i have this code i'm trying to deobfuscate https://pastebin.com/g5mHpWE4
I used https://beautifier.io/ and http://www.jsnice.org/
but the result is still not good, current code: https://pastebin.com/whfqanxx
much remains coded
example: window [$ (" 0x128 ")] [$ (" 0x11 ")] [$ (" 0x7 ")]
Is it possible to leave this code 100% clean?
Having such code the first thing to do is to analyze what part is the obfuscation algorithm and what's the actual code. Here' it's not that difficult as all the code is on top. So let's analyze it step by step:
var norm = ["cookie", "toUTCString",...
defines an array with string that will be used in the application. Having them in an array and not in the code makes the code more difficult for human to understand but the machine will still managed to parse the code correctly.
So we have an array...
What's next? Following the array there's this function
(function(value, count) {
var fn = function(selected_image) {
for (; --selected_image;) {
value["push"](value["shift"]());
}
};
fn(++count);
})(norm, 144);
What it does it creates a function that can shuffle an array and in the last line (norm, 144) it is being executed with our aforementioned array of strings and the constant value of 144 that will be used to count the number of rounds of the shuffling (+1 -> fn(++count)).
So after this we no longer know the order of string in our defined array norm. In order to know it we would have to execute those two instructions (it might be dangerous if you don't understand what your are doing) or mimic similar behavior in another language and get the result. (["object", "exports", "./IPv6",...]).
So now comes the third part of the obfuscation - this function:
var $ = function(i, fn) {
i = i - 0;
var id = norm[i];
return id;
};
It simply defines a function named $ that, when passed an argument i returns the string from our shuffled array norm.
Now comes the actual code part. Whenever you see code like this $("0x1b1") you would have to replace it by running (or simulating) the call to function $ with the argument and get the result. In this case it would be for 0x1b1 = "hxxps://www.bitonclick.com/jump/next.php?r=1967903" (without xx - a proper address) and for example for $("0x114") = "FuckAdBlock". And so on...
Doing this of all the calls you would get all of the code extracted, but going over this manually can be mundane and error prone so it would be nice to have some kind of automated way of performing this activities.
Doing that (not even for the whole file) would allow to more easily understand the code but from parts of it, it looks like it might be injecting some ads on the page (it might not be the only purpose of it) - as one can see in the strings "Ad", "FuckAdBlock" and some iframes.