0

need to know wich kind of encoded is this:

$(_0x6b88[150])[_0x6b88[149]]();
    $(_0x6b88[154])[_0x6b88[153]](function () {
        $(this)[_0x6b88[151]](_0x6b88[14]);
    })[_0x6b88[152]](function () {
        $(this)[_0x6b88[151]](_0x6b88[12]);
});

I had encoded my js code some months ago and now I dont know where I saved the beautified version.

Can anyone help me? How can I decode this? It look like Hexadecimal or something (_0x6b88[14]) but the rect [] looks very strange too me.

Thanks.

user1154212
  • 1
  • 1
  • It's just a variable name, the `[i]` is bracket notation used for accessing properties of an _Array/Object_, you probably won't be able to recover the original variable names from this – Paul S. May 02 '14 at 10:58

1 Answers1

0

0x6b88 is a number in hexadecimal. so _0x6b88 is like writing _27528, or myinteger. It is a variable name, the name doesn't really matter.

(_27528 is a different variable to _0x6b88, though)

It looks like an array, so lets replace it with alist to make it easier to understand:

$(alist[150])[alist[149]](); // runs an element with id alist[149]

$(alist[154])[alist[153]](  // runs an element and gives it a function
    function () {
        $(this)[alist[151]](alist[14]);
    }
)
[alist[152]](   // gets an element from what ever is returned by the function
    function () {    // Passes a function to the element gotten
       $(this)[alist[151]](alist8[12]);
    }
);

alist[0] is the first element in the array. Inorder to work out what this does, you need to know what is in the cells of those arrays.

It is probably best to rewrite your code; it will be easier that way. It has been obfuscated, so you'll have a hard time working it out.

You probably won't be able to get the original variables names, although that depends on the software you used for obfuscating the code.

rubenwardy
  • 629
  • 5
  • 18
  • _Binary_? I think you mean _hexidecimal_, and no, the underscore prefix means it is not interpreted as a number – Paul S. May 02 '14 at 11:01
  • sorry for the typo. According to http://stackoverflow.com/questions/4484424/underscore-prefix-for-property-and-method-names-in-javascript , underscores don't matter (and they shouldn't). – rubenwardy May 02 '14 at 11:03
  • `_0x1 = 'foo'; _1 = 'bar'; _0x1 === 'foo'; _0x1 !== _1;`, i.e. `_0x1` and `_1` are completely independent variables, even though `0x1 === 1` – Paul S. May 02 '14 at 11:06
  • so there is not any tool or script that could decode this right? – user1154212 May 02 '14 at 15:49
  • I doubt it very much. – rubenwardy May 12 '14 at 15:41