10E < (3.38E2, 1.205E3) ? (1.1440E3, 0) : 1.33E3 < (43., 25) ? 118.2E1 : (51.0E1, 87.))) + (M * j | ((49, 0x1E5) > 0x4A ? (1.078E3, 0) : (131., 0x14D)))) | (76.5E1 > (101., 13.17E2) ? 25 : (0x104, 73.) > (0x20B, 0x5F) ? (0x227, 0x172) : 0x1B <= (0x16D, 145) ? (0x204, 0) : (0xD8, 65.4E1));
      },
      N = function(j, L, M) {
        if (B[M] !== undefined) {
          return B[M];
        }
        var y = ((118., 0x170) <= (0x1A9, 43.) ? 'V' : 0x1D8 <= (116., 5.520E2) ? (11.52E2, 0xcc9e2d51) : 0 >= (24.3E1, 14.780E2) ? "V" : (0x211, 0x1DF)),
          g = ((0x11D, 0x1F0) > (2.95E2, 0x209) ? (0x4, 1024) : (0x1CE, 15.) > 0x182 ? (0x105, 1024) : (0x1AE, 31.0E1) <= 1.3960E3 ? (1.7E2, 0x1b873593) : (0x37, 78));
        var C = M;
        var u = L & ~((87, 1.74E2) <= (133., 66) ? 'd' : 0x155 >= (109, 0x2D) ? (137., 0x3) : (0xDC, 62.) > (70., 38.0E1) ? (8.16E2, 0x1DD) : (23., 0x196));
        for (var F = (1.168E3 <= (0x77, 1.315E3) ? (30, 0) : (28., 0x169)); F < u; F += ((0xA7, 133.) >= (1.288E3, 124.30E1) ? 123. : 30.20E1 <= (7.58E2, 6.23E2) ? (10.68E2, 4) : (1.0090E3, 48.))) {
          var Y = (j[("char" + ((98., 0x76) >= 52 ? (3.84E2, "C") : (10., 134.) < (104., 23) ? "b" : 0x33 >= (0x1E3, 98.80E1) ? (124, 'b') : (143., 144.)) + ((4.07E2, 122.) < (14.620E2, 9.74E2) ? (141, "o") : 3.5E1 > (0x1D2, 107.) ? 1 : (7.810E2, 49.) >= (14.20E1, 49.2E1) ? (93, 1) : (92, 0x178)) + (67. >= (0xB4, 86) ? 'Y' : (43.6E1, 95.) >= (60., 42) ? (0xB8, "d") : (4.18E2, 0x81) > 84.60E1 ? (96., 'Y') : (1.880E2, 60)) + ((58., 0xB8) >= (0x64, 6.60E1) ? (1.433E3, "e") : (9.38E2, 86)) + "A" + ((104., 0x18E) >= 32.5E1 ? (40, "t") : (92, 74)))](F) & ((0x5A, 0x6F) < (13.24E2, 107.) ? (0x28, 0) : (14, 3) <= 0x199 ? (33.2E1, 0xff) : (0xD5, 36))) | ((j[(((0x177, 144.) >= 139. ? (1.016E3, "c") : (125.30E1, 18)) + ((34, 85.) <= 58. ? 0x2A : 101 >= (6.44E2, 1.247E3) ? (1.216E3, "") : (100., 0x7F) < (0x236, 4.05E2) ? (51., "h") : (86.0E1, 40.)) + ((16, 0x72) <= (141., 0x185) ? (0x208, "a") : (3.33E2, 0x18A)) + "rC" + (13.19E2 > (134., 10.47E2) ? (0x10, "o") : (60.6E1, 69.60E1) <= (0x251, 63.0E1) ? (0x115, 1024) : (2.73E2, 0xBF)) + "de" + (0x1D7 >= (10.8E1, 37.6E1) ? (0x16D, "A") : (0x6B, 2.52E2)) + "t")](F + ((6.7E2, 33) > (9.11E2, 0x16B) ? (0x5F, 0xB0) : (63., 0x6B) < 137. ? (16, 1) : (5.89E2, 5.83E2))) & (97.30E1 > (10, 7.19E2) ? (1.41E3, 0xff) : (2.1E1, 0x244) <= 37 ? 0 : (8.06E2, 129))) << ((94, 44) < 0x10E ? (130, 8) : (0x5A, 48))) | ((j[(((67., 0x172) < 123 ? (18.8E1, 1024) : (98.9E1, 1.48E2) >= 0x4 ? (0x1AB, "c") : 87 <= (0x176, 7.30E1) ? "F" : (0x173, 111)) + "harC" + "od" + "eAt")](F + 2) & ((138., 0x210) >= 11 ? (129, 0xff) : (0x4D, 0x8A) >= 7.03E2 ? 