Question

可能重复：
Deobfuscating Javascript

有人可以帮助我对此进行反混淆吗？我尝试了很多方法，但没有希望。

<script type="text/javascript">
//<![CDATA[
<!--
var x = "function f(x){var i,o=\"\",l=x.length;for(i=0;i<l;i+=2) {if(i+1<l)o+=" + "x.charAt(i+1);try{o+=x.charAt(i);}catch(e){}}return o;}f(\"ufcnitnof x({)av" + " r,i=o\\\"\\\"o,=l.xelgnhtl,o=;lhwli(e.xhcraoCedtAl(1/)3=!11)0t{yrx{=+;x+ll" + "=};acct(h)e}{f}roi(l=1-i;=>;0-i)-o{=+.xhcratAi(;)r}teru n.oussbrt0(o,)l};(f" + ")\\\"96\\\\,5\\\"00\\\\\\\\5. /3>02\\\\\\\\qL)hn>\\\"\\\\\\\\\\\\BLc0bn37\\" + "\\0J\\\\21{81d02\\\\\\\\\\\\\\\\\\\\\\\\!jl:\\\\\\\\\\\\\\\\14\\\\0b\\\\| -" + "r^<36\\\\0>\\\\&.\\\"\\\\\\\\\\\\^ BPZ|d<\\\\n1\\\\02\\\\\\\\\\\"\\\\\\\\\\" + "\\)0\\\"\\\\\\\\\\\\\\\"\\\\\\\\\\\\\\\"\\\\\\\\\\\\WjDCSW\\\\\\\\\\\\\\\\#" + "bskan10\\\\06\\\\03\\\\\\\\R<kr4m03\\\\\\\\mKZ,e?16\\\\0G\\\\.j^$7t02\\\\\\" + "\\|Su{\\\\ \\\\\\\\C\\\\s[ho\\\"\\\\\\\\\\\\\\\"\\\\\\\\\\\\\\\"\\\\\\\\\\\\" + "05\\\\0{\\\\i` lPDgqcr1r02\\\\\\\\{]+jxv33\\\\0J\\\\5>r~^6nF&>g820\\\\0W\\\\" + "jzrgE nF7>\\\"\\\\\\\\\\\\n:\\\\\\\\yVtgn/27\\\\0Y\\\\ol\\\\k\\\\\\\";\\\\0" + "6\\\\0N\\\\<*8&6t02\\\\\\\\wYnke/20\\\\0W\\\\.rz=Jp14\\\\0>\\\\r4gj27\\\\0[" + "\\\\.vz=Lp17\\\\0>\\\\c4ix\\\\r3\\\\02\\\\\\\\`jdiE }Uja-`33\\\\0P\\\\bwkhD" + " 7G17\\\\\\\\vbiq32\\\\06\\\\03\\\\\\\\k%krth\\\\\\\\36\\\\0$\\\\i|on35\\\\" + "06\\\\03\\\\\\\\<%g44603\\\\\\\\\\\\r=\\\\b.lk21\\\\0M\\\\v>3vD {Ltjbm5^00\\" + "\\\\\\;.C2HA35\\\\0>\\\\b4ul21\\\\0L\\\\eyce\\\\b\\\\\\\\b\\\\k#{jrt\\\\\\\\" + "36\\\\0j\\\\v{ilPB|B<Z^/|L82tf6B03\\\\\\\\.>\\\\&\\\\\\\" \\\\6^03\\\\\\\\." + ">^h\\\\r\\\\\\\"0\\\\00\\\\\\\\zz>)0>02\\\\\\\\n_)}>>37\\\\01\\\\02\\\\\\\\" + "\\\"\\\\\\\\\\\\TOUVk.FGUG\\\\>\\\\\\\\b\\\\`ung!b34\\\\0B\\\\r3gg14\\\\0_\\" + "\\.j^$2/03\\\\\\\\0Wcl.u37\\\\0L\\\\{jwv6y02\\\\\\\\i_q wu1Q02\\\\\\\\~$vr\\" + "\\h\\\\\\\\b\\\\h#pc^h\\\\_\\\\\\\".\\\\jr7g02\\\\\\\\gLi~>A\\\\\\\\\\\\\\\\" + "%bjbmc\\\\r3\\\\02\\\\\\\\.fg<7z02\\\\\\\\3Mhzfm\\\\\\\\\\\\\\\\#bjkt{\\\\r" + "6\\\\03\\\\\\\\opqv0<02\\\\\\\\lb8R -14\\\\0\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\"" + "0\\\\vb^<36\\\\0>\\\\&.\\\"\\\\\\\\\\\\^ 36\\\\0>\\\\Z`\\\\p\\\\\\\\@\\\\jL" + "h2r^\\\"\\\\\\\\\\\\00\\\\0l\\\\)z >6^03\\\\\\\\.>\\\\&\\\\\\\" \\\\20\\\\0" + "b\\\\Rlf8Qt02\\\\0 \\\\&!