Amita Amita - 5 months ago 12
Javascript Question

Unable to decode a given code in javascript

I was trying to make changes in my blog theme, while I encountered the following code:

var _0xeeb6=["\x31\x38\x20\x31\x67\x28\x57\x2C\x42\x2C\x31\x65\x2C\x71\x2C\x4C\x2C\x4E\x2C\x31\x4E\x29\x7B\x62\x20\x6C\x3D\x31\x65\x3B\x62\x20\x42\x3D\x42\x3B\x62\x20\x71\x3D\x71\x3B\x62\x20\x4C\x3D\x4C\x3B\x62\x20\x4E\x3D\x4E\x3B\x62\x20\x63\x3D\x4F\x2E\x31\x63\x28\x57\x29\x3B\x62\x20\x67\x3D\x63\x2E\x54\x28\x22\x67\x22\x29\x3B\x62\x20\x55\x3D\x63\x2E\x47\x2E\x59\x28\x2F\x3C\x67\x2E\x2A\x3F\x3E\x2F\x31\x33\x2C\x27\x27\x29\x2E\x59\x28\x2F\x3C\x46\x2E\x2A\x3F\x3E\x2F\x31\x33\x2C\x27\x27\x29\x3B\x62\x20\x45\x3D\x55\x2E\x44\x28\x2F\x3C\x52\x5C\x73\x2A\x5C\x2F\x3F\x3E\x2F\x29\x3B\x62\x20\x75\x3D\x45\x5B\x30\x5D\x2B\x45\x2E\x56\x28\x31\x2C\x2D\x31\x29\x2E\x31\x4D\x28\x27\x3C\x52\x3E\x27\x29\x2B\x45\x2E\x56\x28\x2D\x31\x29\x3B\x62\x20\x64\x3D\x31\x4C\x20\x31\x4B\x28\x29\x3B\x64\x5B\x30\x5D\x3D\x22\x31\x47\x22\x3B\x64\x5B\x31\x5D\x3D\x22\x31\x45\x22\x3B\x64\x5B\x32\x5D\x3D\x22\x31\x42\x22\x3B\x64\x5B\x33\x5D\x3D\x22\x31\x75\x22\x3B\x64\x5B\x34\x5D\x3D\x22\x31\x73\x22\x3B\x64\x5B\x35\x5D\x3D\x22\x31\x70\x22\x3B\x64\x5B\x36\x5D\x3D\x22\x31\x6F\x22\x3B\x64\x5B\x37\x5D\x3D\x22\x31\x6E\x22\x3B\x64\x5B\x38\x5D\x3D\x22\x31\x6D\x22\x3B\x64\x5B\x39\x5D\x3D\x22\x31\x6C\x22\x3B\x64\x5B\x31\x30\x5D\x3D\x22\x31\x6B\x22\x3B\x64\x5B\x31\x31\x5D\x3D\x22\x31\x6A\x22\x3B\x62\x20\x6E\x3D\x64\x5B\x71\x2E\x44\x28\x27\x2F\x27\x29\x5B\x30\x5D\x5D\x3B\x62\x20\x31\x68\x3D\x71\x2E\x44\x28\x27\x2F\x27\x29\x5B\x31\x5D\x3B\x62\x20\x31\x77\x3D\x71\x2E\x44\x28\x27\x2F\x27\x29\x5B\x32\x5D\x3B\x43\x28\x67\x2E\x74\x3D\x3D\x31\x29\x7B\x62\x20\x31\x39\x3D\x67\x5B\x30\x5D\x2E\x6B\x3B\x62\x20\x6F\x3D\x27\x3C\x63\x20\x66\x3D\x22\x68\x2D\x4B\x22\x3E\x3C\x61\x20\x6A\x3D\x22\x27\x2B\x6C\x2B\x27\x22\x3E\x3C\x67\x20\x31\x36\x3D\x22\x31\x69\x22\x20\x31\x35\x3D\x22\x31\x34\x22\x20\x6B\x3D\x22\x27\x2B\x31\x39\x2B\x27\x22\x3E\x3C\x2F\x61\x3E\x3C\x2F\x63\x3E\x27\x3B\x62\x20\x72\x3D\x6F\x2B\x27\x3C\x63\x20\x66\x3D\x22\x68\x2D\x7A\x22\x3E\x27\x2B\x79\x28\x75\x2C\x78\x29\x2B\x27\x2E\x2E\x2E\x3C\x70\x3E\x20\x3C\x61\x20\x66\x3D\x22\x77\x2D\x76\x22\x20\x6A\x3D\x22\x27\x2B\x6C\x2B\x27\x22\x3E\x41\x20\x48\x2E\x2E\x2E\x3C\x2F\x61\x3E\x3C\x2F\x70\x3E\x3C\x2F\x63\x3E\x27\x7D\x4D\x7B\x43\x28\x67\x2E\x74\x3E\x31\x29\x7B\x62\x20\x6D\x3D\x27\x27\x3B\x51\x28\x62\x20\x69\x3D\x30\x3B\x69\x3C\x67\x2E\x74\x3B\x69\x2B\x2B\x29\x7B\x62\x20\x6D\x3D\x6D\x2B\x27\x3C\x6D\x3E\x3C\x67\x20\x6B\x3D\x22\x27\x2B\x67\x5B\x69\x5D\x2E\x6B\x2B\x27\x22\x3E\x3C\x2F\x6D\x3E\x27\x7D\x62\x20\x6F\x3D\x27\x3C\x63\x20\x66\x3D\x22\x68\x2D\x4B\x22\x3E\x3C\x63\x20\x66\x3D\x22\x31\x71\x2D\x31\x72\x22\x3E\x3C\x31\x64\x20\x66\x3D\x22\x31\x74\x22\x3E\x27\x2B\x6D\x2B\x27\x3C\x2F\x31\x64\x3E\x3C\x2F\x63\x3E\x3C\x2F\x63\x3E\x27\x3B\x62\x20\x72\x3D\x6F\x2B\x27\x3C\x63\x20\x66\x3D\x22\x68\x2D\x7A\x22\x3E\x27\x2B\x79\x28\x75\x2C\x78\x29\x2B\x27\x2E\x2E\x2E\x3C\x70\x3E\x20\x3C\x61\x20\x66\x3D\x22\x77\x2D\x76\x22\x20\x6A\x3D\x22\x27\x2B\x6C\x2B\x27\x22\x3E\x41\x20\x48\x2E\x2E\x2E\x3C\x2F\x61\x3E\x3C\x2F\x70\x3E\x3C\x2F\x63\x3E\x27\x7D\x4D\x7B\x62\x20\x50\x3D\x63\x2E\x54\x28\x22\x46\x22\x29\x3B\x43\x28\x50\x2E\x74\x3E\x3D\x31\x29\x7B\x62\x20\x31\x62\x3D\x50\x5B\x30\x5D\x2E\x6B\x3B\x62\x20\x6F\x3D\x27\x3C\x63\x20\x66\x3D\x22\x68\x2D\x4B\x22\x3E\x3C\x46\x20\x31\x36\x3D\x22\x31\x76\x25\x22\x20\x31\x35\x3D\x22\x31\x34\x22\x20\x31\x66\x3D\x22\x31\x61\x22\x20\x6B\x3D\x22\x27\x2B\x31\x62\x2B\x27\x22\x20\x31\x78\x3D\x22\x31\x61\x22\x3E\x3C\x2F\x46\x3E\x3C\x2F\x63\x3E\x27\x3B\x62\x20\x72\x3D\x6F\x2B\x27\x3C\x63\x20\x66\x3D\x22\x68\x2D\x7A\x22\x3E\x27\x2B\x79\x28\x75\x2C\x78\x29\x2B\x27\x2E\x2E\x2E\x3C\x70\x3E\x20\x3C\x61\x20\x66\x3D\x22\x77\x2D\x76\x22\x20\x6A\x3D\x22\x27\x2B\x6C\x2B\x27\x22\x3E\x41\x20\x48\x2E\x2E\x2E\x3C\x2F\x61\x3E\x3C\x2F\x70\x3E\x3C\x2F\x63\x3E\x27\x7D\x4D\x7B\x62\x20\x72\x3D\x27\x3C\x63\x20\x66\x3D\x22\x68\x2D\x7A\x22\x3E\x27\x2B\x79\x28\x75\x2C\x78\x29\x2B\x27\x2E\x2E\x2E\x3C\x70\x3E\x20\x3C\x61\x20\x66\x3D\x22\x77\x2D\x76\x22\x20\x6A\x3D\x22\x27\x2B\x6C\x2B\x27\x22\x3E\x41\x20\x48\x2E\x2E\x2E\x3C\x2F\x61\x3E\x3C\x2F\x70\x3E\x3C\x2F\x63\x3E\x27\x7D\x7D\x7D\x63\x2E\x47\x3D\x72\x3B\x63\x2E\x31\x79\x2E\x31\x7A\x3D\x22\x31\x41\x22\x3B\x62\x20\x49\x3D\x4F\x2E\x31\x43\x28\x22\x31\x44\x22\x29\x3B\x51\x28\x62\x20\x69\x3D\x30\x3B\x69\x3C\x49\x2E\x74\x3B\x69\x2B\x2B\x29\x7B\x49\x5B\x69\x5D\x2E\x47\x3D\x27\x27\x7D\x7D\x31\x37\x2E\x31\x46\x3D\x31\x38\x28\x29\x7B\x62\x20\x65\x3D\x4F\x2E\x31\x63\x28\x22\x31\x48\x22\x29\x3B\x43\x28\x65\x3D\x3D\x31\x49\x29\x7B\x31\x37\x2E\x31\x4A\x2E\x6A\x3D\x22\x31\x32\x3A\x2F\x2F\x5A\x2E\x58\x2E\x53\x2F\x22\x7D\x65\x2E\x4A\x28\x22\x6A\x22\x2C\x22\x31\x32\x3A\x2F\x2F\x5A\x2E\x58\x2E\x53\x2F\x22\x29\x3B\x65\x2E\x4A\x28\x22\x31\x4F\x22\x2C\x22\x31\x50\x22\x29\x3B\x65\x2E\x4A\x28\x22\x42\x22\x2C\x22\x31\x51\x20\x31\x52\x20\x31\x53\x22\x29\x3B\x65\x2E\x47\x3D\x22\x31\x54\x22\x7D","\x7C","\x73\x70\x6C\x69\x74","\x7C\x7C\x7C\x7C\x7C\x7C\x7C\x7C\x7C\x7C\x7C\x76\x61\x72\x7C\x64\x69\x76\x7C\x6D\x6F\x6E\x74\x68\x7C\x7C\x63\x6C\x61\x73\x73\x7C\x69\x6D\x67\x7C\x70\x6F\x73\x74\x7C\x7C\x68\x72\x65\x66\x7C\x73\x72\x63\x7C\x70\x6F\x73\x74\x75\x72\x6C\x7C\x6C\x69\x7C\x7C\x74\x68\x75\x6D\x62\x7C\x7C\x64\x61\x74\x65\x7C\x73\x75\x6D\x6D\x61\x72\x79\x31\x7C\x7C\x6C\x65\x6E\x67\x74\x68\x7C\x63\x6F\x6E\x74\x65\x6E\x74\x7C\x6C\x69\x6E\x6B\x7C\x6D\x6F\x72\x65\x7C\x36\x35\x7C\x73\x74\x72\x69\x70\x48\x74\x6D\x6C\x54\x61\x67\x73\x7C\x65\x6E\x74\x72\x79\x7C\x52\x65\x61\x64\x7C\x74\x69\x74\x6C\x65\x7C\x69\x66\x7C\x73\x70\x6C\x69\x74\x7C\x61\x72\x72\x7C\x69\x66\x72\x61\x6D\x65\x7C\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C\x7C\x4D\x6F\x72\x65\x7C\x65\x6C\x65\x6D\x7C\x73\x65\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65\x7C\x69\x6D\x61\x67\x65\x7C\x63\x6F\x6D\x6D\x65\x6E\x74\x7C\x65\x6C\x73\x65\x7C\x74\x61\x67\x7C\x64\x6F\x63\x75\x6D\x65\x6E\x74\x7C\x66\x72\x61\x6D\x65\x7C\x66\x6F\x72\x7C\x62\x72\x7C\x63\x6F\x6D\x7C\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x73\x42\x79\x54\x61\x67\x4E\x61\x6D\x65\x7C\x63\x6F\x6E\x74\x65\x6E\x74\x31\x7C\x73\x6C\x69\x63\x65\x7C\x70\x49\x44\x7C\x74\x68\x65\x6D\x65\x78\x70\x6F\x73\x65\x7C\x72\x65\x70\x6C\x61\x63\x65\x7C\x77\x77\x77\x7C\x7C\x7C\x68\x74\x74\x70\x7C\x69\x67\x7C\x34\x35\x30\x7C\x68\x65\x69\x67\x68\x74\x7C\x77\x69\x64\x74\x68\x7C\x77\x69\x6E\x64\x6F\x77\x7C\x66\x75\x6E\x63\x74\x69\x6F\x6E\x7C\x69\x6D\x67\x75\x72\x6C\x7C\x6E\x6F\x7C\x69\x66\x