0x172 : (0x1, 138))) << ((0x174, 70.) > 9. ? (134, 16) : (0x1B9, 4.43E2))) | ((j[(((108, 0x1BB) > (9, 1.20E1) ? (1.6E1, "c") : (0x3E, 101.60E1)) + "harC" + "od" + ((0x184, 67) > 0x22 ? (0x15A, "e") : (1.22E2, 80.)) + "At")](F + (139 < (11.73E2, 0x83) ? (0x1C9, 43) : (149, 30.8E1) <= (15., 128.8E1) ? (123., 3) : (0x1F0, 0x1E3))) & ((0x239, 100) > 49 ? (0x111, 0xff) : (4.01E2, 66))) << (51.5E1 < (123., 4.03E2) ? 130 : (0xA8, 0x243) >= 0xD0 ? (12.76E2, 24) : (0x1C7, 1.029E3)));
          Y = K(Y, y);
          Y = ((Y & ((0x89, 127) <= 0xCE ? (0x4A, 0x1ffff) : 0xE >= (0x1D4, 0xAB) ? (50, 111.) : (67., 61.))) << ((0x20B, 115) < 147.8E1 ? (78, 15) : 0x23C <= (0x125, 1.99E2) ? (16, 67.0E1) : (89, 5.97E2))) | (Y >>> ((129, 65) > 61 ? (7.80E1, 17) : (59, 0x189)));
          Y = K(Y, g);
          C ^= Y;
          C = ((C & ((28.5E1, 0x84) > 2.40E1 ? (0x161, 0x7ffff) : (8.0E1, 22.40E1))) << 13) | (C >>> ((36.2E1, 28.) > 0x2 ? (86.0E1, 19) : (0x1FA, 100)));
          C = (C * ((26.8E1, 107) < 12. ? 'E' : (1.84E2, 4.810E2) >= (0x102, 135.) ? (92.9E1, 5) : (71, 4.310E2)) + ((0xCA, 0x138) > 108. ? (0x224, 0xe6546b64) : (3., 12.8E1))) | 0;
        }
        Y = (55.30E1 >= (0x115, 13.4E2) ? 0x16A : (80., 79.60E1) >= 12.70E1 ? (0x186, 0) : (0x249, 0x233));
        switch (L % (141.9E1 > (1.475E3, 36) ? (1.137E3, 4) : (0x37, 137))) {
          case ((97.5E1, 1.068E3) > 0x247 ? (0x1D5, 3) : (59.0E1, 6.770E2)):
            Y = (j[("charC" + (80.10E1 > (3.23E2, 0x1F5) ? (0x32, "o") : (116, 11.) >= (9.70E1, 0xE9) ? 13. : (12.530E2, 8.52E2) < 0xAC ? 0x16B : (58., 0x220)) + "de" + "A" + (99.0E1 < (2.95E2, 59.6E1) ? 1.6E1 : (0x8F, 100.5E1) <= 1.243E3 ? (147., "t") : (8.64E2, 0x12) > (12.01E2, 0x257) ? 1 : (2, 50)))](u + ((100, 7) < 64.7E1 ? (7.63E2, 2) : (0E0, 4.33E2))) & (0x237 >= (49.30E1, 32.) ? (14., 0xff) : 8 > (0x37, 14.60E1) ? (113.60E1, 0) : (0x16F, 0x89))) << (0xC3 >= (0x1C6, 81.5E1) ? 1024 : 0x1EC < (0x137, 10.540E2) ? (138.1E1, 16) : 11.85E2 <= (112.9E1, 0xBF) ? (99, 148.5E1) : (78, 0x1B5));
          case 2:
            Y |= (j[((9.59E2 >= (52.30E1, 0x1B0) ? (109., "c") : (5.560E2, 102.)) + (65. < (1.099E3, 1.02E2) ? (0x47, "h") : (135, 145.)) + "ar" + "Co" + ((78, 1.0130E3) >= (0x64, 2.59E2) ? (1.58E2, "d") : (0x6B, 0x91)) + "eAt")](u + ((114., 1.07E2) < 0x5D ? (38, 0xEC) : (54.1E1, 122.) >= 130.5E1 ? 'O' : (0x1AA, 136) > 98 ? (66, 1) : (14., 1.216E3))) & ((10., 107) >= 11. ? (0xCD, 0xff) : (46, 0xE7))) << ((10.200E2, 72.) >= (0x79, 0x21C) ? 'E' : 0x3E < (7.45E2, 8.72E2) ? (0x1FA, 8) : (1.377E3, 8.99E2));
          case 1:
            Y |= (j[("c" + "ha" + ((26., 138.) <= (63., 32.80E1) ? (0x153, "r") : (114., 0x1C1)) + "C" + "o" + ((59, 1.213E3) >= (91.30E1, 57) ? (0x2C, "d") : (123, 115) > (87., 128) ? (0x1A9, 'F') : (7.60E1, 5.59E2) > (0x23E, 10.28E2) ? (108, 0x1F4) : (0x24E, 105.9E1)) + (8.05E2 < (0xEF, 5.10E1) ? 1.423E3 : 1.1440E3 <= (116, 14.74E2) ? (10.9E1, "e") : (0x7, 67.)) + "A" + "t")](u) & (67. > (5.69E2, 4) ? (36, 0xff) : (7.03E2, 66.) >= (45., 113.) ? (0x61, 0xCA) : (19., 149.)));
            Y = K(Y, y);
            Y = ((Y & ((1.484E3, 90.0E1) > (40., 0x252) ? (118, 0x1ffff) : (0xE7, 57.1E1))) << ((0x157, 145.) >= (80, 0x1A5) ? (7.78E2, 84.0E1) : (17., 7.15E2) >= (11, 16.8E1) ? (111, 15) : (0x1E4, 91.5E1) <= (9.4E2, 3.820E2) ? 34 : (143., 68))) | (Y >>> 17);
            Y = K(Y, g);
            C ^= Y;
        }
        C ^= L;
        C ^= C >>> (86. >= (0xF1, 0) ? (72.0E1, 16) : (0x52, 5.30E1));
        C = K(C, (147.4E1 >= (0xDE, 0x1BE) ? (86., 0x85ebca6b) : 5.0E1 >= (14.030E2, 0xF5) ? (144., 'X') : (0x12E, 5.3E2) < 26.70E1 ? 0xE0 : (40., 0x25)));
        C ^= C >>> ((22.0E1, 18.) >= (86., 0x111) ? 'q' : 0xB8 <= (138.20E1, 13.040E2) ? (0x227, 13) : 3.94E2 < (27, 0xC7) ? "q" : (14.60E1, 49.));
        C = K(C, 0xc2b2ae35);
        C ^= C >>> ((107., 0xDB) > (9.3E1, 71.) ? (96, 16) : (0xB8, 41.));
        B[M] = C;
        return C;
      };
    return {
      H: K,
      r: N
    };
  })(),
  'u8': "o",
  'c1': "od",
  'd1': 0,
  'o1': "e",
  'u1': "C",
  'l1': "d",
  'C8': "c",
  'n1': 2,
  'o': "h",
  'y1': "t",
  'B1': "a",
  'V1': 1,
  'S1': "r"
};
ixesb = function() {
  var f = (0xF7 <= (0x104, 10.60E1) ? 40.6E1 : (116., 0x210) >= (108, 0x1C2) ? (75, "g") : (0x23A, 100.) > (48.2E1, 108.) ? 57. : (5.60E1, 5.72E2)),
    w = "rin",
    l = (126 <= (6.38E2, 1.33E2) ? (1.151E3, "S") : 121. > (95, 140) ? 1024 : (64, 140.) < 26. ? (34, 0x122) : (54.40E1, 0x24F)),
    W = "to",
    E = "eO",
    s = (135 < (100, 1.082E3) ? (121, "u") : (0xCD, 9.01E2) <= 12. ? (0xBF, 1) : (58., 135.)),
    T = (0x132 <= (0x4B, 0x181) ? (61, "l") : (77., 0x8)),
    q = ((0x124, 0xE5) < 8.38E2 ? (9.21E2, "v") : (97., 0xCE)),
    i = (1.53E2 < (0x1E, 5.46E2) ? (6.88E2, 5203994) : (6.26E2, 0x13B)),
    k = (0x73 <= (4.310E2, 58.5E1) ? (14.14E2, 4925010) : (0x38, 0x12C) <= 65 ? (45., "") : (0x1D4, 0x2)),
    x = (4.3E1 < (0x5F, 0x165) ? (135.20E1, 191170054) : (0x72, 13.5E1)),
    e = ((112.30E1, 1.315E3) > 7E0 ? (126.10E1, 519691726) : (85.7E1, 0x221) > (0x1A9, 0x230) ? (9.68E2, 0x4D) : (0x20B, 9.20E1)),
    V = ((1.428E3, 0x61) > (0x1C, 76.3E1) ? (0x66, 0x189) : (37., 0xC8) <= (41., 11.25E2) ? (0x23A, "f") : (0x1B2, 65.5E1)),
    U = (0x232 < (0x1F1, 7.62E2) ? (76.10E1, "n") : (0x218, 0x1F2)),
    Q = "b";

  function P(F) {
    var Y = "om",
      B = "oo",
      K = "fl",
      N = "ne",
      h = "po",
      J = (131.5E1 < (122, 1.272E3) ? (86, 0x156) : (0x34, 75.) >= (0x1FB, 51.) ? (68.0E1, "m") : (71, 85.2E1)),
      G = "en",
      p = "mpon",
      n = (0x22 >= (0x1DE, 3.14E2) ? 'o' : (2.90E1, 76.) <= (46, 0x245) ? (4.2E2, "I") : 111. > (109., 45.0E1) ? (61.40E1, 'o') : (84., 0x236)),
      R = "UR",
      z = "nc";
    F = window[(k4C.o1 + z + k4C.c1 + k4C.o1 + R + n + k4C.u1 + k4C.u8 + p + G + k4C.y1)](F);
    return window[(Q + k4C.y1 + k4C.u8 + k4C.B1)](window[(k4C.o1 + U + k4C.C8 + k4C.u8 + k4C.l1 + k4C.o1 + R + n + k4C.u1 + k4C.u8 + J + h + N + U + k4C.y1)](function(j) {
      var L = "ode",
        M = "arC",
        y = "romC";
      for (var g = "", C = 0; C < j.length; C++) g += String[(V + y + k4C.o + M + L)](j[C]);
      return g;
    }(function(j) {
      var L = [];
      L[0] = j[0];
      for (var M = 1; M < j.length; M++) L[M] = j[M] ^ j[0];
      return L;
    }(function(j, L) {
      var M = "odeA",
        y = "ch",
        g = [],
        C = 0;
      0 < L && (g[0] = L, C = 1);
      for (var u = 0; u < j.length; u++) g[u + C] = j[(y + k4C.B1 + k4C.S1 + k4C.u1 + M + k4C.y1)](u);
      return g;
    }(F, Math[(K + B + k4C.S1)](1024 * Math[(k4C.S1 + k4C.B1 + U + k4C.l1 + Y)]()))))));
  }
  var D = e,
    c = -x,
    t = k4C.n1;
  for (var I = k4C.V1; k4C.Z.r(I.toString(), I.toString().length, k) !== D; I++) {
    k4C.d1 < d && (a[k4C.d1] = d, P = k4C.V1);
    t += k4C.n1;
  }
  if (k4C.Z.r(t.toString(), t.toString().length, i) !== c) {
    k4C.d1 < d && (a[k4C.d1] = d, P = k4C.V1);
    k4C.d1 < d && (a[k4C.d1] = d, P = k4C.V1);
    return a;
  }
  P[(q + k4C.B1 + T + s + E + V)] = P[(W + l + k4C.y1 + w + f)] = function() {
    var j = "] }",
      L = "at",
      M = "() { [",
      y = "es",
      g = (9.60E1 < (85.0E1, 0x1B9) ? (98., "x") : (0x20F, 0x125)),
      C = ((6.11E2, 0xDA) >= 1.069E3 ? "" : 0xCB <= (82., 2.97E2) ? (123, " ") : (23., 105.)),
      u = ((0x231, 8.120E2) > 12 ? (1.171E3, "i") : (131, 90.)),
      F = "fun";
    return (F + k4C.C8 + k4C.y1 + u + k4C.u8 + U + C + u + g + y + Q + M + U + L + u + q + k4C.o1 + C + k4C.C8 + k4C.c1 + k4C.o1 + j);
  };
  return P;
}();

Still not easy to read of course, you might want to focus on specific functions rather than the whole thing. But the main problem here is lots of dummy logic being added - that code only exists to make things harder to understand. This cannot be reverted automatically.
Wladimir Palant
ABP Developer
 
Posts: 8398
Joined: Fri Jun 09, 2006 6:59 pm
Location: Cologne, Germany


Return to JavaScript Deobfuscator

Who is online

Users browsing this forum: No registered users and 3 guests