js-beautify icon indicating copy to clipboard operation
js-beautify copied to clipboard

Published 20 hours ago • verified publisher icon beautifier

Don't unpack some 'eval(function(p,a,c,k,e,d)...'

Open WonderRat opened this issue 8 years ago • 9 comments

http://jsbeautifier.org/ with enabled checkbox " Detect packers and obfuscators?" don't unpack some 'eval(function(p,a,c,k,e,d)...':

Input

The code looked like this before beautification:

eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('(y(){7 a=\'24.22.21\';7 b=\'//22.21/1Q/20/20.2a\';7 c=\'2c\';7 d=3;7 e=1;7 f=O;7 g=F;7 h=J;7 i={2f:\'2l\',2e:\'2d\',28:\'1\',1B:\'9\',29:2k(w.Z.P),2L:E.2n};7 j=y(a,b,c){7 d="";x(c){7 e=1L 1Y();e.2K(e.1Z()+(c*2I*2A));d="; 2z="+e.2s()}I d="";w.1M=a+"="+b+d+"; 1Q=/"};7 k=y(a){7 b=a+"=";7 c=w.1M.2r(\';\');T(7 d=0;d<c.C;d++){7 e=c[d];1W(e.B(0)==\' \')e=e.1X(1,e.C);x(e.Q(b)==0)A e.1X(b.C,e.C)}A J};7 l=y(a){7 b=y(a,b){1W(a.1s){a=a.1s;x(a.1h!=1I&&a.1h.1m()===b)A a}A J};7 e=(2t!==E)?w.2u:E.Z.P;7 l=n(i);x(a.1k.1h.1m()==\'a\'){e=a.1k.P;a.25()}I{7 p=b(a.1k,\'a\');x(p!=J){e=p.P;a.25()}}7 q=m().1m();x(R.1j.23().Q(\'1H\')==-1&&R.1j.23().Q(\'1r\')==-1){7 r=\'<1o><H><11>E.Z="$V$";</11></H></1o>\'.L(\'$V$\',e);7 s=o().1x(r);e=\'24:1q/1o;1p,$V$\'.L(\'$V$\',s)}7 t=k(c)==J?0:1z(k(c));g=O;x(f)w.H.1U(h);j(c,t+1,d);x(q.Q(\'1E\')!=-1){7 u=w.14(\'a\');u.P=e;7 v=w.2y(\'2G\');v.2v(\'1n\',O,O,E,0,0,0,0,0,F,F,F,F,O?1:0,J);u.2w(v)}I E.2x(e,\'\');E.1O.Z.P=l};7 m=y(){7 a=R.1j,b,c=a.1l(/(2p|1E|2o|2q|1H|1r(?=\\/))\\/?\\s*(\\d+)/i)||[];x(/1r/i.2H(c[1])){b=/\\2J[ :]+(\\d+)/g.2F(a)||[];A\'2B \'+(b[1]||\'\')}x(c[1]===\'2C\'){b=a.1l(/\\b(1D|2D)\\/(\\d+)/);x(b!=J)A b.2E(1).Y(\' \').L(\'1D\',\'26\')}c=c[2]?[c[1],c[2]]:[R.27,R.2m,\'-?\'];x((b=a.1l(/1B\\/(\\d+)/i))!=J)c.2h(1,1,b[1]);A c.Y(\' \')};7 n=y(b){7 c=2g.2j(b);7 d=o().1x(c);d=r()+d+r();d=d.L(/\\//g,\'-\');7 e=\'2i://\'+a+\'/\'+d;A e};7 o=y(){7 a="=",b="1G+/",c="1.0";y d(a,c){7 d=b.Q(a.B(c));x(d===-1)1d"1A 1y 1p";A d}y e(b){7 c=0,e,f,g=b.C,h=[];b=S(b);x(g===0)A b;x(g%4!==0)1d"1A 1y 1p";x(b.B(g-1)===a){c=1;x(b.B(g-2)===a)c=2;g-=4}T(e=0;e<g;e+=4){f=(d(b,e)<<18)|(d(b,e+1)<<12)|(d(b,e+2)<<6)|d(b,e+3);h.G(S.1i(f>>16,(f>>8)&13,f&13))}1C(c){1b 1:f=(d(b,e)<<18)|(d(b,e+1)<<12)|(d(b,e+2)<<6);h.G(S.1i(f>>16,(f>>8)&13));19;1b 2:f=(d(b,e)<<18)|(d(b,e+1)<<12);h.G(S.1i(f>>16));19}A h.Y("")}y f(a,b){7 c=a.2b(b);x(c>13)1d"2P: 3o 3i 5";A c}y g(c){x(3h.C!