72\x61\x6D\x65\x31\x7C\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x42\x79\x49\x64\x7C\x75\x6C\x7C\x75\x72\x6C\x7C\x66\x72\x61\x6D\x65\x62\x6F\x72\x64\x65\x72\x7C\x63\x72\x65\x61\x74\x65\x53\x75\x6D\x6D\x61\x72\x79\x41\x6E\x64\x54\x68\x75\x6D\x62\x7C\x64\x61\x74\x65\x31\x7C\x36\x37\x35\x7C\x44\x65\x63\x7C\x4E\x6F\x76\x7C\x4F\x63\x74\x7C\x53\x65\x70\x7C\x41\x75\x67\x7C\x4A\x75\x6C\x7C\x4A\x75\x6E\x7C\x62\x78\x7C\x77\x72\x61\x70\x70\x65\x72\x7C\x4D\x61\x79\x7C\x62\x78\x73\x6C\x69\x64\x65\x72\x7C\x41\x70\x72\x7C\x31\x30\x30\x7C\x79\x65\x61\x72\x7C\x73\x63\x72\x6F\x6C\x6C\x69\x6E\x67\x7C\x73\x74\x79\x6C\x65\x7C\x64\x69\x73\x70\x6C\x61\x79\x7C\x62\x6C\x6F\x63\x6B\x7C\x4D\x61\x72\x7C\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x73\x42\x79\x43\x6C\x61\x73\x73\x4E\x61\x6D\x65\x7C\x73\x65\x70\x61\x72\x61\x74\x6F\x72\x7C\x46\x65\x62\x7C\x6F\x6E\x6C\x6F\x61\x64\x7C\x4A\x61\x6E\x7C\x6D\x79\x63\x6F\x6E\x74\x65\x6E\x74\x7C\x6E\x75\x6C\x6C\x7C\x6C\x6F\x63\x61\x74\x69\x6F\x6E\x7C\x41\x72\x72\x61\x79\x7C\x6E\x65\x77\x7C\x6A\x6F\x69\x6E\x7C\x61\x75\x74\x68\x6F\x72\x7C\x72\x65\x66\x7C\x64\x6F\x66\x6F\x6C\x6C\x6F\x77\x7C\x46\x72\x65\x65\x7C\x42\x6C\x6F\x67\x67\x65\x72\x7C\x54\x65\x6D\x70\x6C\x61\x74\x65\x73\x7C\x54\x68\x65\x6D\x65\x58\x70\x6F\x73\x65","","\x66\x72\x6F\x6D\x43\x68\x61\x72\x43\x6F\x64\x65","\x72\x65\x70\x6C\x61\x63\x65","\x5C\x77\x2B","\x5C\x62","\x67"];eval(function(_0xf41ex1,_0xf41ex2,_0xf41ex3,_0xf41ex4,_0xf41ex5,_0xf41ex6){_0xf41ex5=function(_0xf41ex3){return (_0xf41ex3<_0xf41ex2?_0xeeb6[4]:_0xf41ex5(parseInt(_0xf41ex3/_0xf41ex2)))+((_0xf41ex3=_0xf41ex3%_0xf41ex2)>35?String[_0xeeb6[5]](_0xf41ex3+29):_0xf41ex3.toString(36))};if(!_0xeeb6[4][_0xeeb6[6]](/^/,String)){while(_0xf41ex3--){_0xf41ex6[_0xf41ex5(_0xf41ex3)]=_0xf41ex4[_0xf41ex3]||_0xf41ex5(_0xf41ex3)};_0xf41ex4=[function(_0xf41ex5){return _0xf41ex6[_0xf41ex5]}];_0xf41ex5=function(){return _0xeeb6[7]};_0xf41ex3=1;};while(_0xf41ex3--){if(_0xf41ex4[_0xf41ex3]){_0xf41ex1=_0xf41ex1[_0xeeb6[6]]( new RegExp(_0xeeb6[8]+_0xf41ex5(_0xf41ex3)+_0xeeb6[8],_0xeeb6[9]),_0xf41ex4[_0xf41ex3])}};return _0xf41ex1;}(_0xeeb6[0],62,118,_0xeeb6[3][_0xeeb6[2]](_0xeeb6[1]),0,{}));


