2

Say I have the following Javascript array:

var _0xe984=[ '\x61\x70\x70\x6c\x79',
  '\x72\x65\x74\x75\x72\x6e\x20\x28\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x28\x29\x20',
  '\x7b\x7d\x2e\x63\x6f\x6e\x73\x74\x72\x75\x63\x74\x6f\x72\x28\x22\x72\x65\x74\x75\x72\x6e\x20\x74\x68\x69\x73\x22\x29\x28\x29',
  '\x69\x74\x65\x6d', '\x65\x76\x61\x6c', 
  '\x77\x68\x69\x6c\x65\x28\x74\x72\x75\x65\x29\x7b\x7d',
  '\x5b\x62\x62\x4e\x6a\x6b\x59\x56\x63\x6e\x64\x76\x75\x53\x67\x4a\x67\x50\x55\x65\x6d\x51\x5d',
  '\x77\x61\x62\x62\x4e\x6a\x6b\x59\x56\x63\x69\x72\x2e\x69\x6e\x64\x6f\x76\x75\x53\x67\x4a\x67\x50\x55\x65\x6d\x51',
  '\x72\x65\x70\x6c\x61\x63\x65', '\x66\x6f\x72\x45\x61\x63\x68',
  '\x63\x6f\x6e\x73\x74\x72\x75\x63\x74\x6f\x72',
  ...<TRUNCATED FOR READABILITY>...,
  '\x64\x65\x62\x75\x67\x67\x65\x72'];

I used jsnice.org to deobfuscate this code, and I got:

_0xe984("0xa")

My question is whether _0xe984("0xa") is equivalent to _0xe984.10?

  • This is an array of strings, you can access them as _0xe984[INDEX].. jsbeautifier.org has an option "Unescape printable chars encoded as \xNN or \uNNNN?" if thats what you are looking for – Sigtran Jul 30 '17 at 18:03
2

The variable _0xe984 in your example is an array of strings, therefore, calling it with _0xe984("0xa") is actually to call as if it was a function that gets the string "0xa" as a parameter. Thus, the interpreter will throw an exception because _0xe984 is not a function.

However, calling _0xe984[0xa] will output the item in the index 0xa (i.e index 10) of the array _0xe984. So if the decoded array is looking like this:

var _0xe984 =["apply", "return (function () ", "{}.constructor("return this")()", "item", "eval", "while(true){}", "[bbNjkYVcndvuSgJgPUemQ]", "wabbNjkYVcir.indovuSgJgPUemQ", "replace", "forEach", "constructor", "return this", "length", "charCodeAt", "indexOf", "ws://gameserver.wair.uk.to:888",...]

the tenth item of the array is constructor.

Another situation which you might encounter with obfuscated Javascript code is that a property of an object is called as if the object was an array. For example, instead of writing document.createElement(...) you can write document['createElement'](...). Therefore it is possible that you'll see something like that _0xe984[_0xe984[0xc]] which will call the property length of the array object _0xe984 ('length' is the 12th/0xc item in the array) and that will result with the length of the array (124).

0

you can use powershell to get the ith element in the array like this

:\>([regex]::Unescape((Get-Content .\copypaste.txt))).Split(",")[10]
'constructor'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.