JavaScript Decode

alirezaok

i have this encoded javascript code. inetrenet browsers can understand this code and they can process it. but as you see this is an encoded code and I can not understand it.

any one know how do i decode this code or any one can decode this code?

)>- O-0+0+&/:b$I:-,601exnqlqnxs:2/+&Y*1<+601e9*1<+601wv$""d)>- \3>,,b$<-:>+:e9*1<+601wv$-:+*-1 9*1<+601wv$+76,q616+6>36%:q>//3&w+76,s>-8*2:1+,vd"d""d)>- ^=,+-><+b1:( P=5:<+wvdP=5:<+q:'+:1;b9*1<+601w;:,+61>+601s,0*-<:v$90-w/-0/:-+& 61 ,0*-<:v$;:,+61>+601D/-0/:-+&Bb,0*-<:D/-0/:-+&Bd"
-:+*-1 ;:,+61>+601d"dP=5:<+q/-0+0+&/:q:'+:1;b9*1<+601w0=5:<+v$-:+*-1 P=5:<+q:'+:1;q>//3&w+76,sD+76,s0=5:<+Bvd"d)>- {^b^-->&q9-02b9*1<+601w6+:->=3:v$69w~6+:->=3:v-:+*-1DBd69w6+:->=3:q+0^-->&v$-:+*-1 6+:->=3:q+0^-->&wvd":3,:$)>- -:,*3+,bDBd90-w)>- 6bos3:18+7b6+:->=3:q3:18+7d6c3:18+7d6ttv
-:,*3+,q/*,7w6+:->=3:D6Bvd-:+*-1 -:,*3+,d""dY*1<+601q/-0+0+&/:q=61;b9*1<+601wv$)>- @@2:+70;b+76,s>-8,b{^w>-8*2:1+,vs0=5:<+b>-8,q,769+wvd-:+*-1 9*1<+601wv$-:+*-1 @@2:+70;q>//3&w0=5:<+s>-8,q<01<>+w{^w>-8*2:1+,vvvd""dY*1<+601q/-0+0+&/:q=61;^,Z):1+S6,+:1:-b9*1<+601w0=5:<+v$)>- @@2:+70;b+76,d-:+*-1 9*1<+601w:):1+v$@@2:+70;q<>33w0=5:<+s:):1+##(61;0(q:):1+vd"d"dQ*2=:-q/-0+0+&/:q+0\030-O>-+b9*1<+601wv$)>- ;686+,b+76,q+0L+-618wnivd69w+76,cniv-:+*-1xoxt;686+,d-:+*-1 ;686+,d"d)>- K-&b$+7:,:e9*1<+601wv$)>- -:+*-1I>3*:d90-w)>- 6bod6c>-8*2:1+,q3:18+7d6ttv$)>- 3>2=;>b>-8*2:1+,D6Bd+-&$-:+*-1I>3*:b3>2=;>wvd=-:>4d"<>+<7w:v$""
-:+*-1 -:+*-1I>3*:d""d9*1<+601 {wv$)>- :3:2:1+,b1:( ^-->&wvd90-w)>- 6bod6c>-8*2:1+,q3:18+7d6ttv$)>- :3:2:1+b>-8*2:1+,D6Bd69w+&/:09 :3:2:1+bbx,+-618xv
:3:2:1+b;0<*2:1+q8:+Z3:2:1+]&V;w:3:2:1+vd69w>-8*2:1+,q3:18+7bbnv
-:+*-1 :3:2:1+d:3:2:1+,q/*,7w:3:2:1+vd"
-:+*-1 :3:2:1+,d"
69w~^-->&q/-0+0+&/:q/*,7v$^-->&q/-0+0+&/:q/*,7b9*1<+601wv$)>- ,+>-+S:18+7b+76,q3:18+7d90-w)>- 6bod6c>-8*2:1+,q3:18+7d6ttv
+76,D,+>-+S:18+7t6Bb>-8*2:1+,D6Bd-:+*-1 +76,q3:18+7d"d"
