Como decifrar código Javascript criptografado?

  • Autor Autor Wizard
  • Data de início Data de início
Tradução em andamento: em alguns minutos este tópico estará em português. Por enquanto, o conteúdo está no original em espanhol. Ver original
Wizard

Wizard

Xi
Verificación en dos pasos activada
Buenas amigos, últimamente me estoy encontrando por varios blogs, con códigos js, pero al parecer tienen su código encriptado, así (O similares):

Inserir CODE, HTML ou PHP:
\x67\x63\x6F\x6D\x6D\x65\x6E\x74\x73","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x36\x30\x35","\x42\x4C\x4F\x47\x47\x45\x52","\x46\x49\x4C\x54\x45\x52\x45\x44\x5F\x50\x4F\x53\x54\x4D\x4F\x44","\x72\x65\x6E\x64\x65\x72","\x63\x6F\x6D\x6D\x65\x6E\x74\x73","\x64\x69\x73\x70\x6C\x61\x79","\x6E\x6F\x6E\x65","\x63\x73\x73","\x23\x67\x63\x6F\x6E\x74\x61\x69\x6E\x65\x72","\x62\x6C\x6F\x63\x6B","\x23\x63\x6F\x6D\x6D\x65\x6E\x74\x73","\x63\x6F\x6D\x2D\x6F\x6E","\x61\x64\x64\x43\x6C\x61\x73\x73","\x23\x63\x6F\x6D\x2D\x6E\x6F\x72\x6D","\x72\x65\x6D\x6F\x76\x65\x43\x6C\x61\x73\x73","\x23\x63\x6F\x6D\x2D\x67\x70\x6C\x75\x73","\x73\x72\x63","\x68\x74\x74\x70\x3A\x2F\x2F\x6C\x68\x33\x2E\x67\x6F\x6F\x67\x6C\x65\x75\x73\x65\x72\x63\x6F\x6E\x74\x65\x6E\x74\x2E\x63\x6F\x6D\x2F\x2D\x6E\x66\x72\x6B\x6F\x55\x59\x73\x56\x2D\x45\x2F\x55\x58\x56\x69\x36\x57\x37\x43\x49\x38\x49\x2F\x41\x41\x41\x41\x41\x41\x41\x41\x49\x4C\x6F\x2F\x75\x43\x53\x33\x74\x68\x65\x50\x4B\x58\x55\x2F\x73\x35\x30\x2F\x62\x6C\x6F\x67\x67\x65\x72\x5F\x6F\x6E\x2E\x70\x6E\x67","\x61\x74\x74\x72","\x68\x74\x74\x70\x3A\x2F\x2F\x6C\x68\x36\x2E\x67\x6F\x6F\x67\x6C\x65\x75\x73\x65\x72\x63\x6F\x6E\x74\x65\x6E\x74\x2E\x63\x6F\x6D\x2F\x2D\x77\x6E\x54\x62\x37\x53\x48\x41\x47\x45\x45\x2F\x55\x58\x56\x69\x36\x78\x6F\x48\x58\x41\x49\x2F\x41\x41\x41\x41\x41\x41\x41\x41\x49\x4C\x59\x2F\x36\x76\x78\x35\x45\x6D\x35\x77\x38\x4D\x49\x2F\x73\x35\x30\x2F\x70\x6C\x75\x73\x5F\x6F\x66\x66\x2E\x70\x6E\x67","\x63\x6C\x69\x63\x6B","\x68\x74\x74\x70\x3A\x2F\x2F\x6C\x68\x33\x2E\x67\x6F\x6F\x67\x6C\x65\x75\x73\x65\x72\x63\x6F\x6E\x74\x65\x6E\x74\x2E\x63\x6F\x6D\x2F\x2D\x5A\x44\x78\x6B\x39\x41\x4E\x72\x4C\x4E\x45\x2F\x55\x58\x56\x69\x36\x75\x6C\x4C\x7A\x76\x49\x2F\x41\x41\x41\x41\x41\x41\x41\x41\x49\x4C\x67\x2F\x6A\x69\x55\x79\x38\x72\x4A\x53\x5F\x4F\x6B\x2F\x73\x35\x30\x2F\x62\x6C\x6F\x67\x67