Reverse Engineering Javascript - Out of Memory

Question

I found this javascript file on one of those online movie streaming services and was interested in finding out what it does. However, after trying many deobfuscators I am still stuck. A major problem preventing me from making progress was that when I tried staying on the page too long, Chromium (Firefox had the same problem) would run out of memory and freeze. Running it in node resulted in the same thing ("FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory"). This also prevented me from trying to add console.log statements because it would simply freeze. I am not experienced enough to see what is actually causing these massive allocations to occur. Any advice as to where I should look next?

Original File URL: https://videospider.in/js/play2.min.js

Archived: https://pastebin.com/ycw6MSLQ

Answer 1

Based on the "deobfuscated" output posted by @Supreme, the code appears to be encoding very basic information about the click event when the user clicks on a video's play button. Here it is tidied up, with some comments:

var alreadyClicked = false;

$(document).on("click", "#play", function(e) {
    e.preventDefault();

    if (!alreadyClicked) {
        $(".loading").text("Loading video... Please wait.");

        // Generate random numbers between 10-20
        var idLength1 = Math.floor(Math.random() * (20 - 10 + 1)) + 10;
        var idLength2 = Math.floor(Math.random() * (20 - 10 + 1)) + 10;

        // Generate random numbers between 0-9
        var randInt1  = Math.floor(Math.random() * (9 - 0 + 1)) + 0;
        var randInt2  = Math.floor(Math.random() * (9 - 0 + 1)) + 0;

        // Create "ID" with random IDs + the event name and mouse X/Y coordinates
        var encodedId = randInt1 + "" + idLength1 + "" + generateId(idLength1) + "" + btoa(String(e.originalEvent) + "*" + e.pageX + "*" + e.pageY) + "" + generateId(idLength2) + "" + idLength2 + "" + randInt2;

        // Prevent submitting the form again if #play is clicked
        alreadyClicked = true;

        $("#playID").val(encodedId);
        $("#playForm").submit();
    }
})

function generateId(length) {
    var id = "";
    var idCharacters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";

    for (var i = 0; i < length; i++) {
        id = id + idCharacters.charAt(Math.floor(Math.random() * idCharacters.length));
    }

    return id;
}

The encodedId variable would look something like:

"618iNXtzD0htGiVKXSV9EW29iamVjdCBNb3VzZUV2ZW50XSo4ODYqNzY56i9zvoRJQ16pPj143"

Reversing this is fairly trivial as we can see how it's constructed in the above code.

1. Remove the first and last characters as they will always be a single character. The string is now 18iNXtzD0htGiVKXSV9EW29iamVjdCBNb3VzZUV2ZW50XSo4ODYqNzY56i9zvoRJQ16pPj14.
2. Read the first two characters as a number and remove that amount of characters from the beginning. In this case, 18, becoming W29iamVjdCBNb3VzZUV2ZW50XSo4ODYqNzY56i9zvoRJQ16pPj14.
3. Do the same again for the last two characters, 14 - W29iamVjdCBNb3VzZUV2ZW50XSo4ODYqNzY5.
4. Decode from Base64: atob("W29iamVjdCBNb3VzZUV2ZW50XSo4ODYqNzY5") == "[object MouseEvent]*886*769".
5. We can now see the #play element was triggered by a MouseEvent at X 886 / Y 769.

Guess: this is probably a basic method of checking for bots.

Answer 2

it was obfuscated with obfuscator.io, here it is deobfuscated.
https://pastebin.com/tdH8Di2u
The function names and variables are still random though.