We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
URL: https://hector.baidu.com/a.js
https://hector.baidu.com/a.js
a.js is a short one, so sad I'm not good enough to find out why the deobfuscator don't work.
a.js
Also there is a longer https://hectorstatic.baidu.com/1371300bc53d20f8.js, it can only be half de-obfs-ed in v2.4.5.
https://hectorstatic.baidu.com/1371300bc53d20f8.js
var _0x2495=['cEdPUUk=','WUVTRVA=','eUt6YnI=','c3BsaXQ=','NXwxMXw=','TGlOcm4=','d2NhWmM=','TGV2RHE=','cVFPeHQ=','UHpkTmE=','WEpZTUg=','fDJ8MTM=','MXwwfDE=','NHw2fDc=','fDR8OXw=','VHFCRFk=','fDEwfDM=','TkRkbVE=','VHJOTG0=','MTJ8OA==','cWppYUw='];(function(_0x4fcb42,_0x249590){var _0x2cff01=function(_0x175e8e){while(--_0x175e8e){_0x4fcb42['push'](_0x4fcb42['shift']());}};_0x2cff01(++_0x249590);}(_0x2495,0x1b3));var _0x2cff=function(_0x4fcb42,_0x249590){_0x4fcb42=_0x4fcb42-0x0;var _0x2cff01=_0x2495[_0x4fcb42];if(_0x2cff['fEIjCz']===undefined){(function(){var _0xf95bf2;try{var _0x3eee6d=Function('return\x20(function()\x20'+'{}.constructor(\x22return\x20this\x22)(\x20)'+');');_0xf95bf2=_0x3eee6d();}catch(_0x402702){_0xf95bf2=window;}var _0x38ab06='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';_0xf95bf2['atob']||(_0xf95bf2['atob']=function(_0x3071c7){var _0x3524dc=String(_0x3071c7)['replace'](/=+$/,'');var _0x15cb8d='';for(var _0x3af137=0x0,_0x2a3f28,_0x21d190,_0x35ef8d=0x0;_0x21d190=_0x3524dc['charAt'](_0x35ef8d++);~_0x21d190&&(_0x2a3f28=_0x3af137%0x4?_0x2a3f28*0x40+_0x21d190:_0x21d190,_0x3af137++%0x4)?_0x15cb8d+=String['fromCharCode'](0xff&_0x2a3f28>>(-0x2*_0x3af137&0x6)):0x0){_0x21d190=_0x38ab06['indexOf'](_0x21d190);}return _0x15cb8d;});}());_0x2cff['ZsjoFF']=function(_0x593685){var _0x54bfaf=atob(_0x593685);var _0x1e9d70=[];for(var _0xae8cc=0x0,_0x33ae87=_0x54bfaf['length'];_0xae8cc<_0x33ae87;_0xae8cc++){_0x1e9d70+='%'+('00'+_0x54bfaf['charCodeAt'](_0xae8cc)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x1e9d70);};_0x2cff['uytahu']={};_0x2cff['fEIjCz']=!![];}var _0x175e8e=_0x2cff['uytahu'][_0x4fcb42];if(_0x175e8e===undefined){_0x2cff01=_0x2cff['ZsjoFF'](_0x2cff01);_0x2cff['uytahu'][_0x4fcb42]=_0x2cff01;}else{_0x2cff01=_0x175e8e;}return _0x2cff01;};(function(){var _0x3fc986={};_0x3fc986[_0x2cff('0x8')]=_0x2cff('0x12')+_0x2cff('0x13')+_0x2cff('0x1')+_0x2cff('0x11')+_0x2cff('0x14')+_0x2cff('0xa')+_0x2cff('0x4');_0x3fc986[_0x2cff('0x7')]=function(_0x551a97,_0x5d60a3){return _0x551a97>>>_0x5d60a3;};_0x3fc986[_0x2cff('0x0')]=function(_0x1c765b,_0x329d15){return _0x1c765b&_0x329d15;};_0x3fc986[_0x2cff('0xf')]=function(_0x57bb10,_0x30dcf5){return _0x57bb10>>>_0x30dcf5;};_0x3fc986[_0x2cff('0x5')]=function(_0x3ec38d,_0x10a891){return _0x3ec38d&_0x10a891;};_0x3fc986[_0x2cff('0x10')]=function(_0x3d53a3,_0x352d91){return _0x3d53a3+_0x352d91;};_0x3fc986[_0x2cff('0xe')]=function(_0xc0713e,_0x19b803){return _0xc0713e+_0x19b803;};_0x3fc986[_0x2cff('0xc')]=function(_0x1a72b8,_0x4bd927){return _0x1a72b8+_0x4bd927;};_0x3fc986[_0x2cff('0x2')]=function(_0x327b8c,_0x346171){return _0x327b8c>>>_0x346171;};_0x3fc986[_0x2cff('0x6')]=function(_0x34e03a,_0x371081){return _0x34e03a|_0x371081;};_0x3fc986[_0x2cff('0x3')]=function(_0x2d639c,_0x4fbebe){return _0x2d639c<<_0x4fbebe;};_0x3fc986[_0x2cff('0xb')]=function(_0x39017d,_0xe1601e){return _0x39017d>>>_0xe1601e;};_0x3fc986[_0x2cff('0xd')]=function(_0x40928c,_0xae3a34){return _0x40928c+_0xae3a34;};var _0x5ec6dc=_0x3fc986;var _0x3f3d80=function(_0x44f2a1,_0x275148){var _0x17670e=_0x5ec6dc[_0x2cff('0x8')][_0x2cff('0x9')]('|');var _0x55362d=0x0;while(!![]){switch(_0x17670e[_0x55362d++]){case'0':_0x275148=[_0x5ec6dc[_0x2cff('0x7')](_0x275148[0x0],0x10),_0x5ec6dc[_0x2cff('0x0')](_0x275148[0x0],0xffff),_0x5ec6dc[_0x2cff('0x7')](_0x275148[0x1],0x10),_0x5ec6dc[_0x2cff('0x0')](_0x275148[0x1],0xffff)];continue;case'1':_0x44f2a1=[_0x5ec6dc[_0x2cff('0xf')](_0x44f2a1[0x0],0x10),_0x5ec6dc[_0x2cff('0x5')](_0x44f2a1[0x0],0xffff),_0x5ec6dc[_0x2cff('0xf')](_0x44f2a1[0x1],0x10),_0x5ec6dc[_0x2cff('0x5')](_0x44f2a1[0x1],0xffff)];continue;case'2':_0x3bd1dd[0x1]+=_0x5ec6dc[_0x2cff('0xf')](_0x3bd1dd[0x2],0x10);continue;case'3':_0x3bd1dd[0x2]+=_0x5ec6dc[_0x2cff('0x10')](_0x44f2a1[0x2],_0x275148[0x2]);continue;case'4':_0x3bd1dd[0x1]+=_0x5ec6dc[_0x2cff('0xe')](_0x44f2a1[0x1],_0x275148[0x1]);continue;case'5':_0x3bd1dd[0x1]&=0xffff;continue;case'6':_0x3bd1dd[0x3]+=_0x5ec6dc[_0x2cff('0xc')](_0x44f2a1[0x3],_0x275148[0x3]);continue;case'7':_0x3bd1dd[0x2]+=_0x5ec6dc[_0x2cff('0x2')](_0x3bd1dd[0x3],0x10);continue;case'8':return[_0x5ec6dc[_0x2cff('0x6')](_0x5ec6dc[_0x2cff('0x3')](_0x3bd1dd[0x0],0x10),_0x3bd1dd[0x1]),_0x5ec6dc[_0x2cff('0x6')](_0x5ec6dc[_0x2cff('0x3')](_0x3bd1dd[0x2],0x10),_0x3bd1dd[0x3])];case'9':_0x3bd1dd[0x0]+=_0x5ec6dc[_0x2cff('0xb')](_0x3bd1dd[0x1],0x10);continue;case'10':_0x3bd1dd[0x3]&=0xffff;continue;case'11':_0x3bd1dd[0x0]+=_0x5ec6dc[_0x2cff('0xd')](_0x44f2a1[0x0],_0x275148[0x0]);continue;case'12':_0x3bd1dd[0x0]&=0xffff;continue;case'13':_0x3bd1dd[0x2]&=0xffff;continue;case'14':var _0x3bd1dd=[0x0,0x0,0x0,0x0];continue;}break;}};}());
To decode it:
var sourceCode = `...`; [ ["_0x2cff('0x0')", "'TqBDY'"], ["_0x2cff('0x1')", "'|10|3'"], ["_0x2cff('0x2')", "'NDdmQ'"], ["_0x2cff('0x3')", "'TrNLm'"], ["_0x2cff('0x4')", "'12|8'"], ["_0x2cff('0x5')", "'qjiaL'"], ["_0x2cff('0x6')", "'pGOQI'"], ["_0x2cff('0x7')", "'YESEP'"], ["_0x2cff('0x8')", "'yKzbr'"], ["_0x2cff('0x9')", "'split'"], ["_0x2cff('0xa')", "'5|11|'"], ["_0x2cff('0xb')", "'LiNrn'"], ["_0x2cff('0xc')", "'wcaZc'"], ["_0x2cff('0xd')", "'LevDq'"], ["_0x2cff('0xe')", "'qQOxt'"], ["_0x2cff('0xf')", "'PzdNa'"], ["_0x2cff('0x10')", "'XJYMH'"], ["_0x2cff('0x11')", "'|2|13'"], ["_0x2cff('0x12')", "'1|0|1'"], ["_0x2cff('0x13')", "'4|6|7'"], ["_0x2cff('0x14')", "'|4|9|'"] ].forEach(([before, after]) => sourceCode = sourceCode.replaceAll(before, after)); console.log(sourceCode);
Note that, after this manual decode step, deobfuscator works fine on the FunctionExpressions.
FunctionExpression
The text was updated successfully, but these errors were encountered:
No branches or pull requests
URL:
https://hector.baidu.com/a.js
a.js
is a short one, so sad I'm not good enough to find out why the deobfuscator don't work.Also there is a longer
https://hectorstatic.baidu.com/1371300bc53d20f8.js
, it can only be half de-obfs-ed in v2.4.5.A snapshot of
a.js
To decode it:
Note that, after this manual decode step, deobfuscator works fine on the
FunctionExpression
s.The text was updated successfully, but these errors were encountered: