I got this a function eval in javascript - but i don't know how read it? how does this generate or decode the string? or simply how is this code?

thanks for help!

I got this a function eval in javascript - http://pastebin./E1PXQeKj but i don't know how read it? how does this generate or decode the string? or simply how is this code?

thanks for help!

• javascript
• encoding
• eval
• decode

2 Answers 2

Paste it in http://jsbeautifier/ and it reveals:

var secret = 'dDGSUW1QU01JaVZNTWFFN0pWcm2RZkE6MD';

To do it manually, find the end of the eval function and replace eval by alert or whatever debugging function you use. Line 2 can be handled in that way.

Line 3 formatted looks like: var _9581

;
var _8438 = '196E84D180D984E928C920F980E928D988C652F768E652F680B924F808E924A724E916A872C1000A720A848E872F868D980E864C796E940A724B912F724B732B724B924C876C956D836C912C864A804E1008E840C868A800A740A832E848B680D760F';
var _5668 = /[\x41\x42\x43\x44\x45\x46]/;
var _9413 = 2;
var _9565 = _8438.charAt(_8438.length - 1);
var _5032;
var _9978 = _8438.split(_5668);
var _4678 = [String.fromCharCode, isNaN, parseInt, String];
_9978[1] = _4678[_9413 + 1](_4678[_9413](_9978[1]) / 21);
var _6432 = (_9413 == 7) ? String : eval;
_5032 = '';
_11 = _4678[_9413](_9978[0]) / _4678[_9413](_9978[1]);
for (_9581 = 3; _9581 < _11; _9581++) _5032 += (_4678[_9413 - 2]((_4678[_9413](_9978[_9581]) + _4678[_9413](_9978[2]) + _4678[_9413](_9978[1])) / _4678[_9413](_9978[1]) - _4678[_9413](_9978[2]) + _4678[_9413](_9978[1]) - 1));
_6432(_5032);

Now analyse it yourself. Care should be taken when something is executeable. Constructs like foo(bar).

Decoding in progress:

var _9581;
var _8438 = '196E84D180D984E928C920F980E928D988C652F768E652F680B924F808E924A724E916A872C1000A720A848E872F868D980E864C796E940A724B912F724B732B724B924C876C956D836C912C864A804E1008E840C868A800A740A832E848B680D760F';
var _5668 = /[ABCDEF]/;
var _9413 = 2;
var _9565 = "F";
var _5032;
var _9978 = [196, 84, 180, 984, 928, 920, 980, 928, 988, 652, 768, 652, 680, 924, 808, 924, 724, 916, 872, 1000, 720, 848, 872, 868, 980, 864, 796, 940, 724, 912, 724, 732, 724, 924, 876, 956, 836, 912, 864, 804, 1008, 840, 868, 800, 740, 832, 848, 680, 760, ];
var _4678 = [String.fromCharCode, isNaN, parseInt, String];
_9978[1] = "4"; //String(parseInt(84) / 21)
var _6432 = eval;
_5032 = '';
_11 = 49; //parseInt(196) / parseInt(4);
for (_9581 = 3; _9581 < _11; _9581++) {
    //_5032 += (String.fromCharCode((parseInt(_9978[_9581]) + parseInt(180) + parseInt(4)) / parseInt(4) - parseInt(180) + parseInt(4) - 1));
    _5032 += String.fromCharCode((parseInt(_9978[_9581]) + 184) / 4 - 177);
}
// so from here one, we can safely assume that the code is NOT executable
//_6432(_5032);
console.log(_5032);

Yields:

secret = 'dGd3bWw1QWVrUDh2a412dXl2aUFyOVE6MQ';

Conclusion:

• The first packer is to confuse people who manage to decode it.
• The second code actually changes the secret variable

Here is unpacker for code encoded in such a way http://www.strictly-software./unpacker. It seems the only thing this code do is:

ver secret = 'dGd3bWw1QWVrUDh1a242dXlNaUFyOVE6MQ';