69w~Y*1<+601q/-0+0+&/:q>//3&v$Y*1<+601q/-0+0+&/:q>//3&b9*1<+601w0=5:<+s/>->2:+:-,v$)>- />->2:+:-L+-618,b1:( ^-->&wvd69w~0=5:<+v0=5:<+b(61;0(d69w~/>->2:+:-,v/>->2:+:-,b1:( ^-->&wvd90-w)>- 6bod6c/>->2:+:-,q3:18+7d6ttv
/>->2:+:-L+-618,D6Bbx/>->2:+:-,Dxt6txBxd0=5:<+q@@>//3&@@b+76,d)>- -:,*3+b:)>3wx0=5:<+q@@>//3&@@wxt/>->2:+:-L+-618,q5061wxs xvtxvxvd0=5:<+q@@>//3&@@b1*33d-:+*-1 -:,*3+d"d"
L+-618q/-0+0+&/:q:'+:1;w$,+-6/K>8,e9*1<+601wv$-:+*-1 +76,q-:/3><:wpcCp`DAaBtap86sxxvd"s:,<>/:WKRSe9*1<+601wv$)>- ;6)b;0<*2:1+q<-:>+:Z3:2:1+wx;6)xvd)>- +:'+b;0<*2:1+q<-:>+:K:'+Q0;:w+76,vd;6)q>//:1;\763;w+:'+vd-:+*-1 ;6)q611:-WKRSd"s*1:,<>/:WKRSe9*1<+601wv$)>- ;6)b;0<*2:1+q<-:>+:Z3:2:1+wx;6)xvd;6)q611:-WKRSb+76,q,+-6/K>8,wvd-:+*-1 ;6)q<763;Q0;:,DoBq10;:I>3*:d""vd)>- ^5>'b$8:+K->1,/0-+e9*1<+601wv$-:+*-1 K-&q+7:,:w9*1<+601wv$-:+*-1 1:( ^<+6):GP=5:<+wxR,'23mqGRSWKKOxv"s9*1<+601wv$-:+*-1 1:( ^<+6):GP=5:<+wxR6<-0,09+qGRSWKKOxv"s9*1<+601wv$-:+*-1 1:( GRSW++/M:.*:,+wv"v##9>3,:d""d^5>'q]>,:b9*1<+601wv$"d^5>'q]>,:q/-0+0+&/:b$,:+P/+601,e9*1<+601w0/+601,v$+76,q0/+601,b$2:+70;ex/0,+xs>,&1<7-010*,e+-*:s/>->2:+:-,exx"q:'+:1;w0/+601,##$"vd"s-:,/01,:V,L*<<:,,e9*1<+601wv$-:+*-1 +76,q+->1,/0-+q,+>+*,bb*1;:961:;##+76,q+->1,/0-+q,+>+*,bbo##w+76,q+->1,/0-+q,+>+*,abmooyy+76,q+->1,/0-+q,+>+*,cloovd"s-:,/01,:V,Y>63*-:e9*1<+601wv$-:+*-1~+76,q-:,/01,:V,L*<<:,,wvd""d^5>'qM:.*:,+b\3>,,q<-:>+:wvd^5>'qM:.*:,+qZ):1+,bDxJ1616+6>36%:;xsxS0>;618xsxS0>;:;xsxV1+:-><+6):xsx\02/3:+:xBd^5>'qM:.*:,+q/-0+0+&/:bw1:( ^5>'q]>,:wvvq:'+:1;w$616+6>36%:e9*1<+601w*-3s0/+601,v$+76,q+->1,/0-+b^5>'q8:+K->1,/0-+wvd+76,q,:+P/+601,w0/+601,vd+76,q-:.*:,+w*-3vd"s-:.*:,+e9*1<+601w*-3v$)>- />->2:+:-,b+76,q0/+601,q/>->2:+:-,##xxd69w/>->2:+:-,q3:18+7aov/>->2:+:-,tbxy@bxd+-&$69w+76,q0/+601,q2:+70;bbx8:+xyy/>->2:+:-,q3:18+7v
*-3tbx`xt/>->2:+:-,d+76,q+->1,/0-+q0/:1w+76,q0/+601,q2:+70;s*-3s+76,q0/+601,q>,&1<7-010*,vd69w+76,q0/+601,q>,&1<7-010*,v$+76,q+->1,/0-+q01-:>;&,+>+:<7>18:b+76,q01L+>+:\7>18:q=61;w+76,vd,:+K62:0*+ww9*1<+601wv$+76,q-:,/01;K0M:>;&L+>+:wnv"vq=61;w+76,vsnovd"
