Path: csiph.com!news.mixmin.net!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail From: Thomas 'PointedEars' Lahn Newsgroups: comp.lang.javascript Subject: Re: decode hex string Date: Fri, 05 Aug 2016 07:53:18 +0200 Organization: PointedEars Software (PES) Lines: 43 Message-ID: <2543619.e9J7NaK4W3@PointedEars.de> References: Reply-To: Thomas 'PointedEars' Lahn Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8Bit X-Trace: solani.org 1470376400 27628 eJwNx8EBwCAIA8CVrJgg4wCa/Uew9zsYP7YvgguCPGfsuj1mDzIIKwdNJ3WkiavyP5EZ2ub9ACYKEgk= (5 Aug 2016 05:53:20 GMT) X-Complaints-To: abuse@news.solani.org NNTP-Posting-Date: Fri, 5 Aug 2016 05:53:20 +0000 (UTC) User-Agent: KNode/4.14.2 X-User-ID: eJwFwYEBwDAEBMCVCI+MI+r3H6F3sNCY9EA4CO49L7dbp+NNYg3nMa+sqQn0fCr1jRjoVE558oh0iLKq8gdeXxUk Cancel-Lock: sha1:yhsIN7d5zkOR8iOuD1VesyM0YrA= X-NNTP-Posting-Host: eJwNxsEBwCAIA8CVlCRUxxEK+4+g9zrBp+dHl1OtjmFvVNKisVh/9g7HILY06zkOnCxb6IwLFSoRXg== Xref: csiph.com comp.lang.javascript:31071 Andrew Poulos wrote: > I have some code I need to edit and the previous programmer has used > variable names like _0x29aexe, _0x29aexf, _0x29aex10, _0x29aex11, > _0x29aex12, _0x29aex13, _0x29aex14, _0x29aex15... > > My guess was that it's hex with a leading underscore but when I convert > I get "?)®?" and the like. > > Did I convert it wrongly or did the person obfuscate the variable names > even further? Impossible to say for certain without seeing the source codes (theirs and yours). However, hexadecimal numbers do not contain the letter “x”, so if you used parseInt(…, 16) on anything but the “_”, then you converted it wrongly; parseInt(…, 16) would recognize and ignore the “0x” as a hexadecimal number prefix, but it would stop parsing before the second “x”. But String.fromCharCode(parseInt("0x29aexfoo", 16)) returns "⦮", not "?", so you might not have attempted to convert them this way. The identifier format suggests “_” as a default prefix, “0x29ae” as a marker that all those variables have in common (perhaps they have the same identifier, but are declared in different execution contexts, the marker indicating the identifier; or they have different identifiers, but are declared in the same execution context, the marker indicating the context), “x” as a separator, maybe do indicate hexadecimal as well, and what follows an index using hexadecimal numbers (e, f, 10, …). It was most certainly created by an obfuscation *program*. I suggest to use a refactoring tool like (js-)refactor [1] for Atom [2] (if you are not using Atom yet, you are missing out) to make sense of the source code step by step, renaming each of those variables considering the context in which it is used. [1] p. [2] -- PointedEars FAQ: | SVN: Twitter: @PointedEars2 | ES Matrix: Please do not cc me. / Bitte keine Kopien per E-Mail.