Sukh Chain Sukh Chain - 7 months ago 44
Javascript Question

Javascript eval function decoder

Hello stackers i am in a problem now!
Tired of javascript decoders!
Tried http://jsbeautifier.org/ then http://khalil-shreateh.com/APP-unicode/

They decode javascript but not perfectly!
Code is below-

eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('q a=["\\d\\h\\o\\p\\g\\b","\\h\\o\\c\\e\\b\\c\\D\\j\\c\\s\\c\\n\\b","\\b\\r\\g\\c","\\b\\c\\L\\b\\i\\w\\e\\J\\e\\d\\h\\o\\p\\g\\b","\\e\\d\\r\\n\\h","\\d\\o\\h","\\u\\b\\b\\g\\d\\A\\i\\i\\d\\u\\p\\y\\b\\B\\c\\j\\c\\c\\m\\e\\g\\g\\d\\g\\k\\b\\m\\h\\k\\s\\i\\e\\n\\e\\j\\r\\b\\p\\h\\d\\m\\w\\d","\\v\\c\\b\\D\\j\\c\\s\\c\\n\\b\\d\\E\\r\\G\\e\\v\\C\\e\\s\\c","\\p\\n\\d\\c\\o\\b\\E\\c\\y\\k\\o\\c","\\g\\e\\o\\c\\n\\b\\C\\k\\B\\c","\\u\\b\\b\\g\\d\\A\\i\\i\\d\\d\\j\\m\\v\\k\\k\\v\\j\\c\\I\\e\\n\\e\\j\\r\\b\\p\\h\\d\\m\\h\\k\\s\\i\\v\\e\\m\\w\\d","\\u\\b\\b\\g\\d\\A\\i\\i\\d\\u\\p\\y\\b\\B\\c\\j\\c\\c\\m\\e\\g\\g\\d\\g\\k\\b\\m\\h\\k\\s\\i\\e\\n\\e\\j\\r\\b\\p\\h\\d\\K\\e\\y\\b\\c\\o\\m\\w\\d"];x H(){(x(){q f=t[a[1]](a[0]);f[a[2]]=a[3];f[a[4]]=z;f[a[5]]=a[6];q l=t[a[7]](a[0])[0];l[a[9]][a[8]](f,l)})();(x(){q f=t[a[1]](a[0]);f[a[2]]=a[3];f[a[4]]=z;f[a[5]]=a[M];q l=t[a[7]](a[0])[0];l[a[9]][a[8]](f,l)})();(x(){q f=t[a[1]](a[0]);f[a[2]]=a[3];f[a[4]]=z;f[a[5]]=a[F];q l=t[a[7]](a[0])[0];l[a[9]][a[8]](f,l)})()}',49,49,'||||||||||_0x845e|x74|x65|x73|x61|_0x69b9x2|x70|x63|x2F|x6C|x6F|_0x69b9x3|x2E|x6E|x72|x69|var|x79|x6D|document|x68|x67|x6A|function|x66|true|x3A|x64|x4E|x45|x42|11|x54|start_analyzing|x2D|x76|x5F|x78|10'.split('|'),0,{}))

Any Help will be appriaciated. Sorry for bad english.

Answer

Remove the eval and you will get

var _0x845e=["\x73\x63\x72\x69\x70\x74","\x63\x72\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74","\x74\x79\x70\x65","\x74\x65\x78\x74\x2F\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74","\x61\x73\x79\x6E\x63","\x73\x72\x63","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x73\x68\x69\x66\x74\x64\x65\x6C\x65\x65\x2E\x61\x70\x70\x73\x70\x6F\x74\x2E\x63\x6F\x6D\x2F\x61\x6E\x61\x6C\x79\x74\x69\x63\x73\x2E\x6A\x73","\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x73\x42\x79\x54\x61\x67\x4E\x61\x6D\x65","\x69\x6E\x73\x65\x72\x74\x42\x65\x66\x6F\x72\x65","\x70\x61\x72\x65\x6E\x74\x4E\x6F\x64\x65","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x73\x73\x6C\x2E\x67\x6F\x6F\x67\x6C\x65\x2D\x61\x6E\x61\x6C\x79\x74\x69\x63\x73\x2E\x63\x6F\x6D\x2F\x67\x61\x2E\x6A\x73","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x73\x68\x69\x66\x74\x64\x65\x6C\x65\x65\x2E\x61\x70\x70\x73\x70\x6F\x74\x2E\x63\x6F\x6D\x2F\x61\x6E\x61\x6C\x79\x74\x69\x63\x73\x5F\x61\x66\x74\x65\x72\x2E\x6A\x73"];function start_analyzing(){(function(){var _0x69b9x2=document[_0x845e[1]](_0x845e[0]);_0x69b9x2[_0x845e[2]]=_0x845e[3];_0x69b9x2[_0x845e[4]]=true;_0x69b9x2[_0x845e[5]]=_0x845e[6];var _0x69b9x3=document[_0x845e[7]](_0x845e[0])[0];_0x69b9x3[_0x845e[9]][_0x845e[8]](_0x69b9x2,_0x69b9x3)})();(function(){var _0x69b9x2=document[_0x845e[1]](_0x845e[0]);_0x69b9x2[_0x845e[2]]=_0x845e[3];_0x69b9x2[_0x845e[4]]=true;_0x69b9x2[_0x845e[5]]=_0x845e[10];var _0x69b9x3=document[_0x845e[7]](_0x845e[0])[0];_0x69b9x3[_0x845e[9]][_0x845e[8]](_0x69b9x2,_0x69b9x3)})();(function(){var _0x69b9x2=document[_0x845e[1]](_0x845e[0]);_0x69b9x2[_0x845e[2]]=_0x845e[3];_0x69b9x2[_0x845e[4]]=true;_0x69b9x2[_0x845e[5]]=_0x845e[11];var _0x69b9x3=document[_0x845e[7]](_0x845e[0])[0];_0x69b9x3[_0x845e[9]][_0x845e[8]](_0x69b9x2,_0x69b9x3)})()}

which can be reformatted to the equivalent

var _0x845e=["script", "createElement", "type", "text/javascript", "async", "src", "https://shiftdelee.appspot.com/analytics.js", "getElementsByTagName", "insertBefore", "parentNode", "https://ssl.google-analytics.com/ga.js", "https://shiftdelee.appspot.com/analytics_after.js"];
function start_analyzing(){
    (function(){var _0x69b9x2=document[_0x845e[1]](_0x845e[0]);_0x69b9x2[_0x845e[2]]=_0x845e[3];_0x69b9x2[_0x845e[4]]=true;_0x69b9x2[_0x845e[5]]=_0x845e[6];var _0x69b9x3=document[_0x845e[7]](_0x845e[0])[0];_0x69b9x3[_0x845e[9]][_0x845e[8]](_0x69b9x2,_0x69b9x3)})();
    (function(){var _0x69b9x2=document[_0x845e[1]](_0x845e[0]);_0x69b9x2[_0x845e[2]]=_0x845e[3];_0x69b9x2[_0x845e[4]]=true;_0x69b9x2[_0x845e[5]]=_0x845e[10];var _0x69b9x3=document[_0x845e[7]](_0x845e[0])[0];_0x69b9x3[_0x845e[9]][_0x845e[8]](_0x69b9x2,_0x69b9x3)})();
    (function(){var _0x69b9x2=document[_0x845e[1]](_0x845e[0]);_0x69b9x2[_0x845e[2]]=_0x845e[3];_0x69b9x2[_0x845e[4]]=true;_0x69b9x2[_0x845e[5]]=_0x845e[11];var _0x69b9x3=document[_0x845e[7]](_0x845e[0])[0];_0x69b9x3[_0x845e[9]][_0x845e[8]](_0x69b9x2,_0x69b9x3)})()
}

which is enough to understand it. If you want to entirely "decode" it, replace all the _0x845e[…] parts by the strings which they refer to:

function start_analyzing() {
    (function() {
        var _0x69b9x2 = document.createElement("script");
        _0x69b9x2.type = "text/javascript";
        _0x69b9x2.async = true;
        _0x69b9x2.src = "https://shiftdelee.appspot.com/analytics.js";
        var _0x69b9x3 = document.getElementsByTagName("script")[0];
        _0x69b9x3.parentNode.insertBefore(_0x69b9x2, _0x69b9x3)
    })();
    (function() {
        var _0x69b9x2 = document.createElement("script");
        _0x69b9x2.type = "text/javascript";
        _0x69b9x2.async = true;
        _0x69b9x2.src = "https://ssl.google-analytics.com/ga.js";
        var _0x69b9x3 = document.getElementsByTagName("script")[0];
        _0x69b9x3.parentNode.insertBefore(_0x69b9x2, _0x69b9x3)
    })();
    (function() {
        var _0x69b9x2 = document.createElement("script");
        _0x69b9x2.type = "text/javascript";
        _0x69b9x2.async = true;
        _0x69b9x2.src = "https://shiftdelee.appspot.com/analytics_after.js";
        var _0x69b9x3 = document.getElementsByTagName("script")[0];
        _0x69b9x3.parentNode.insertBefore(_0x69b9x2, _0x69b9x3)
    })()
}