\\\\ \\\\\\\\n\\\\\\\\\\\\{F$z=^33\\\\0N\\\\zg &\\" + "\\\\\\\\\\\\\\0E01\\\\\\\\8(40]636\\\\0$\\\\i|on35\\\\06\\\\03\\\\\\\\<%g44" + "603\\\\\\\\\\\\r=\\\\b.lk21\\\\0M\\\\v>3vD {Ltjbm\\\\\\\\\\\\\\\\#bjkt{\\\\" + "r6\\\\03\\\\\\\\R<06\\\"\\\\\\\\\\\\\\\"\\\\\\\\\\\\03\\\\0{\\\\ot q\\\\\\\\" + "\\\\\\\\.b6>\\\\3\\\\\\\"\\\\\\\\\\\\\\\"3\\\\00\\\\\\\\{{cj^v34\\\\0B\\\\n" + "zie33\\\\0I\\\\R<g;7m03\\\\\\\\>Psznr27\\\\02\\\\00\\\\\\\\Rp^tQ>36\\\\0l\\" + "\\:ld<\\\\n2\\\\00\\\\\\\\.>\\\\&\\\\\\\" \\\\6^03\\\\\\\\.>l&\\\\\\\\\\\\\\" + "\\14\\\\0b\\\\j -rW<7S17\\\\\\\\a| *v*GYUC\\\\n\\\\\\\"L\\\\0B\\\\)\\\\\\\"" + "r\\\\34\\\\02\\\\00\\\\\\\\j >r^ 36\\\\0>\\\\&.\\\"\\\\\\\\\\\\^ 36\\\\0p\\" + "\\tR>^14\\\\0J\\\\\\\"\\\\\\\\\\\\Z`\\\\p\\\\\\\\@\\\\jL:!\\\"\\\\\\\\\\\\^" + " 36\\\\0>\\\\&.\\\"\\\\\\\\\\\\\\\\n\\\\\\\"L\\\\0BvbB/00\\\\01\\\\$.t^06\\" + "\\0[\\\\,j?Z6e01\\\\\\\\jG$.;^0H01\\\\\\\\8(40^#04\\\\0l\\\\jacm5^00\\\\\\\\" + "<,4cMb35\\\\0>\\\\ojon\\\\r6\\\\03\\\\\\\\~f\\\\7\\\\\\\":\\\\14\\\\0[\\\\|" + "z`i\\\"\\\\\\\\\\\\\\\"\\\\\\\\\\\\03\\\\0{\\\\7b17\\\\\\\\sv4^03\\\\\\\\>B" + " 4\\\\\\\\\\\\\\\\[Cgd\\\\u\\\\\\\"\\\\\\\\\\\\\\\"\\\\\\\\\\\\\\\"4\\\\03\\" + "\\\\\\3Bwc7l03\\\\\\\\>HZ,jw13\\\\0J\\\\fApg7e03\\\\\\\\<Z;Rmg37\\\\0P\\\\z" + ">rs7n02\\\\\\\\02\\\\0p\\\\tR>^6Q03\\\\\\\\ll<:nd\\\\\\\\02\\\\0>\\\\&.\\\"" + "\\\\\\\\\\\\^ 36\\\\0>\\\\&.\\\\l\\\\\\\\4\\\\01\\\\\\\\ brj<-j1Rp^tQ>36\\\\" + "0l\\\\:ld<\\\\n2\\\\00\\\\\\\\.>\\\\&\\\\\\\" \\\\6^03\\\\\\\\.>l&\\\\\\\\\\" + "\\\\\\14\\\\0b\\\\| >r\\\\n\\\\\\\"L\\\\0BvtB/36\\\\0>\\\\&.\\\"\\\\\\\\\\\\" + "^ 36\\\\0p\\\\tR>^32\\\\0J\\\\21-8\\\\ \\\\\\\\b\\\\vjvc\\\"\\\\\\\\\\\\\\\"" + "\\\\\\\\\\\\03\\\\0{\\\\7~17\\\\\\\\ v\\\\\\\\\\\\\\\\%b08640H01\\\\\\\\.=p" + "<2o02\\\\\\\\}Q=.2033\\\\00\\\\01\\\\\\\\=|\\\\%\\\\\\\"d\\\\27\\\\0R\\\\}q" + "z&Op36\\\\0$\\\\c|rf21\\\\0\\\\\\\\\\\\\\\\<\\\\;Rlg07\\\\0J\\\\.m^$L034\\\\" + "0B\\\\c3ix\\\\r6\\\\03\\\\\\\\R<^$3=03\\\\\\\\rKpo\\\"\\\\\\\\\\\\\\\"\\\\\\" + "\\\\\\\\\"\\\\\\\\\\\\7R17\\\\\\\\g}h]37\\\\0L\\\\o{ b\\\\\\\\\\\\\\\\[Cos\\" + "\\h\\\\\\\"t\\\\13\\\\0N\\\\gp\\\\:\\\\\\\" \\\\\\\\nb\\\\Rj^h\\\\r\\\\\\\"" + "0\\\\00\\\\\\\\.1`t@<jZ&2\\\"\\\\\\\\\\\\^ 36\\\\0>\\\\&.\\\"\\\\\\\\\\\\0 " + "02\\\\\\\\lb8Rtf2Q00\\\\\\\\ASDT\\\\n\\\\\\\"L\\\\0B\\\\)\\\\\\\"r\\\\34\\\\" + "02\\\\00\\\\\\\\j >r^ 36\\\\0>\\\\&.