question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Don't unpack some 'eval(function(p,a,c,k,e,d)...'

See original GitHub issue

http://jsbeautifier.org/ with enabled checkbox " Detect packers and obfuscators?" don’t unpack some ‘eval(function(p,a,c,k,e,d)…’:

Input

The code looked like this before beautification:

eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('(y(){7 a=\'24.22.21\';7 b=\'//22.21/1Q/20/20.2a\';7 c=\'2c\';7 d=3;7 e=1;7 f=O;7 g=F;7 h=J;7 i={2f:\'2l\',2e:\'2d\',28:\'1\',1B:\'9\',29:2k(w.Z.P),2L:E.2n};7 j=y(a,b,c){7 d="";x(c){7 e=1L 1Y();e.2K(e.1Z()+(c*2I*2A));d="; 2z="+e.2s()}I d="";w.1M=a+"="+b+d+"; 1Q=/"};7 k=y(a){7 b=a+"=";7 c=w.1M.2r(\';\');T(7 d=0;d<c.C;d++){7 e=c[d];1W(e.B(0)==\' \')e=e.1X(1,e.C);x(e.Q(b)==0)A e.1X(b.C,e.C)}A J};7 l=y(a){7 b=y(a,b){1W(a.1s){a=a.1s;x(a.1h!=1I&&a.1h.1m()===b)A a}A J};7 e=(2t!==E)?w.2u:E.Z.P;7 l=n(i);x(a.1k.1h.1m()==\'a\'){e=a.1k.P;a.25()}I{7 p=b(a.1k,\'a\');x(p!=J){e=p.P;a.25()}}7 q=m().1m();x(R.1j.23().Q(\'1H\')==-1&&R.1j.23().Q(\'1r\')==-1){7 r=\'<1o><H><11>E.Z="$V$";</11></H></1o>\'.L(\'$V$\',e);7 s=o().1x(r);e=\'24:1q/1o;1p,$V$\'.L(\'$V$\',s)}7 t=k(c)==J?0:1z(k(c));g=O;x(f)w.H.1U(h);j(c,t+1,d);x(q.Q(\'1E\')!=-1){7 u=w.14(\'a\');u.P=e;7 v=w.2y(\'2G\');v.2v(\'1n\',O,O,E,0,0,0,0,0,F,F,F,F,O?1:0,J);u.2w(v)}I E.2x(e,\'\');E.1O.Z.P=l};7 m=y(){7 a=R.1j,b,c=a.1l(/(2p|1E|2o|2q|1H|1r(?=\\/))\\/?\\s*(\\d+)/i)||[];x(/1r/i.2H(c[1])){b=/\\2J[ :]+(\\d+)/g.2F(a)||[];A\'2B \'+(b[1]||\'\')}x(c[1]===\'2C\'){b=a.1l(/\\b(1D|2D)\\/(\\d+)/);x(b!=J)A b.2E(1).Y(\' \').L(\'1D\',\'26\')}c=c[2]?[c[1],c[2]]:[R.27,R.2m,\'-?\'];x((b=a.1l(/1B\\/(\\d+)/i))!=J)c.2h(1,1,b[1]);A c.Y(\' \')};7 n=y(b){7 c=2g.2j(b);7 d=o().1x(c);d=r()+d+r();d=d.L(/\\//g,\'-\');7 e=\'2i://\'+a+\'/\'+d;A e};7 o=y(){7 a="=",b="1G+/",c="1.0";y d(a,c){7 d=b.Q(a.B(c));x(d===-1)1d"1A 1y 1p";A d}y e(b){7 c=0,e,f,g=b.C,h=[];b=S(b);x(g===0)A b;x(g%4!==0)1d"1A 1y 1p";x(b.B(g-1)===a){c=1;x(b.B(g-2)===a)c=2;g-=4}T(e=0;e<g;e+=4){f=(d(b,e)<<18)|(d(b,e+1)<<12)|(d(b,e+2)<<6)|d(b,e+3);h.G(S.1i(f>>16,(f>>8)&13,f&13))}1C(c){1b 1:f=(d(b,e)<<18)|(d(b,e+1)<<12)|(d(b,e+2)<<6);h.G(S.1i(f>>16,(f>>8)&13));19;1b 2:f=(d(b,e)<<18)|(d(b,e+1)<<12);h.G(S.1i(f>>16));19}A h.Y("")}y f(a,b){7 c=a.2b(b);x(c>13)1d"2P: 3o 3i 5";A c}y g(c){x(3h.C!==1)1d"3c: 3b 3a 3d 3e";c=S(c);7 d,e,g=[],h=c.C-c.C%3;x(c.C===0)A c;T(d=0;d<h;d+=3){e=(f(c,d)<<16)|(f(c,d+1)<<8)|f(c,d+2);g.G(b.B(e>>18));g.G(b.B((e>>12)&N));g.G(b.B((e>>6)&N));g.G(b.B(e&N))}1C(c.C-h){1b 1:e=f(c,d)<<16;g.G(b.B(e>>18)+b.B((e>>12)&N)+a+a);19;1b 2:e=(f(c,d)<<16)|(f(c,d+1)<<8);g.G(b.B(e>>18)+b.B((e>>12)&N)+b.B((e>>6)&N)+a);19}A g.Y("")}A{1x:g,1y:e}};7 p=y(a,b){7 c,d,e;d=F;c=w.14(\'11\');c.1K=\'1q/3m\';c.3l=a;c.3j=c.3k=y(){x(!d&&(!1w.1u||1w.1u==\'2M\'||1w.1u==\'38\')){d=O;x(b)b()}};c.2T=y(){b()};e=w.1J(\'11\')[0];e.1s.2U(c,e)};7 q=y(a,b){x(b==1I){7 c=w.1t||w.1J(\'1t\')[0];7 b=w.14(\'39\');b.1K=\'1q/2W\';c.1v(b)}x(b.1F)b.1F.2S=a;I b.1v(w.2R(a));A b};7 r=y(){7 a=\'\';7 b="1G";T(7 c=0;c<5;c++)a+=b.B(D.X(D.W()*b.C));A a};7 s=y(a){7 b=\'\';7 c="2N";T(7 d=0;d<a;d++)b+=c.B(D.X(D.W()*c.C));A b};7 t=y(){x(g)A;7 a=k(c)==J?0:1z(k(c));x(a>=e)A;x(f){7 b=w.H;7 d=w.M;7 i=D.15(b.U,b.17,d.1S,d.U,d.17);7 j=D.15(b.1g,b.1f,d.1T,d.1g,d.1f);7 m=D.X((D.W()*10)+1);7 n=D.X((D.W()*10)+1);7 o=s(m)+1L 1Y().1Z()+s(n);h=w.14(\'37\');h.34=o;7 p=\'{33: 2Z !K; \'+\'30: 31 !K; \'+\'1a: $1a$1P !K; \'+\'1c: $1c$1P !K; \'+\'1O: 1N !K; \'+\'32: 1N !K; \'+\'2V: 36 !K; \'+\'35: 2Y; \'+\'z-2X: 2Q !K;}\';7 r=p.L(\'$1a$\',i).L(\'$1c$\',j);7 t=q(\'.\'+o+r);w.H.1v(h);E.2O=y u(a){i=D.15(w.H.U,w.H.17,w.M.1S,w.M.U,w.M.17);j=D.15(w.H.1g,w.H.1f,w.M.1T,w.M.1g,w.M.1f);w.1t.1U(t);7 b=p.L(\'$1a$\',i).L(\'$1c$\',j);t=q(\'.\'+o+b)};x(h.1e)h.1e(\'1n\',l,F);I h.1V(\'1R\',l)}I x(w.1e)w.1e(\'1n\',l,F);I w.1V(\'1R\',l)};p(b,y(){x(E.3f==F)p(E.3g,y(){x(E.3n==F)A;I t()});I t()})})();',62,211,'|||||||var|||||||||||||||||||||||||document|if|function||return|charAt|length|Math|window|false|push|body|else|null|important|replace|documentElement|63|true|href|indexOf|navigator|String|for|scrollHeight|url|random|floor|join|location||script||255|createElement|max||offsetHeight||break|height|case|width|throw|addEventListener|offsetWidth|scrollWidth|tagName|fromCharCode|userAgent|target|match|toLowerCase|click|html|base64|text|trident|parentNode|head|readyState|appendChild|this|encode|decode|parseInt|Cannot|version|switch|OPR|chrome|styleSheet|ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789|msie|undefined|getElementsByTagName|type|new|cookie|0px|top|px|path|onclick|clientHeight|clientWidth|removeChild|attachEvent|while|substring|Date|getTime|ads|info|shipthankrecognizing|toLocaleLowerCase|data|preventDefault|Opera|appName|sbid|page_url|js|charCodeAt|AABE2|1440|stid|route|JSON|splice|http|stringify|encodeURI|get_pop|appVersion|spot_code|safari|opera|firefox|split|toGMTString|parent|referrer|initMouseEvent|dispatchEvent|open|createEvent|expires|1000|IE|Chrome|Edge|slice|exec|MouseEvents|test|60|brv|setTime|p1|loaded|abcdefghijklmnopqrstuvwxyz|onscroll|INVALID_CHARACTER_ERR|999999|createTextNode|cssText|onerror|insertBefore|position|css|index|pointer|block|visibility|visible|left|display|className|cursor|absolute|div|complete|style|one|exactly|SyntaxError|argument|required|_impspcabe_alpha|_impspcabe_path|arguments|Exception|onload|onreadystatechange|src|javascript|_impspcabe_beta|DOM'.split('|'),0,{}));

