How to call an item of a Javascript array?

Question

Say I have the following Javascript array:

var _0xe984=[ '\x61\x70\x70\x6c\x79',
  '\x72\x65\x74\x75\x72\x6e\x20\x28\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x28\x29\x20',
  '\x7b\x7d\x2e\x63\x6f\x6e\x73\x74\x72\x75\x63\x74\x6f\x72\x28\x22\x72\x65\x74\x75\x72\x6e\x20\x74\x68\x69\x73\x22\x29\x28\x29',
  '\x69\x74\x65\x6d', '\x65\x76\x61\x6c', 
  '\x77\x68\x69\x6c\x65\x28\x74\x72\x75\x65\x29\x7b\x7d',
  '\x5b\x62\x62\x4e\x6a\x6b\x59\x56\x63\x6e\x64\x76\x75\x53\x67\x4a\x67\x50\x55\x65\x6d\x51\x5d',
  '\x77\x61\x62\x62\x4e\x6a\x6b\x59\x56\x63\x69\x72\x2e\x69\x6e\x64\x6f\x76\x75\x53\x67\x4a\x67\x50\x55\x65\x6d\x51',
  '\x72\x65\x70\x6c\x61\x63\x65', '\x66\x6f\x72\x45\x61\x63\x68',
  '\x63\x6f\x6e\x73\x74\x72\x75\x63\x74\x6f\x72',
  ...<TRUNCATED FOR READABILITY>...,
  '\x64\x65\x62\x75\x67\x67\x65\x72'];

I used jsnice.org to deobfuscate this code, and I got:

_0xe984("0xa")

My question is whether _0xe984("0xa") is equivalent to _0xe984.10?

Answer 1

The variable _0xe984 in your example is an array of strings, therefore, calling it with _0xe984("0xa") is actually to call as if it was a function that gets the string "0xa" as a parameter. Thus, the interpreter will throw an exception because _0xe984 is not a function.

However, calling _0xe984[0xa] will output the item in the index 0xa (i.e index 10) of the array _0xe984. So if the decoded array is looking like this:

var _0xe984 =["apply", "return (function () ", "{}.constructor("return this")()", "item", "eval", "while(true){}", "[bbNjkYVcndvuSgJgPUemQ]", "wabbNjkYVcir.indovuSgJgPUemQ", "replace", "forEach", "constructor", "return this", "length", "charCodeAt", "indexOf", "ws://gameserver.wair.uk.to:888",...]

the tenth item of the array is constructor.

Another situation which you might encounter with obfuscated Javascript code is that a property of an object is called as if the object was an array. For example, instead of writing document.createElement(...) you can write document['createElement'](...). Therefore it is possible that you'll see something like that _0xe984[_0xe984[0xc]] which will call the property length of the array object _0xe984 ('length' is the 12th/0xc item in the array) and that will result with the length of the array (124).

Answer 2

you can use powershell to get the ith element in the array like this

:\>([regex]::Unescape((Get-Content .\copypaste.txt))).Split(",")[10]
'constructor'