<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Novocained &#187; Tips</title>
	<atom:link href="http://novocained.com/tag/tips/feed/" rel="self" type="application/rss+xml" />
	<link>http://novocained.com</link>
	<description>Another dose of Technology!!</description>
	<lastBuildDate>Tue, 01 Dec 2009 11:26:05 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>How to unpack a packed javascript!</title>
		<link>http://novocained.com/uncategorized/how-to-unpack-a-packed-javascript/</link>
		<comments>http://novocained.com/uncategorized/how-to-unpack-a-packed-javascript/#comments</comments>
		<pubDate>Tue, 28 Apr 2009 11:55:47 +0000</pubDate>
		<dc:creator>Aditya</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[Javascript]]></category>
		<category><![CDATA[Tips]]></category>
		<category><![CDATA[Tricks]]></category>

		<guid isPermaLink="false">http://novocained.com/uncategorized/how-to-unpack-a-packed-javascript/</guid>
		<description><![CDATA[Sometimes malicious scripts float around and you are asked to run them in your browser by script kiddies. You try and have a look at the code, and find it all to be obfuscated something like function(p,a,c,k,e,d){…}. It is actually a packed version so that ‘normal’ users cannot modify it for their own purpose. But [...]]]></description>
			<content:encoded><![CDATA[<p>Sometimes malicious scripts float around and you are asked to run them in your browser by script kiddies. You try and have a look at the code, and find it all to be obfuscated something like function(p,a,c,k,e,d){…}. It is actually a packed version so that ‘normal’ users cannot modify it for their own purpose. But this script can be easily unpacked without using any third party tool. I will explain how can it be done in Firefox.</p>
<p><span id="more-114"></span></p>
<p><div class="note"><div class="notewarning"> This is an informational post only, and has no intent of encouraging malicious attacks via javascript. </div></div></p>
<p>For this example I will use this javascipt :</p>
<pre class="javascript">function demoMatchClick() {
  var re = new RegExp(document.demoMatch.regex.value);
  if (document.demoMatch.subject.value.match(re)) {
    alert("Successful match");
  } else {
    alert("No match");
  }
}

function demoShowMatchClick() {
  var re = new RegExp(document.demoMatch.regex.value);
  var m = re.exec(document.demoMatch.subject.value);
  if (m == null) {
    alert("No match");
  } else {
    var s = "Match at position " + m.index + ":n";
    for (i = 0; i &lt; m.length; i++) {
      s = s + m[i] + "n";
    }
    alert(s);
  }
}

function demoReplaceClick() {
  var re = new RegExp(document.demoMatch.regex.value, "g");
  document.demoMatch.result.value =
    document.demoMatch.subject.value.replace(re,
      document.demoMatch.replacement.value);
}</pre>
<p>After packing it from <a href="http://dean.edwards.name/packer/">here</a>, I get this</p>
<pre>eval(function(p,a,c,k,e,r){e=function(c){return c.toString(a)};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\b'+e(c)+'\b','g'),k[c]);return p}('7 h(){4 a=8 9(1.2.b.3);d(1.2.c.3.5(a)){6("j 5")}e{6("f 5")}}7 k(){4 a=8 9(1.2.b.3);4 m=a.l(1.2.c.3);d(m==o){6("f 5")}e{4 s="p q r "+m.t+":\n";u(i=0;i&lt;m.v;i++){s=s+m[i]+"\n"}6(s)}}7 w(){4 a=8 9(1.2.b.3,"g");1.2.x.3=1.2.c.3.ya,1.2.z.3)}',36,36,'|document|demoMatch|value|var|match|alert|function|new|RegExp||regex|subject|if|else|No||demoMatchClick||Successful|demoShowMatchClick|exec|||null|Match|at|position||index|for|length|demoReplaceClick|result|replace|replacement'.split('|'),0,{}))</pre>
<p>To unpack it in Firefox,</p>
<ul>
<li>Goto Tools-&gt;Error Console (or Ctrl+Shift+J).</li>
<li>Paste the packed script in input box</li>
<li>Add “eval = alert;” (without quotes) before the packed script.</li>
<li>Hit Evaluate, a pop up shows the unpacked script as</li>
</ul>
<ul><a href="http://novocained.com/blog/wp-content/uploads/2009/04/image.png"><img style="border-top-width: 0px; display: block; border-left-width: 0px; float: none; border-bottom-width: 0px; margin-left: auto; margin-right: auto; border-right-width: 0px" title="image" src="http://novocained.com/blog/wp-content/uploads/2009/04/image-thumb.png" border="0" alt="image" width="574" height="108" /></a></p>
<li><span style="color: #555555;">Press Ctrl + A to select all the text. Paste it to notepad.</span></li>
</ul>
<p>You got the original javascript back! This is pretty useful while analyzing malicious code to find a solution to counter-attack(or stop) that code.</p>
]]></content:encoded>
			<wfw:commentRss>http://novocained.com/uncategorized/how-to-unpack-a-packed-javascript/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

