Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I have read about de-obfuscating JS files and about multi-layered obfuscation. I have come across a file (which I have uploaded here) and it doesn't seem to be obfuscated except for lines 21 and 42. I there seems to be some HTML components on those lines but when I tried using JSBeautifier and JSDetox on it, it doesn't help.
Have any of the reverse engineers come across this type of obfuscation? if yes, how is it done?
Is thereany way to de-obfuscate it?
you can either print out the eval values on a custom html page using something like
<html>
<body>
<script>
document.write('<textarea cols="120" rows="10">');
document.write(contents of eval);
document.write('</textarea>');
</script>
</body>
</html>
or use malzilla or http://matthewfl.com/unPacker.html
This is dean edwards' js packer : http://dean.edwards.name/packer/. I see it quite frequently being used to obfuscate scripts as it is freely available. It's written in Javascript but there are also versions in other langages on the site.
By the way the Decode button and text area is only disabled via HTML attributes, so you can reenable them using The Developer Tools in Google Chrome for example :) Here are the 2 decoded scripts from your sample :
