Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > microsoft.public.scripting.vbscript > #11131 > unrolled thread

JS De-obfuscator

Back to article view | Back to microsoft.public.scripting.vbscript

Contents

  JS De-obfuscator "Mayayana" <mayayana@invalid.nospam> - 2015-08-29 10:44 -0400
    Re: JS De-obfuscator GS <gs@v.invalid> - 2015-11-02 14:42 -0500
      Re: JS De-obfuscator "Mayayana" <mayayana@invalid.nospam> - 2015-11-02 15:06 -0500
        Re: JS De-obfuscator GS <gs@v.invalid> - 2015-11-02 15:21 -0500

#11131 — JS De-obfuscator

  I've been working on a fun project lately that
I though people might find useful. Maybe there
will also be comments or suggestions:

http://www.jsware.net/jsware/scrfiles.php5#jsdeob

  It's an HTA. I've been finding that webpage code
increasingly uses very bloated and obfuscated JS
to create the page. In some cases I've even found
JSON, embedded in script, which in turns embeds
the HTML of the page! In some cases the idea seems
to be to force people to enable script. In other cases
it seems to be to either hide or protect the code.

   In any case, I wanted to be able to dump the
obfuscated script into a window and clean it up.
The result is at the link above. It starts with an
OSS script to format, then uses my own VBS to
further clean up the code and add color syntax
highlighting.

[toc] | [next] | [standalone]

#11171

>   I've been working on a fun project lately that
> I though people might find useful. Maybe there
> will also be comments or suggestions:
>
> http://www.jsware.net/jsware/scrfiles.php5#jsdeob
>
>   It's an HTA. I've been finding that webpage code
> increasingly uses very bloated and obfuscated JS
> to create the page. In some cases I've even found
> JSON, embedded in script, which in turns embeds
> the HTML of the page! In some cases the idea seems
> to be to force people to enable script. In other cases
> it seems to be to either hide or protect the code.
>
>    In any case, I wanted to be able to dump the
> obfuscated script into a window and clean it up.
> The result is at the link above. It starts with an
> OSS script to format, then uses my own VBS to
> further clean up the code and add color syntax
> highlighting.

Interesting that not all browsers support vbs!

I built my website using Frontpage because it shipped with my Office 
2000 Developer Edition. I switched to using ExpressionWeb when M$ offer 
a cheap upgrade for FP users. (This has also been deprecated, and v4 is 
available free since there's no longer any support for it!)

I recently moved my website to a newer server (same host but 1/3 the 
annual cost) from an older 'legacy' server where I was making use of 
Frontpage Server Extensions. This, of course, was deprecated circa 2002 
and is not supported on the new server. I thought I'd have to implement 
some js to substitute the FSE features no longer available. I managed 
to replace my webform/webmail stuff with Perl scripts, though.

In my research I ran across Dojo. This is a heavy duty js package that 
also makes use of JSON and Regex. Older versions of the Dojo package 
apparently required lots of js scripting over what they're calling 
'Modern Dojo'. As far as I could see they're are millions of web 
developers using this stuff.

I also looked at Wordpress but passed since I like a WYSIWYG editor UI. 
I went with the newest version of EW since I'm familiar with it. Don't 
know how much js WP uses, but I suspect plenty since html alone can't 
do much of the features it offers.

I still have some js in place for parsing values passed in a URL. It 
would be nice, though, if I could replace it with html somehow!

-- 
Garry

Free usenet access at http://www.eternal-september.org
Classic VB Users Regroup!
  comp.lang.basic.visual.misc
  microsoft.public.vb.general.discussion

[toc] | [prev] | [next] | [standalone]

#11172

| Interesting that not all browsers support vbs!
|

  I think it was Microsoft's way of competing with
Netscape. They thought they'd force compatibility
with their system, but Netscape never made an
effort to support VBS. I used to have an old VBS book
that said VBScript would "soon" be supported by all
browsers... That was 1996, so all browsers meant
Netscape. :)

  Frontpage was also known as a monstrosity. Microsoft's
tool for making webpages designed for IE.

  I'd avoid Wordpress. They seem to get hacked about
once per week, due to the extreme amount of highly
functional script and plugins they use.

  It's a big topic. I see script getting *so* overused.
Fortunately I'm able to block it most of the time. And
on my own site I like to code "by hand", avoiding script.
The only script I've ever needed has been for older
versions of IE that don't support CSS hover for "flyout"
menus. For that I use VBS. To me JS is just to ugly
and terse to really get interested in.

  I guess partly my attitude dates to an earlier time
when script was being phased out for security and
CSS was starting to fill the gaps. It made sense to
try to eliminate script. But these days it permeates
many commercial sites.


| I still have some js in place for parsing values passed in a URL. It
| would be nice, though, if I could replace it with html somehow!
|

  I wonder what you're doing that requires script
on your site. Many things can now be done with
CSS. Much can also be done with PHP on Unix/Linux,
or maybe aspx on Windows servers. I'm not sure
about URL parameters, but I would think that's
one of the most common things to deal with. On
my own site I use PHP to check the userAgent
and provide one of two versions of the page,
depending on whether the visitor is using IE or
another browser. It all happen server-side, so I
don't need script in the page. 

[toc] | [prev] | [next] | [standalone]

#11173

>   I wonder what you're doing that requires script
> on your site. Many things can now be done with
> CSS. Much can also be done with PHP on Unix/Linux,
> or maybe aspx on Windows servers. I'm not sure
> about URL parameters, but I would think that's
> one of the most common things to deal with. On
> my own site I use PHP to check the userAgent
> and provide one of two versions of the page,
> depending on whether the visitor is using IE or
> another browser. It all happen server-side, so I
> don't need script in the page.

This is how I was having licensed apps 'registered' on my website. I've 
since revised my licensing code to do this via a form and email, so I 
probably don't need that js anymore for this purpose.

My app installer download page uses js to parse the download filename. 
Otherwise, I'd need a separate download page for each app (and is 
probably the way to go!).

-- 
Garry

Free usenet access at http://www.eternal-september.org
Classic VB Users Regroup!
  comp.lang.basic.visual.misc
  microsoft.public.vb.general.discussion

[toc] | [prev] | [standalone]

Back to top | Article view | microsoft.public.scripting.vbscript

csiph-web