Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #31071

Re: decode hex string

Show all headers | View raw

Andrew Poulos wrote:

> I have some code I need to edit and the previous programmer has used
> variable names like _0x29aexe, _0x29aexf, _0x29aex10, _0x29aex11,
> _0x29aex12, _0x29aex13, _0x29aex14, _0x29aex15...
> 
> My guess was that it's hex with a leading underscore but when I convert
> I get "?)®?" and the like.
> 
> Did I convert it wrongly or did the person obfuscate the variable names
> even further?

Impossible to say for certain without seeing the source codes (theirs and 
yours). 

However, hexadecimal numbers do not contain the letter “x”, so if you used 
parseInt(…, 16) on anything but the “_”, then you converted it wrongly; 
parseInt(…, 16) would recognize and ignore the “0x” as a hexadecimal number 
prefix, but it would stop parsing before the second “x”.  But 
String.fromCharCode(parseInt("0x29aexfoo", 16)) returns "⦮", not "?", so you 
might not have attempted to convert them this way.

The identifier format suggests “_” as a default prefix, “0x29ae” as a marker 
that all those variables have in common (perhaps they have the same 
identifier, but are declared in different execution contexts, the marker 
indicating the identifier; or they have different identifiers, but are 
declared in the same execution context, the marker indicating the context), 
“x” as a separator, maybe do indicate hexadecimal as well, and what follows 
an index using hexadecimal numbers (e, f, 10, …).  It was most certainly 
created by an obfuscation *program*.

I suggest to use a refactoring tool like (js-)refactor [1] for Atom [2] (if 
you are not using Atom yet, you are missing out) to make sense of the source 
code step by step, renaming each of those variables considering the context 
in which it is used.

[1] <https://atom.io/packages/refactor> p.
[2] <https://atom.io/>
-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not cc me. / Bitte keine Kopien per E-Mail.

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

decode hex string Andrew Poulos <ap_prog@hotmail.com> - 2016-08-05 10:19 +1000
  Re: decode hex string $Bill <news@todbe.com> - 2016-08-04 21:28 -0700
  Re: decode hex string Andreas Bergmaier <andber93@web.de> - 2016-08-05 06:44 +0200
  Re: decode hex string Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-08-05 07:53 +0200
    Re: decode hex string Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-08-05 08:06 +0200

csiph-web