Unpacking packed JavaScript code

JavaScript
1

Hello,

I have this code that is unpacked using the ‘packed’ function (the code is only a part of it because at the end there are parameters which I do not understand). The packed code below is not complete, only a part of it just to be presented the complete picture:

eval(function(p, a, c, k, e, d) {
    while (c--) {
        if (k[c]) {
            p = p.replace(new RegExp("\\b" + c + "\\b", "g"), k[c]);
        }
    }
    return p;
}("23(16=(15='࠵ϾĹà{࢙Јà™’࠵Į26ࢤԩçòè࠾Ӑ ... ⟤ЉƛòÎ✒ӆƐü~⟤ϾæúÌ⫺ӐƤ8}✚Ϫƹ–').11,13=2,10='',9=0;9<16;9++)10+=14.27(24(15[9].25(0),!9||9%5?++13:13=3,21(18).11,(19(){20 22.28,40,48,46.44(49),43.45 47 42,41,33,14().32().31(),29 30,34,35.11,39,38,37})()));36(10)", 10, 50, "|z|||e||B|xz|x|i|s|length|g|d|String|uN|len|zz|false|function|return|uneval|Number|for|parseInt|charCodeAt|xy|fromCharCode|isInteger|typeof|Date|toUpperCase|toLowerCase|NaN|RegExp|Array|eval|true|undefined|null|Error|Boolean|File|Folder|ceil|Desktop|Math|instanceof|Object|Infinity".split("|")));

After unpacking it, again I get:

for(len=(uN='࠵ϾĹà{࢙Јà��࠵Į�xyࢤԩçòè࠾Ӑ���࢚ϩƤ ... úÌ⫺ӐƤx}✚Ϫƹ�').length,d=2,s='',i=0;i<len;i++)s+=String.fromCharCode(parseInt(uN[i].charCodeAt(0),!i||i%5?++d:d=3,uneval(false).length,(function(){return Number.isInteger,Error,Object,Math.ceil(Infinity),Folder.Desktop instanceof File,Boolean,NaN,String().toLowerCase().toUpperCase(),typeof Date,RegExp,Array.length,null,undefined,true})()));eval(s)

Can someone point me to what is happening here and what kind of encoding, packing etc is involved into this process as, again, at the end there are prameters which I do not understand. Is it related to byte array or something else?

P.S. As I do not have time to write excuses that this is not for bad intentions, this is actually my code packed by someone else with which I had collaboration once, so returned the modification as a packed version and never had the chance to ask him for the solution to this kind of JS packing which looks interesting.

Thanks

2

The main thing to understand about the packed code is that it’s intended to reduce the bytesize of the code as much as possible.

3

I am afraid I do not understand what you mean by “reduce the bytesize of the code as much as possible.” I am actually trying to understand what methods are implemented to pack it this way because all I know is that JavaScript code can be obfuscated to some point, but it can be very easily deobfuscated. Do you mean that this is a bytecode (made with V8 for example)?

Thanks

4

The whole point of a packer is to make the JavaScript source code as small as it possibly can be.
I have nothing to share on the techniques they use to achieve that.

5

This topic was automatically closed 91 days after the last reply. New replies are no longer allowed.