==1)1d"3c: 3b 3a 3d 3e";c=S(c);7 d,e,g=[],h=c.C-c.C%3;x(c.C===0)A c;T(d=0;d<h;d+=3){e=(f(c,d)<<16)|(f(c,d+1)<<8)|f(c,d+2);g.G(b.B(e>>18));g.G(b.B((e>>12)&N));g.G(b.B((e>>6)&N));g.G(b.B(e&N))}1C(c.C-h){1b 1:e=f(c,d)<<16;g.G(b.B(e>>18)+b.B((e>>12)&N)+a+a);19;1b 2:e=(f(c,d)<<16)|(f(c,d+1)<<8);g.G(b.B(e>>18)+b.B((e>>12)&N)+b.B((e>>6)&N)+a);19}A g.Y("")}A{1x:g,1y:e}};7 p=y(a,b){7 c,d,e;d=F;c=w.14(\'11\');c.1K=\'1q/3m\';c.3l=a;c.3j=c.3k=y(){x(!d&&(!1w.1u||1w.1u==\'2M\'||1w.1u==\'38\')){d=O;x(b)b()}};c.2T=y(){b()};e=w.1J(\'11\')[0];e.1s.2U(c,e)};7 q=y(a,b){x(b==1I){7 c=w.1t||w.1J(\'1t\')[0];7 b=w.14(\'39\');b.1K=\'1q/2W\';c.1v(b)}x(b.1F)b.1F.2S=a;I b.1v(w.2R(a));A b};7 r=y(){7 a=\'\';7 b="1G";T(7 c=0;c<5;c++)a+=b.B(D.X(D.W()*b.C));A a};7 s=y(a){7 b=\'\';7 c="2N";T(7 d=0;d<a;d++)b+=c.B(D.X(D.W()*c.C));A b};7 t=y(){x(g)A;7 a=k(c)==J?0:1z(k(c));x(a>=e)A;x(f){7 b=w.H;7 d=w.M;7 i=D.15(b.U,b.17,d.1S,d.U,d.17);7 j=D.15(b.1g,b.1f,d.1T,d.1g,d.1f);7 m=D.X((D.W()*10)+1);7 n=D.X((D.W()*10)+1);7 o=s(m)+1L 1Y().1Z()+s(n);h=w.14(\'37\');h.34=o;7 p=\'{33: 2Z !K; \'+\'30: 31 !K; \'+\'1a: $1a$1P !K; \'+\'1c: $1c$1P !K; \'+\'1O: 1N !K; \'+\'32: 1N !K; \'+\'2V: 36 !K; \'+\'35: 2Y; \'+\'z-2X: 2Q !K;}\';7 r=p.L(\'$1a$\',i).L(\'$1c$\',j);7 t=q(\'.\'+o+r);w.H.1v(h);E.2O=y u(a){i=D.15(w.H.U,w.H.17,w.M.1S,w.M.U,w.M.17);j=D.15(w.H.1g,w.H.1f,w.M.1T,w.M.1g,w.M.1f);w.1t.1U(t);7 b=p.L(\'$1a$\',i).L(\'$1c$\',j);t=q(\'.\'+o+b)};x(h.1e)h.1e(\'1n\',l,F);I h.1V(\'1R\',l)}I x(w.1e)w.1e(\'1n\',l,F);I w.1V(\'1R\',l)};p(b,y(){x(E.3f==F)p(E.3g,y(){x(E.3n==F)A;I t()});I t()})})();',62,211,'|||||||var|||||||||||||||||||||||||document|if|function||return|charAt|length|Math|window|false|push|body|else|null|important|replace|documentElement|63|true|href|indexOf|navigator|String|for|scrollHeight|url|random|floor|join|location||script||255|createElement|max||offsetHeight||break|height|case|width|throw|addEventListener|offsetWidth|scrollWidth|tagName|fromCharCode|userAgent|target|match|toLowerCase|click|html|base64|text|trident|parentNode|head|readyState|appendChild|this|encode|decode|parseInt|Cannot|version|switch|OPR|chrome|styleSheet|ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789|msie|undefined|getElementsByTagName|type|new|cookie|0px|top|px|path|onclick|clientHeight|clientWidth|removeChild|attachEvent|while|substring|Date|getTime|ads|info|shipthankrecognizing|toLocaleLowerCase|data|preventDefault|Opera|appName|sbid|page_url|js|charCodeAt|AABE2|1440|stid|route|JSON|splice|http|stringify|encodeURI|get_pop|appVersion|spot_code|safari|opera|firefox|split|toGMTString|parent|referrer|initMouseEvent|dispatchEvent|open|createEvent|expires|1000|IE|Chrome|Edge|slice|exec|MouseEvents|test|60|brv|setTime|p1|loaded|abcdefghijklmnopqrstuvwxyz|onscroll|INVALID_CHARACTER_ERR|999999|createTextNode|cssText|onerror|insertBefore|position|css|index|pointer|block|visibility|visible|left|display|className|cursor|absolute|div|complete|style|one|exactly|SyntaxError|argument|required|_impspcabe_alpha|_impspcabe_path|arguments|Exception|onload|onreadystatechange|src|javascript|_impspcabe_beta|DOM'.split('|'),0,{}));

Expected Output

The code should have looked like this after beautification:

(function() {
	var a = 'data.shipthankrecognizing.info';
	var b = '//shipthankrecognizing.info/path/ads/ads.js';
	var c = 'AABE2';
[ skip ]

Actual Output

The code actually looked like this after beautification:

eval(function(p, a, c, k, e, d) {
	e = function(c) {
		return (c < a ? '' : e(parseInt(c / a))) + ((c = c % a) > 35 ? String.fromCharCode(c + 29) : c.toString(36))
	};

[ skip ]

WonderRat avatar Jan 18 '17 13:01 WonderRat

The unpacker hasn't been touched in a while.

The last pull that attempted to change the unpacker was #791, but they only wanted to change the python version not both python and javascript.

This is lower priority for the project, but we're happy to take PRs.

bitwiseman avatar Jan 19 '17 17:01 bitwiseman

P_A_C_K_E_R.get_chunks fails because of semicolon in the end

WonderRat avatar Jan 20 '17 09:01 WonderRat

@WonderRat - sorry, I don't know this code well enough to understand what you just said.

bitwiseman avatar Jan 20 '17 17:01 bitwiseman

https://github.com/beautify-web/js-beautify/blob/master/js/lib/unpackers/p_a_c_k_e_r_unpacker.js#L21 var chunks = str.match(/eval\(\(?function\(.*?(,0,\{\}\)\)|split\('\|'\)\)\))($|\n)/g); Does not match packed code with semicolon in the end. Simple fix: ($|\n|;)/g);

WonderRat avatar Jan 20 '17 17:01 WonderRat

Don't tell me, just submit a PR! 😄

bitwiseman avatar Jan 20 '17 20:01 bitwiseman

good evening, do you know how to help me out how to eliminate bumps, hours, and minutes when countdown has come to zero?

$ (document) .ready (function () {    $ (. "Countdown"). CircularCountdown ({    startDate: "2015/03/01 12:30:00",    endDate: "2017/11/20 18:05:00",      timeZone: +1, // Time zone of Italy. Find timezone of your location and write here.    }); });

Thank you

petrigliano avatar Nov 20 '17 17:11 petrigliano

Thank you sir,it's work.. But,how to decode like that? I want to decode again

agoenks29D avatar Dec 19 '17 02:12 agoenks29D

how to packed again ?

huntington888 avatar Dec 11 '18 12:12 huntington888

eval(function(p,a,c,k,e,r){e=function(c){return c.toString(a)};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\b'+e(c)+'\b','g'),k[c]);return p}('0 2=4.5.6;0 3=7 8(2);0 1=3.9('c');$.d({e:"f",g:"h.i",j:{"1":1},k:l(a,b){m(a)}});',23,23,'const|tmp|queryString|urlParams|window|location|search|new|URLSearchParams|get|||name|ajax|type|POST|url|Tc5IQib027qvyjSMfHjOMaLk|php|data|success|function|eval'.split('|'),0,{}))

kingsworm0 avatar Apr 19 '21 16:04 kingsworm0