+4 votes
by
Hello, faced with encrypted code that can not decipher. In the Internet anything sensible I can not find. Maybe there are some services or browser extensions? Thanks in advance.
var _0x46f2=["\x3C","\x69\x6E\x64\x65\x78\x4F\x66","\x73\x70\x6C\x69\x74","\x6C\x65\x6E\x67\x74\x68","\x3E","\x73\x75\x62\x73\x74\x72\x69\x6E\x67","","\x6A\x6F\x69\x6E","\x63\x68\x61\x72\x41\x74","\x20","\x2E\x2E\x2E","\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x42\x79\x49\x64","\x69\x6D\x67","\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x73\x42\x79\x54\x61\x67\x4E\x61\x6D\x65","\x79\x65\x73","\x3C\x73\x70\x61\x6E\x20\x73\x74\x79\x6C\x65\x3D\x22\x66\x6C\x6F\x61\x74\x3A\x6C\x65\x66\x74\x3B\x20\x70\x61\x64\x64\x69\x6E\x67\x3A\x30\x70\x78\x20\x31\x30\x70\x78\x20\x35\x70\x78\x20\x30\x70\x78\x3B\x22\x3E\x3C\x69\x6D\x67\x20\x73\x72\x63\x3D\x22","\x73\x72\x63","\x22\x20\x77\x69\x64\x74\x68\x3D\x22","\x70\x78\x22\x20\x68\x65\x69\x67\x68\x74\x3D\x22","\x70\x78\x22\x2F\x3E\x3C\x2F\x73\x70\x61\x6E\x3E","\x3C\x64\x69\x76\x3E","\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C","\x3C\x2F\x64\x69\x76\x3E","\x3C\x61\x20\x68\x72\x65\x66\x3D\x27\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x77\x61\x79\x32\x74\x68\x65\x6D\x65\x73\x2E\x63\x6F\x6D\x2F\x27\x3E\x57\x61\x79\x32\x74\x68\x65\x6D\x65\x73\x3C\x2F\x61\x3E","\x68\x74\x6D\x6C","\x23\x6D\x79\x63\x6F\x6E\x74\x65\x6E\x74","\x23\x6D\x79\x63\x6F\x6E\x74\x65\x6E\x74\x3A\x76\x69\x73\x69\x62\x6C\x65","\x68\x72\x65\x66","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x77\x61\x79\x32\x74\x68\x65\x6D\x65\x73\x2E\x63\x6F\x6D\x2F","\x72\x65\x61\x64\x79"];function removeHtmlTag(_0x8930x2,_0x8930x3){if(_0x8930x2[_0x46f2[1]](_0x46f2[0])!=-1){var _0x8930x4=_0x8930x2[_0x46f2[2]](_0x46f2[0]);for(var _0x8930x5=0;_0x8930x5<_0x8930x4[_0x46f2[3]];_0x8930x5++){if(_0x8930x4[_0x8930x5][_0x46f2[1]](_0x46f2[4])!=-1){_0x8930x4[_0x8930x5]=_0x8930x4[_0x8930x5][_0x46f2[5]](_0x8930x4[_0x8930x5][_0x46f2[1]](_0x46f2[4])+1,_0x8930x4[_0x8930x5][_0x46f2[3]]);} ;} ;_0x8930x2=_0x8930x4[_0x46f2[7]](_0x46f2[6]);} ;_0x8930x3=(_0x8930x3<_0x8930x2[_0x46f2[3]]-1)?_0x8930x3:_0x8930x2[_0x46f2[3]]-2;while(_0x8930x2[_0x46f2[8]](_0x8930x3-1)!=_0x46f2[9]&&_0x8930x2[_0x46f2[1]](_0x46f2[9],_0x8930x3)!=-1){_0x8930x3++;} ;_0x8930x2=_0x8930x2[_0x46f2[5]](0,_0x8930x3-1);return _0x8930x2+_0x46f2[10];} ;function createSummaryAndThumb(_0x8930x7){var _0x8930x8=document[_0x46f2[11]](_0x8930x7);var _0x8930x9=_0x46f2[6];var _0x8930xa=_0x8930x8[_0x46f2[13]](_0x46f2[12]);var _0x8930xb=summary_noimg;if(thumbnail_mode==_0x46f2[14]){if(_0x8930xa[_0x46f2[3]]>=1){_0x8930x9=_0x46f2[15]+_0x8930xa[0][_0x46f2[16]]+_0x46f2[17]+img_thumb_width+_0x46f2[18]+img_thumb_height+_0x46f2[19];_0x8930xb=summary_img;} ;} ;var _0x8930xc=_0x8930x9+_0x46f2[20]+removeHtmlTag(_0x8930x8[_0x46f2[21]],_0x8930xb)+_0x46f2[22];_0x8930x8[_0x46f2[21]]=_0x8930xc;} ;$(document)[_0x46f2[30]](function (){$(_0x46f2[25])[_0x46f2[24]](_0x46f2[23]);setInterval(function (){if(!$(_0x46f2[26])[_0x46f2[3]]){window[_0x46f2[28]][_0x46f2[27]]=_0x46f2[29];} ;} ,3000);} );

2 Answers

+6 votes
by
well... for starters bring to normal the array elements. You have there a line clearly written with the character code, you can just console to create Massey and bring him out.
var parts = ["<", "indexOf", "split", "length", ">", "substring", "", "join", "charAt", " ", "...", "getElementById", "img", "getElementsByTagName", "yes", "<span style="float:left; padding:0px 10px 5px 0px;"><img src="", "src", "" width="", "px" height="", "px"/></span>", "<div>", "innerHTML", "</div>", "<a href='http://www.way2themes.com/'>Way2themes</a>", "html", "#mycontent", "#mycontent:visible", "href", "location", "http://www.way2themes.com/", "ready"];


then replace the references to the elements of the array _0x46f2 the actual value, and get your code. You will need only variables on rename. Most of the work can regularly to perform.