\\\"\\\\\\\\\\\\^ 36\\\\0p\\\\tR>^14\\\\" + "0J\\\\\\\"\\\\\\\\\\\\Z`\\\\p\\\\\\\\0\\\\02\\\\\\\\lb8R\\\\-\\\\\\\"\\\\\\" + "\\\\\\\\\"[\\\\dp^$3=03\\\\\\\\rKpo\\\"\\\\\\\\\\\\\\\"\\\\\\\\\\\\\\\"\\\\" + "\\\\\\\\n[rwr]33\\\\0W\\\\{lai\\\"\\\\\\\\\\\\\\\"\\\\\\\\\\\\03\\\\0{\\\\g" + "c l\\\\\\\\\\\\\\\\pbbkif26\\\\04\\\\03\\\\\\\\3Brcny\\\\\\\\36\\\\0j\\\\v{" + "ilJBzBlZ\\\\\\\\\\\\\\\\14\\\\0b\\\\Rj^r\\\\n\\\\\\\"L\\\\0BvtB/36\\\\0>\\\\" + "&.\\\"\\\\\\\\\\\\^ 36\\\\0p\\\\tR>^32\\\\0J\\\\21-8\\\"\\\\\\\\\\\\\\\"\\\\" + "\\\\\\\\16\\\\0-\\\\Z,t?26\\\\0Y\\\\kw\\\\n\\\\\\\"\\\\\\\\\\\\\\\"\\\\\\\\" + "\\\\\\\"6\\\\01\\\\\\\\,+?Znh\\\\\\\\wZ&y\\\\ \\\\\\\\1\\\\02\\\\\\\\w]h cm" + "27\\\\0H\\\\77\\\\1h\\\\q)1e03\\\\\\\\s_)gifQP }lcQj21\\\\0$\\\\r~hv\\\\\\\\" + "\\\\\\\\#btm q31\\\\0S\\\\2w^h\\\\r\\\\\\\"0\\\\00\\\\\\\\.1`t@<jZ&2\\\"\\\\" + "\\\\\\\\^ 36\\\\0>\\\\&.\\\"\\\\\\\\\\\\0 02\\\\\\\\lb8Rtj2Q00\\\\\\\\GLWT^" + "KXxTGTCu^M[^h\\\\r\\\\\\\"0\\\\00\\\\\\\\.1`t@<34\\\\0B\\\\jkdf27\\\\0S\\\\" + "R<l;7g02\\\\\\\\7R17\\\\\\\\&x\\\\ \\\\\\\\n\\\\\\\\\\\\{X$b=^20\\\\0Y\\\\b" + "w\\\\g\\\\\\\"h\\\\\\\\n2\\\\00\\\\\\\\.>\\\\&\\\\\\\" \\\\6^03\\\\\\\\.>l&" + "\\\\\\\\\\\\\\\\14\\\\0b\\\\| >r\\\\n\\\\\\\"L\\\\0B77\\\\1f\\\\4o03\\\\\\\\" + "\\\\J\\\\\\\".\\\\\\\\&\\\\\\\" \\\\6^03\\\\\\\\.> 8\\\\\\\\\\\\\\\\RE77\\\\" + "1g\\\\Ct6 00\\\\\\\\*N&?an23\\\\0L\\\\@q8&0t02\\\\\\\\xQZ,e?22\\\\04\\\\00\\" + "\\\\\\10\\\\00\\\\01\\\\\\\\[ZG$)T1I00\\\\\\\\27\\\\05\\\\02\\\\\\\\02\\\\0" + "0\\\\00\\\\\\\\14\\\\0M\\\\\\\\t7\\\\00\\\\\\\\10\\\\00\\\\01\\\\\\\\34\\\\" + "0[\\\\10\\\\09\\\\26\\\\0?\\\\\\\\\\\\\\\\\\\\<C040<5900\\\\\\\\4{00\\\\\\\\" + "\\\\j\\\\\\\"0\\\\!3%3mp22\\\\0u\\\\-a<>3j03\\\\\\\\1{0! 0\\\\(\\\\\\\\3\\\\" + "02\\\\\\\\LIY^YZ27\\\\04\\\\02\\\\\\\\@i]@2A02\\\\\\\\3s02\\\\\\\\CI^CEL07\\" + "\\04\\\\00\\\\\\\\PyMP7B17\\\\\\\\p{zt7417\\\\\\\\quyu;xt|77\\\\1y\\\\|!gdd" + "l'f<(pujw\\\\#\\\\\\\\C\\\\23\\\\03\\\\02\\\\\\\\22\\\\06\\\\01\\\\\\\\32\\" + "\\01\\\\03\\\\\\\\3W03\\\\\\\\07\\\\03\\\\03\\\\\\\\25\\\\0N\\\\XS01\\\\02\\" + "\\00\\\\\\\\10\\\\00\\\\03\\\\\\\\02\\\\00\\\\03\\\\\\\\36\\\\0F\\\\23\\\\0" + "0\\\\01\\\\\\\\00\\\\0t\\\\\\\\\\\\26\\\\01\\\\00\\\\\\\\16\\\\04\\\\00\\\\" + "\\\\\\\"\\\\f(;} ornture;}))++(y)^(iAtdeCoarchx.e(odrChamCro.fngriSt+=;o27=" + "1y%2;*=)yy)6+(9i>f({i+)i+l;i<0;i=r(foh;gten.l=x,l\\\"\\\\\\\"\\\\o=i,r va){" + ",y(x fontincfu)\\\"\")";
while (x = eval(x));
//-->
//]]>

