Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #31067 > unrolled thread

decode hex string

Back to article view | Back to comp.lang.javascript

Contents

  decode hex string Andrew Poulos <ap_prog@hotmail.com> - 2016-08-05 10:19 +1000
    Re: decode hex string $Bill <news@todbe.com> - 2016-08-04 21:28 -0700
    Re: decode hex string Andreas Bergmaier <andber93@web.de> - 2016-08-05 06:44 +0200
    Re: decode hex string Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-08-05 07:53 +0200
      Re: decode hex string Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-08-05 08:06 +0200

#31067 — decode hex string

I have some code I need to edit and the previous programmer has used 
variable names like _0x29aexe, _0x29aexf, _0x29aex10, _0x29aex11, 
_0x29aex12, _0x29aex13, _0x29aex14, _0x29aex15...

My guess was that it's hex with a leading underscore but when I convert 
I get "?)®?" and the like.

Did I convert it wrongly or did the person obfuscate the variable names 
even further?

Andrew Poulos

[toc] | [next] | [standalone]

#31068

On 08-04-16 17:19, Andrew Poulos wrote:
> I have some code I need to edit and the previous programmer has used variable names like _0x29aexe, _0x29aexf, _0x29aex10, _0x29aex11, _0x29aex12, _0x29aex13, _0x29aex14, _0x29aex15...
>
> My guess was that it's hex with a leading underscore but when I convert I get "?)®?" and the like.
>
> Did I convert it wrongly or did the person obfuscate the variable names even further?

There's no x in hex.  I'd just strip the _0x29ae off and use the rest.

[toc] | [prev] | [next] | [standalone]

#31069

Andrew Poulos wrote:
> I have some code I need to edit and the previous programmer has used
> variable names like _0x29aexe, _0x29aexf, _0x29aex10, _0x29aex11,
> _0x29aex12, _0x29aex13, _0x29aex14, _0x29aex15...
>
> My guess was that it's hex with a leading underscore but when I convert
> I get "?)®?" and the like.
>
> Did I convert it wrongly or did the person obfuscate the variable names
> even further?

No, a person did not obfuscate these variable names at all.
this is the work of a dedicated obfusciation program that chose these 
names at random to make them look as gibberish as possible.
Admittedly, it might not be completely random, there's definitely a 
pattern there, however it's not an encoding of the original but rather a 
mapping. There's nothing to convert here unless you got a hold onto that 
mapping.

  Andreas

[toc] | [prev] | [next] | [standalone]

#31071

Andrew Poulos wrote:

> I have some code I need to edit and the previous programmer has used
> variable names like _0x29aexe, _0x29aexf, _0x29aex10, _0x29aex11,
> _0x29aex12, _0x29aex13, _0x29aex14, _0x29aex15...
> 
> My guess was that it's hex with a leading underscore but when I convert
> I get "?)®?" and the like.
> 
> Did I convert it wrongly or did the person obfuscate the variable names
> even further?

Impossible to say for certain without seeing the source codes (theirs and 
yours). 

However, hexadecimal numbers do not contain the letter “x”, so if you used 
parseInt(…, 16) on anything but the “_”, then you converted it wrongly; 
parseInt(…, 16) would recognize and ignore the “0x” as a hexadecimal number 
prefix, but it would stop parsing before the second “x”.  But 
String.fromCharCode(parseInt("0x29aexfoo", 16)) returns "⦮", not "?", so you 
might not have attempted to convert them this way.

The identifier format suggests “_” as a default prefix, “0x29ae” as a marker 
that all those variables have in common (perhaps they have the same 
identifier, but are declared in different execution contexts, the marker 
indicating the identifier; or they have different identifiers, but are 
declared in the same execution context, the marker indicating the context), 
“x” as a separator, maybe do indicate hexadecimal as well, and what follows 
an index using hexadecimal numbers (e, f, 10, …).  It was most certainly 
created by an obfuscation *program*.

I suggest to use a refactoring tool like (js-)refactor [1] for Atom [2] (if 
you are not using Atom yet, you are missing out) to make sense of the source 
code step by step, renaming each of those variables considering the context 
in which it is used.

[1] <https://atom.io/packages/refactor> p.
[2] <https://atom.io/>
-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not cc me. / Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#31072

Thomas 'PointedEars' Lahn wrote:

> Andrew Poulos wrote:
>> I have some code I need to edit and the previous programmer has used
>> variable names like _0x29aexe, _0x29aexf, _0x29aex10, _0x29aex11,
>> _0x29aex12, _0x29aex13, _0x29aex14, _0x29aex15...
>> 
>> My guess was that it's hex with a leading underscore but when I convert
>> I get "?)®?" and the like.
>> 
>> Did I convert it wrongly or did the person obfuscate the variable names
>> even further?
> 
> Impossible to say for certain without seeing the source codes (theirs and
> yours).
> 
> However, hexadecimal numbers do not contain the letter “x”, so if you used
> parseInt(…, 16) on anything but the “_”, then you converted it wrongly;
> parseInt(…, 16) would recognize and ignore the “0x” as a hexadecimal
> number
> prefix, but it would stop parsing before the second “x”.  But
> String.fromCharCode(parseInt("0x29aexfoo", 16)) returns "⦮", not "?", so
> you might not have attempted to convert them this way.

You have probably attempted to convert the number as octets: 
String.fromCharCode(0x29, 0xAE) returns ")®".
 
-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not cc me. / Bitte keine Kopien per E-Mail.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.javascript

csiph-web