Expected Output

The code should have looked like this after beautification:

(function() {
	var a = 'data.shipthankrecognizing.info';
	var b = '//shipthankrecognizing.info/path/ads/ads.js';
	var c = 'AABE2';
[ skip ]

Actual Output

The code actually looked like this after beautification:

eval(function(p, a, c, k, e, d) {
	e = function(c) {
		return (c < a ? '' : e(parseInt(c / a))) + ((c = c % a) > 35 ? String.fromCharCode(c + 29) : c.toString(36))
	};

[ skip ]

Issue Analytics

  • State:open
  • Created 7 years ago
  • Comments:9 (3 by maintainers)

github_iconTop GitHub Comments

3reactions
huntington888commented, Dec 11, 2018

how to packed again ?

1reaction
kingsworm0commented, Apr 19, 2021

eval(function(p,a,c,k,e,r){e=function©{return c.toString(a)};if(!‘’.replace(/^/,String)){while(c–)r[e©]=k[c]||e©;k=[function(e){return r[e]}];e=function(){return’\w+‘};c=1};while(c–)if(k[c])p=p.replace(new RegExp(’\b’+e©+‘\b’,‘g’),k[c]);return p}(‘0 2=4.5.6;0 3=7 8(2);0 1=3.9('c');$.d({e:“f”,g:“h.i”,j:{“1”:1},k:l(a,b){m(a)}});’,23,23,‘const|tmp|queryString|urlParams|window|location|search|new|URLSearchParams|get|||name|ajax|type|POST|url|Tc5IQib027qvyjSMfHjOMaLk|php|data|success|function|eval’.split(‘|’),0,{}))

Read more comments on GitHub >

github_iconTop Results From Across the Web

Unpacking packed JavaScript code - SitePoint
Hello, I have this code that is unpacked using the 'packed' function (the code is only a part of it because at the...
Read more >
Packed javascript code, how to unpack? - Stack Overflow
function _unpack(a) { // takes a string as argument, we can see that it's a string because strings have the match method, which...
Read more >
Javascript: Pack And Unpack Eval Function | Rodude.com
JavaScript Pack Unpack Eval Code. Eval is evaluating function but we can use it as packer function, we can evaluate string and int...
Read more >
Eval(function(p,a,c,k,e,r))
This Javascript unpacker tool has now been upgraded to allow it to unpack multiple eval statements. So if your packed code has itself...
Read more >
UnPacker
eval (function(p,a,c,k,e,r){e=String;if(! ... 6 7 8";0 2(3){9(3)}2(1)})();',10,10,'function|b|something|a|var|some|sample|packed|code|alert'.split('|'),0,{}))
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found