3

Having such code the first thing to do is to analyze what part is the obfuscation algorithm and what's the actual code. Here' it's not that difficult as all the code is on top. So let's analyze it step by step: var norm = ["cookie", "toUTCString",... defines an array with string that will be used in the application. Having them in an array and not in the ...


2

The special "accent" letters are just a distraction. You can use a text-editor to replace them with "standard" letters and the code would still work. Let's add a newline after each semicolon: É=-~-~[],ó=-~É,Ë=É<<É,þ=Ë+~[]; Ì=(ó-ó)[Û=(''+{})[É+ó]+(''+{})[ó-É]+([].ó+'')[ó-É]+(!!''+'')[ó]+({}+'')[ó+ó]+(!''+'')[ó-É]+(!''+'')[É]+(''+{})[É+ó]+({}+'')[ó+ó]+(...


2

You could try using de4js. For the javascript snippet in the original post, de4js produces the following output: var _0x2815 = ["3 1(){2 0=5;4 0}", "|", "split", "x|myFunction|var|function|return|", "replace", "", "\\w+", "\\b", "g"]; eval(function (_0xf81fx1, _0xf81fx2, _0xf81fx3, _0xf81fx4, _0xf81fx5, _0xf81fx6) { _0xf81fx5 = function (_0xf81fx3) { ...


1

I know you probably have figured this out... but the JavaScript Beautifier worked perfectly when I used it.


1

Unfortunately, knowledge of JS probably isn't going to help. The HTML passes along the uploaded file to the cgi-bin/maintenance.cgi file which is a compiled ARM BE8 binary that's a bit more work to analyze than just looking at some javascript. After a very brief look, there is an RSA public/private key pair embedded in the binary that might be useful for ...


Only top voted, non community-wiki answers of a minimum length are eligible