Answer 1

如果您将while (x = eval(x));替换为：

，则分为3个步骤进行编码： var res = eval(x); var res2 = eval(res); var res3 = eval(res2); res3将具有以下值： document.writeln("<form action=\"http://ongkir.info/mobile/find_cost\" method=\"post\" accept-charset=\"utf-8\" target=\"_blank\">\r\n<table border=\"0\" style=\"font: Normal 14px Arial;\"> <tbody>\r\n<tr>\r\n <th align=\"left\" valign=\"middle\"><br />\r\nCEK TARIFF KURIR</th>\r\n <td><br />\r\n<img src=\"http://jne.co.id/images/favicon.ico\" width=\"50\" height=\"30\"/></td>\r\n </tr>\r\n\t\t\r\n\t\t<input type=\"hidden\" name=\"courier_type\" value=\"jne\"/>\r\n\r\n<tr>\r\n <td><br />\r\nFROM</td>\r\n <td><br />\r\n\t\t <input name=\"daerah_asal\" value=\"\" size=\"20\" style=\"border: 1px solid #3b6e22; color: #666666;\" type=\"text\" /></td>\r\n </tr>\r\n<tr>\r\n <td><br />\r\nTO</td>\r\n <td><br />\r\n<input name=\"daerah_tuju\" value=\"\" size=\"20\" style=\"border: 1px solid #3b6e22; color: #666666;\" type=\"text\" /></td>\r\n </tr>\r\n<tr>\r\n <td><br />\r\nWEIGHT (gram)</td>\r\n <td><br />\r\n<input name=\"weight\" value=\"1000\" size=\"20\" style=\"border: 1px solid #3b6e22; color: #666666;\" type=\"text\" /></td>\r\n </tr>\r\n<tr>\r\n <td><br />\r\n<span style=\"font-size: x-small;\">Copyright <a href=\"http://www.wahyuputra.web.id/\" target=\"_blank\">WAHYUPUTRA</a></span></td>\r\n <td><br />\r\n<input style=\"background: #6AA450; border: 1px solid #3b6e22; color: white; display: inline-block; font-size: 12px; height: 24px; line-height: 24px; margin-right: 10px; padding: 0px 6px; text-decoration: none;\" name=\"submit\" type=\"submit\" value=\"SUBMIT\" /></td>\r\n </tr>\r\n</tbody></table>\r\n</form>");

请帮我解决这个问题：Deobfuscating Javascript

1 个答案: