Unpacking packed JavaScript code


I have this code that is unpacked using the ‘packed’ function (the code is only a part of it because at the end there are parameters which I do not understand). The packed code below is not complete, only a part of it just to be presented the complete picture:

eval(function(p, a, c, k, e, d) {
    while (c--) {
        if (k[c]) {
            p = p.replace(new RegExp("\\b" + c + "\\b", "g"), k[c]);
    return p;
}("23(16=(15='࠵ϾĹà{࢙Јà™’࠵Į26ࢤԩçòè࠾Ӑ ... ⟤ЉƛòÎ✒ӆƐü~⟤ϾæúÌ⫺ӐƤ8}✚Ϫƹ–').11,13=2,10='',9=0;9<16;9++)10+=14.27(24(15[9].25(0),!9||9%5?++13:13=3,21(18).11,(19(){20 22.28,40,48,46.44(49),43.45 47 42,41,33,14().32().31(),29 30,34,35.11,39,38,37})()));36(10)", 10, 50, "|z|||e||B|xz|x|i|s|length|g|d|String|uN|len|zz|false|function|return|uneval|Number|for|parseInt|charCodeAt|xy|fromCharCode|isInteger|typeof|Date|toUpperCase|toLowerCase|NaN|RegExp|Array|eval|true|undefined|null|Error|Boolean|File|Folder|ceil|Desktop|Math|instanceof|Object|Infinity".split("|")));

After unpacking it, again I get:

for(len=(uN='࠵ϾĹà{࢙Јà��࠵Į�xyࢤԩçòè࠾Ӑ���࢚ϩƤ ... úÌ⫺ӐƤx}✚Ϫƹ�').length,d=2,s='',i=0;i<len;i++)s+=String.fromCharCode(parseInt(uN[i].charCodeAt(0),!i||i%5?++d:d=3,uneval(false).length,(function(){return Number.isInteger,Error,Object,Math.ceil(Infinity),Folder.Desktop instanceof File,Boolean,NaN,String().toLowerCase().toUpperCase(),typeof Date,RegExp,Array.length,null,undefined,true})()));eval(s)

Can someone point me to what is happening here and what kind of encoding, packing etc is involved into this process as, again, at the end there are prameters which I do not understand. Is it related to byte array or something else?

P.S. As I do not have time to write excuses that this is not for bad intentions, this is actually my code packed by someone else with which I had collaboration once, so returned the modification as a packed version and never had the chance to ask him for the solution to this kind of JS packing which looks interesting.


The main thing to understand about the packed code is that it’s intended to reduce the bytesize of the code as much as possible.

I am afraid I do not understand what you mean by “reduce the bytesize of the code as much as possible.” I am actually trying to understand what methods are implemented to pack it this way because all I know is that JavaScript code can be obfuscated to some point, but it can be very easily deobfuscated. Do you mean that this is a bytecode (made with V8 for example)?


The whole point of a packer is to make the JavaScript source code as small as it possibly can be.
I have nothing to share on the techniques they use to achieve that.

This topic was automatically closed 91 days after the last reply. New replies are no longer allowed.