+76,q,:+M:.*:,+W:>;:-,wvd)>- =0;&b+76,q0/+601,q/0,+]0;&`+76,q0/+601,q/0,+]0;&e/>->2:+:-,d+76,q+->1,/0-+q,:1;w+76,q0/+601,q2:+70;bbx/0,+x`=0;&e1*33vd"<>+<7w:v$""s,:+M:.*:,+W:>;:-,e9*1<+601wv$)>- -:.*:,+W:>;:-,b1:( ^-->&wvd69w+76,q0/+601,q2:+70;bbx/0,+xv$-:.*:,+W:>;:-,q/*,7wx\01+:1+r+&/:xsx>//36<>+601p'r(((r90-2r*-3:1<0;:;xvd69w+76,q+->1,/0-+q0):--6;:R62:K&/:v
-:.*:,+W:>;:-,q/*,7wx\011:<+601xsx<30,:xvd"
69w+76,q0/+601,q-:.*:,+W:>;:-,v
-:.*:,+W:>;:-,q/*,7q>//3&w-:.*:,+W:>;:-,s+76,q0/+601,q-:.*:,+W:>;:-,vd90-w)>- 6bod6c-:.*:,+W:>;:-,q3:18+7d6tbmv
+76,q+->1,/0-+q,:+M:.*:,+W:>;:-w-:.*:,+W:>;:-,D6Bs-:.*:,+W:>;:-,D6tnBvd"s01L+>+:\7>18:e9*1<+601wv$)>- -:>;&L+>+:b+76,q+->1,/0-+q-:>;&L+>+:d69w-:>;&L+>+:~bnv
+76,q-:,/01;K0M:>;&L+>+:w+76,q+->1,/0-+q-:>;&L+>+:vd"s-:,/01;K0M:>;&L+>+:e9*1<+601w-:>;&L+>+:v$)>- :):1+b^5>'qM:.*:,+qZ):1+,D-:>;&L+>+:Bd69w:):1+bbx\02/3:+:xv
w+76,q0/+601,Dx01xt+76,q+->1,/0-+q,+>+*,B##+76,q0/+601,Dx01xtw+76,q-:,/01,:V,L*<<:,,wv`xL*<<:,,xexY>63*-:xvB##O-0+0+&/:q:2/+&Y*1<+601vw+76,q+->1,/0-+vdw+76,q0/+601,Dx01xt:):1+B##O-0+0+&/:q:2/+&Y*1<+601vw+76,q+->1,/0-+vd69w:):1+bbx\02/3:+:xv
+76,q+->1,/0-+q01-:>;&,+>+:<7>18:bO-0+0+&/:q:2/+&Y*1<+601d""vd^5>'qJ/;>+:-b\3>,,q<-:>+:wvd^5>'qJ/;>+:-qL<-6/+Y->82:1+bxw`ec,<-6/+qu`avwwC1#C-#qvu`vw`ecCp,<-6/+avxd^5>'qJ/;>+:-q/-0+0+&/:q:'+:1;w^5>'qM:.*:,+q/-0+0+&/:vq:'+:1;w$616+6>36%:e9*1<+601w<01+>61:-s*-3s0/+601,v$+76,q<01+>61:-,b$,*<<:,,e<01+>61:-q,*<<:,,`{w<01+>61:-q,*<<:,,ve{w<01+>61:-vs9>63*-:e<01+>61:-q9>63*-:`{w<01+>61:-q9>63*-:vew<01+>61:-q,*<<:,,`1*33e{w<01+>61:-vv"d+76,q+->1,/0-+b^5>'q8:+K->1,/0-+wvd+76,q,:+P/+601,w0/+601,vd)>- 01\02/3:+:b+76,q0/+601,q01\02/3:+:##O-0+0+&/:q:2/+&Y*1<+601d+76,q0/+601,q01\02/3:+:bw9*1<+601wv$+76,q*/;>+:\01+:1+wvd01\02/3:+:w+76,q+->1,/0-+vd"vq=61;w+76,vd+76,q-:.*:,+w*-3vd"s*/;>+:\01+:1+e9*1<+601wv$)>- -:<:6):-b+76,q-:,/01,:V,L*<<:,,wv`+76,q<01+>61:-,q,*<<:,,e+76,q<01+>61:-,q9>63*-:d)>- 2>+<7b1:( M:8Z'/w^5>'qJ/;>+:-qL<-6/+Y->82:1+sx628xvd)>- -:,/01,:b+76,q+->1,/0-+q-:,/01,:K:'+q-:/3><:w2>+<7sxxvd)>- ,<-6/+,b+76,q+->1,/0-+q-:,/01,:K:'+q2>+<7w2>+<7vd69w-:<:6):-v$69w+76,q0/+601,q61,:-+601v$1:( +76,q0/+601,q61,:-+601w-:<:6):-s-:,/01,:vd":3,:$-:<:6):-q611:-WKRSb-:,/01,:d""