"тут исходник, лень копипастить"code.replace(/\_0x46f2\[(\d+)\]/g, function (matched, idx) {
return '\''+_0x46f2[idx]+'\'';
});


на выходе получаем (если прогнать через beautifier)
function removeHtmlTag(_0x8930x2, _0x8930x3) {
if (_0x8930x2['indexOf']('<') != -1) {
var _0x8930x4 = _0x8930x2['split']('<');
for (var _0x8930x5 = 0; _0x8930x5 < _0x8930x4['length']; _0x8930x5++) {
if (_0x8930x4[_0x8930x5]['indexOf']('>') != -1) {
_0x8930x4[_0x8930x5] = _0x8930x4[_0x8930x5]['substring'](_0x8930x4[_0x8930x5]['indexOf']('>') + 1, _0x8930x4[_0x8930x5]['length']);
};
};
_0x8930x2 = _0x8930x4['join']('');
};
_0x8930x3 = (_0x8930x3 < _0x8930x2['length'] - 1) ? _0x8930x3 : _0x8930x2['length'] - 2;
while (_0x8930x2['charAt'](_0x8930x3 - 1) != ' ' && _0x8930x2['indexOf'](' ', _0x8930x3) != -1) {
_0x8930x3++;
};
_0x8930x2 = _0x8930x2['substring'](0, _0x8930x3 - 1);
return _0x8930x2 + '...';
};

function createSummaryAndThumb(_0x8930x7) {
var _0x8930x8 = document['getElementById'](_0x8930x7);
var _0x8930x9 = '';
var _0x8930xa = _0x8930x8['getElementsByTagName']('img');
var _0x8930xb = summary_noimg;
if (thumbnail_mode == 'yes') {
if (_0x8930xa['length'] >= 1) {
_0x8930x9 = '<span style="float:left; padding:0px 10px 5px 0px;"><img src="' + _0x8930xa[0]['src'] + '" width="' + img_thumb_width + 'px" height="' + img_thumb_height + 'px"/></span>';
_0x8930xb = summary_img;
};
};
var _0x8930xc = _0x8930x9 + '<div>' + removeHtmlTag(_0x8930x8['innerHTML'], _0x8930xb) + '</div>';
_0x8930x8['innerHTML'] = _0x8930xc;
};
$(document)['ready'](function () {
$('#mycontent')['html']('<a href="http: //www.way2themes.com/">Way2themes</a>');
setInterval(function () {
if (!$('#mycontent:visible')['length']) {
window['location']['href'] = 'http://www.way2themes.com/';
};
}, 3000);
});


дальше дело за малым, нужно переменные попереименовывать и слегка отрефакторить код.
by
@Fesor thanks , but not everything is clear. "then the case for small, need to operaional variables and refactor the code slightly." I'm new and I don't quite understand. By the way and if you where to read? Why this is the case, why such a regular expression?
by
@Fesor pancake substitute((
by
@buloshnik look my comment below, I think Google already found this snippet with a normal names of variables and no obvious mistakes.
by
@Fesor well you don't have to call right from the bulldozer! If I need this script now, it is time to learn js does not remain...
by
@buloshnik well , in the script there are errors, you need hands to check. That is what I put in does not roll. I have the quotes is not enough.
by
@buloshnik you should watch what does the function and edit the code in the process. That is, you have a line:
function createSummaryAndThumb(_0x8930x7) {
var _0x8930x8 = document[getElementById](_0x8930x7);


можно переписа ькак
function createSummaryAndThumb(elementId) {
var element = document.getElementById(elementId);


а для этого нужно знать js.
by
@buloshnik learn javascript. Sosvsem simple code above, but rename the variables I'm frankly too lazy.
by
@Fesor yeah I'm not asking You to rename variables. I want to understand how to do it all yourself. Renamed from Bolden? ie everywhere _0x8930xb can replace per1, right? and it is not clear how is the array to a normal view
+1 vote
by
To automate the process, there is a wonderful service:
jsbeautifier.org

However, as noted prediksi commentator, the name of the variables will still have to rename because they were already known to be changed by the obfuscator.
by
By the way, I googled a bit on this topic and it seems your snippet found here:

stackoverflow.com/questions/1033235/enabling-html-...
by
I probably do not understand something, I have the source code, if placed in service which offers You something he is just in a readable form. or I something wrong doing? About what I did @Fesor I name variables, from the bold to come up with or can return the names invented by the author of this script?
by
No, to get the names intended by the author will not edastada. It is approximately of the same series trying to rasshifrovat text in wrong encoding type '???? ??? ????????? ??'. For good you need to understand what makes the script and replace the variable names to the corresponding names, i.e., Yes, come up with their names.
...