I have read about de-obfuscating JS files and about multi-layered obfuscation. I have come across a file (which I have uploaded here) and it doesn't seem to be obfuscated except for lines 21 and 42. I there seems to be some HTML components on those lines but when I tried using JSBeautifier and JSDetox on it, it doesn't help.

  1. Have any of the reverse engineers come across this type of obfuscation? if yes, how is it done?

  2. Is thereany way to de-obfuscate it?

closed as off-topic by Jason Geffner, ixje, 0xec, Ange Oct 3 '14 at 8:28

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking for help reverse-engineering a specific system are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Jason Geffner, ixje, 0xec, Ange
If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 2 down vote accepted

you can either print out the eval values on a custom html page using something like

<html>
<body>
<script>
document.write('<textarea cols="120" rows="10">');
document.write(contents of eval);
document.write('</textarea>');
</script>
</body>
</html>

or use malzilla or http://matthewfl.com/unPacker.html

This is dean edwards' js packer : http://dean.edwards.name/packer/. I see it quite frequently being used to obfuscate scripts as it is freely available. It's written in Javascript but there are also versions in other langages on the site.

By the way the Decode button and text area is only disabled via HTML attributes, so you can reenable them using The Developer Tools in Google Chrome for example :) Here are the 2 decoded scripts from your sample :

http://pastebin.com/duWWwWuQ http://pastebin.com/VUaivSVk

Not the answer you're looking for? Browse other questions tagged or ask your own question.