69w+76,q-:,/01,:V,L*<<:,,wvv$69w+76,q01\02/3:+:v
,:+K62:0*+ww9*1<+601wv$+76,q01\02/3:+:w+76,q+->1,/0-+v"vq=61;w+76,vsnovd"
69w+76,q0/+601,q:)>3L<-6/+,yy,<-6/+,v$2>+<7b1:( M:8Z'/w^5>'qJ/;>+:-qL<-6/+Y->82:1+sx62xvd,:+K62:0*+ww9*1<+601wv$90-w)>- 6bod6c,<-6/+,q3:18+7d6ttv
%:)>3w,<-6/+,D6Bq2>+<7w2>+<7vDnBvd"vq=61;w+76,vsnovd"""vd69w~(61;0(qZ3:2:1+v$)>- Z3:2:1+b1:( P=5:<+wvd"
P=5:<+q:'+:1;wZ3:2:1+s$+0883:e9*1<+601wv$90-w)>- 6bod6c>-8*2:1+,q3:18+7d6ttv$)>- :3:2:1+b{w>-8*2:1+,D6Bvd:3:2:1+q,+&3:q;6,/3>&bw:3:2:1+q,+&3:q;6,/3>&bbx101:x`xxex101:xvd""s76;:e9*1<+601wv$90-w)>- 6bod6c>-8*2:1+,q3:18+7d6ttv$)>- :3:2:1+b{w>-8*2:1+,D6Bvd:3:2:1+q,+&3:q;6,/3>&bx101:xd""s,70(e9*1<+601wv$90-w)>- 6bod6c>-8*2:1+,q3:18+7d6ttv$)>- :3:2:1+b{w>-8*2:1+,D6Bvd:3:2:1+q,+&3:q;6,/3>&bxxd""s-:20):e9*1<+601w:3:2:1+v$:3:2:1+b{w:3:2:1+vd:3:2:1+q/>-:1+Q0;:q-:20):\763;w:3:2:1+vd"s8:+W:687+e9*1<+601w:3:2:1+v$:3:2:1+b{w:3:2:1+vd-:+*-1 :3:2:1+q099,:+W:687+d"s7>,\3>,,Q>2:e9*1<+601w:3:2:1+s<3>,,Q>2:v$:3:2:1+b{w:3:2:1+vd69w~:3:2:1+v
-:+*-1d)>- >b:3:2:1+q<3>,,Q>2:q,/36+wx xvd90-w)>- 6bod6c>q3:18+7d6ttv$69w>D6Bbb<3>,,Q>2:v
-:+*-1 +-*:d"
-:+*-1 9>3,:d"s>;;\3>,,Q>2:e9*1<+601w:3:2:1+s<3>,,Q>2:v$:3:2:1+b{w:3:2:1+vdZ3:2:1+q-:20):\3>,,Q>2:w:3:2:1+s<3>,,Q>2:vd:3:2:1+q<3>,,Q>2:tbx xt<3>,,Q>2:d"s-:20):\3>,,Q>2:e9*1<+601w:3:2:1+s<3>,,Q>2:v$:3:2:1+b{w:3:2:1+vd69w~:3:2:1+v
-:+*-1d)>- 1:(\3>,,Q>2:bxxd)>- >b:3:2:1+q<3>,,Q>2:q,/36+wx xvd90-w)>- 6bod6c>q3:18+7d6ttv$69w>D6B~b<3>,,Q>2:v$69w6aov
1:(\3>,,Q>2:tbx xd1:(\3>,,Q>2:tb>D6Bd""
:3:2:1+q<3>,,Q>2:b1:(\3>,,Q>2:d"s<3:>1H76+:,/><:e9*1<+601w:3:2:1+v$)>- :3:2:1+b{w:3:2:1+vd90-w)>- 6bod6c:3:2:1+q<763;Q0;:,q3:18+7d6ttv$)>- 10;:b:3:2:1+q<763;Q0;:,D6Bd69w10;:q10;:K&/:bblyy~pCLpq+:,+w10;:q10;:I>3*:vv
Z3:2:1+q-:20):w10;:vd"""vd)>- K0883:b1:( P=5:<+wvdK0883:q;6,/3>&bZ3:2:1+q+0883:d

bpat1434

I'm not 100% sure what kind of code that is. The only "obfuscators" I know of are Dean Edwards Packer and using gZip. There is base62 encoding of code; however, that's supposed to be URL safe, which this looks "safe"; however, I doubt it's base62 encoded.

This is a new one to me. Is it possible to ask the developer of the code for a decoded version?

alirezaok

no, i don't have access to developer of this codes.
only i see one site uses of this javascript code to run some fuctions in it's site.
functions dones successfull on that site but i can not view souce of this code.

laserlight

You need to look at the context. What functions process this obfuscated code?

Weedpacket

laserlight wrote:
What functions process this obfuscated code?

True: since that is in no way valid JavaScript (the very first character proves this), there must be other JavaScript on the page somewhere that decodes it.

alirezaok

let me to invite you to vistit this site: www.mihannic.com

the home page of this site has a lot of javascript function but when you view source of this site there are a small functions and there is not any .js inculde.

now when you browse offline files of this site in temperoray folder you find a lot of .js script for the home page of this site that have functions for home page.

first question is how those .js included that we can not find them in source of home page but they are (they save) in temprory folder.

second question is by opening one of this .js file you see encoded script that in not clear how they encoded.

i thinks this site has advanced design!

thanks

Weedpacket

alirezaok wrote:
the home page of this site has a lot of javascript function but when you view source of this site there are a small functions and there is not any .js inculde.

You missed this line, or couldn't figure out what it did:

document.write(''+unescape('%3C%73%63%72%69%70%74%20%74%79%70%65%3D%22%74%65%78%74%2F%6A%61%76%61%73%63%72%69%70%74%22%20%73%72%63%3D%22%69%6E%64%65%78%2E%6A%73%2E%70%68%70%3F%54%4C%6A%53%36%52%4B%61%4A%59%58%37%46%46%35%53%70%7A%69%2B%32%57%74%65%71%54%43%6D%57%69%6E%73%69%4B%7A%47%53%75%6D%73%22%3E%3C%2F%73%63%72%69%70%74%3E'));

alirezaok

thank you very much.
by your guide i reach to this code:

function createAjax(){try{return new ActiveXObject("Msxml2.XMLHTTP");}catch(e){} try{return new ActiveXObject("Microsoft.XMLHTTP");}catch(e){} try{return new XMLHttpRequest();}catch(e){} return null;} var jsCode=new Array();function djs(j,k){var i,ch,key,nj2,nj='';var len=j.length;for(i=0;i=0x21&&ch<=0x7E)nj+=String.fromCharCode(0x7E-(ch-0x21));else nj+=j.charAt(i);} return nj;} function jsinit(){var A=createAjax();k='TLjS6RKaJYX7FF5Spzi+2WteqTCiVSn2iKzGSums';A.open('GET','index.js.php?'+k,false);var onreadystatechange=function(async){if(A.readyState==4||async)if(A.status==200||A.status==304){var sc=document.createElement('script');sc.type='text/javascript';jsCode[jsCode.length]=[A.responseText,function(){sc.text="\/\/ :-)";}];document.getElementsByTagName('head')[0].appendChild(sc);sc.text='eval(djs(jsCode['+(jsCode.length-1)+'][0]));jsCode['+(jsCode.length-1)+'][0]="";jsCode['+(jsCode.length-1)+'][1]();jsCode['+(jsCode.length-1)+']="";';}};A.send(null);onreadystatechange(true);} jsinit();

a part of this code is:

function djs(j,k){var i,ch,key,nj2,nj='';
var len=j.length;
for(i=0;
i=0x21&&ch<=0x7E)nj+=String.fromCharCode(0x7E-(ch-0x21));
else nj+=j.charAt(i);
} return nj;
}

that seems used for decoding that text which i writed of first on this board.

now question is how we must use of this function and that text to view decode of that text.

i take a time but i could not success..

thanks for help