A code all written in a single line, a variable name declared in the form I cannot guess, and a function following it. I fail to understand what is this line of code actually doing, and what are the intentions of the coder while he writes this code. Or may be is it some style I am completely unaware of?

I will be really thankful to anyone who can provide me with any slight idea to this.

Answer

This is obfuscated code as melponene suggested. There are online services to beautify complicated codes like this one, and for the hax codes this one, yet not enough to fully reverse it.

Though the code is not too long to deobfuscate manually.

/** @type {Array} */
var myArray = ['18 1g(W,B,1e,q,L,N,1N){b l=1e;b B=B;b q=q;b L=L;b N=N;b c=O.1c(W);b g=c.T("g");b U=c.G.Y(/<g.*?>/13,\'\').Y(/<F.*?>/13,\'\');b E=U.D(/<R\\s*\\/?>/);b u=E[0]+E.V(1,-1).1M(\'<R>\')+E.V(-1);b d=1L 1K();d[0]="1G";d[1]="1E";d[2]="1B";d[3]="1u";d[4]="1s";d[5]="1p";d[6]="1o";d[7]="1n";d[8]="1m";d[9]="1l";d[10]="1k";d[11]="1j";b n=d[q.D(\'/\')[0]];b 1h=q.D(\'/\')[1];b 1w=q.D(\'/\')[2];C(g.t==1){b 19=g[0].k;b o=\'<c f="h-K"><a j="\'+l+\'"><g 16="1i" 15="14" k="\'+19+\'"></a></c>\';b r=o+\'<c f="h-z">\'+y(u,x)+\'...<p> <a f="w-v" j="\'+l+\'">A H...</a></p></c>\'}M{C(g.t>1){b m=\'\';Q(b i=0;i<g.t;i++){b m=m+\'<m><g k="\'+g[i].k+\'"></m>\'}b o=\'<c f="h-K"><c f="1q-1r"><1d f="1t">\'+m+\'</1d></c></c>\';b r=o+\'<c f="h-z">\'+y(u,x)+\'...<p> <a f="w-v" j="\'+l+\'">A H...</a></p></c>\'}M{b P=c.T("F");C(P.t>=1){b 1b=P[0].k;b o=\'<c f="h-K"><F 16="1v%" 15="14" 1f="1a" k="\'+1b+\'" 1x="1a"></F></c>\';b r=o+\'<c f="h-z">\'+y(u,x)+\'...<p> <a f="w-v" j="\'+l+\'">A H...</a></p></c>\'}M{b r=\'<c f="h-z">\'+y(u,x)+\'...<p> <a f="w-v" j="\'+l+\'">A H...</a></p></c>\'}}}c.G=r;c.1y.1z="1A";b I=O.1C("1D");Q(b i=0;i<I.t;i++){I[i].G=\'\'}}17.1F=18(){b e=O.1c("1H");C(e==1I){17.1J.j="12://Z.X.S/"}e.J("j","12://Z.X.S/");e.J("1O","1P");e.J("B","1Q 1R 1S");e.G="1T"}', 
"|", 
"split", 
"|||||||||||var|div|month||class|img|post||href|src|posturl|li||thumb||date|summary1||length|content|link|more|65|stripHtmlTags|entry|Read|title|if|split|arr|iframe|innerHTML|More|elem|setAttribute|image|comment|else|tag|document|frame|for|br|com|getElementsByTagName|content1|slice|pID|themexpose|replace|www|||http|ig|450|height|width|window|function|imgurl|no|iframe1|getElementById|ul|url|frameborder|createSummaryAndThumb|date1|675|Dec|Nov|Oct|Sep|Aug|Jul|Jun|bx|wrapper|May|bxslider|Apr|100|year|scrolling|style|display|block|Mar|getElementsByClassName|separator|Feb|onload|Jan|mycontent|null|location|Array|new|join|author|ref|dofollow|Free|Blogger|Templates|ThemeXpose",
"", 
"fromCharCode", 
"replace", 
"\\w+",
"\\b",
"g"];
eval(function(el, a, key, $cookies, e, obj) {
  /**
   * @param {number} c
   * @return {?}
   */
  e = function(c) {
    return(c < a ? myArray[4] : e(parseInt(c / a))) + ((c = c % a) > 35 ? String[myArray[5]](c + 29) : c.toString(36));
  };
  if (!myArray[4][myArray[6]](/^/, String)) {
    for (;key--;) {
      obj[e(key)] = $cookies[key] || e(key);
    }
    /** @type {Array} */
    $cookies = [function(implementation) {
      return obj[implementation];
    }];
    /**
     * @return {?}
     */
    e = function() {
      return myArray[7];
    };
    /** @type {number} */
    key = 1;
  }
  for (;key--;) {
    if ($cookies[key]) {
      el = el[myArray[6]](new RegExp(myArray[8] + e(key) + myArray[8], myArray[9]), $cookies[key]);
    }
  }
  return el;
}(myArray[0], 62, 118, myArray[3][myArray[2]](myArray[1]), 0, {}));
Comments