\x65\x72\x5F\x6F\x66\x66\x2E\x70\x6E\x67","\x68\x74\x74\x70\x3A\x2F\x2F\x6C\x68\x33\x2E\x67\x6F\x6F\x67\x6C\x65\x75\x73\x65\x72\x63\x6F\x6E\x74\x65\x6E\x74\x2E\x63\x6F\x6D\x2F\x2D\x6F\x4E\x6C\x44\x33\x34\x37\x77\x6C\x33\x6B\x2F\x55\x58\x56\x69\x37\x41\x69\x42\x64\x48\x49\x2F\x41\x41\x41\x41\x41\x41\x41\x41\x49\x4C\x63\x2F\x4E\x78\x41\x79\x62\x38\x66\x77\x45\x66\x49\x2F\x73\x35\x30\x2F\x70\x6C\x75\x73\x5F\x6F\x6E\x2E\x70\x6E\x67","\x68\x61\x73\x43\x6C\x61\x73\x73","\x68\x6F\x76\x65\x72","\x3C\x61\x20\x68\x72\x65\x66\x3D\x22\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x6D\x79\x62\x6C\x6F\x67\x67\x65\x72\x6C\x61\x62\x2E\x63\x6F\x6D\x22\x3E\x47\x65\x74\x20\x54\x68\x69\x73\x20\x57\x69\x64\x67\x65\x74\x3C\x2F\x61\x3E","\x68\x74\x6D\x6C","\x23\x6D\x62\x6C\x72\x69\x67\x68\x74\x73","\x6C\x65\x6E\x67\x74\x68","\x23\x6D\x62\x6C\x72\x69\x67\x68\x74\x73\x3A\x76\x69\x73\x69\x62\x6C\x65","\x68\x72\x65\x66","\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x6D\x79\x62\x6C\x6F\x67\x67\x65\x72\x6C\x61\x62\x2E\x63\x6F\x6D"];gapi[_0x4c2d[6]][_0x4c2d[5]](_0x4c2d[0],{href:window[_0x4c2d[1]],width:_0x4c2d[2],first_party_property:_0x4c2d[3],view_type:_0x4c2d[4]});$(_0x4c2d[15])[_0x4c2d[22]](function (){$(_0x4c2d[10])[_0x4c2d[9]](_0x4c2d[7],_0x4c2d[8]);$(_0x4c2d[12])[_0x4c2d[9]](_0x4c2d[7],_0x4c2d[11]);$(_0x4c2d[15])[_0x4c2d[14]](_0x4c2d[13]);$(_0x4c2d[17])[_0x4c2d[16]](_0x4c2d[13]);$(_0x4c2d[15])[_0x4c2d[20]](_0x4c2d[18],_0x4c2d[19]);$(_0x4c2d[17])[_0x4c2d[20]](_0x4c2d[18],_0x4c2d[21]);} );$(_0x4c2d[17])[_0x4c2d[22]](function (){$(_0x4c2d[12])[_0x4c2d[9]](_0x4c2d[7],_0x4c2d[8]);$(_0x4c2d[10])[_0x4c2d[9]](_0x4c2d[7],_0x4c2d[11]);$(_0x4c2d[15])[_0x4c2d[16]](_0x4c2d[13]);$(_0x4c2d[17])[_0x4c2d[14]](_0x4c2d[13]);$(_0x4c2d[15])[_0x4c2d[20]](_0x4c2d[18],_0x4c2d[23]);$(_0x4c2d[17])[_0x4c2d[20]](_0x4c2d[18],_0x4c2d[24]);} );$(_0x4c2d[15])[_0x4c2d[26]](function (){if(!$(_0x4c2d[15])[_0x4c2d[25]](_0x4c2d[13])){$(_0x4c2d[15])[_0x4c2d[20]](_0x4c2d[18],_0x4c2d[19]);} ;} ,function (){if(!$(_0x4c2d[15])[_0x4c2d[25]](_0x4c2d[13])){$(_0x4c2d[15])[_0x4c2d[20]](_0x4c2d[18],_0x4c2d[23]);} ;} );$(_0x4c2d[17])[_0x4c2d[26]](function (){if(!$(_0x4c2d[17])[_0x4c2d[25]](_0x4c2d[13])){$(_0x4c2d[17])[_0x4c2d[20]](_0x4c2d[18],_0x4c2d[24]);} ;} ,function (){if(!$(_0x4c2d[17])[_0x4c2d[25]](_0x4c2d[13])){$(_0x4c2d[17])[_0x4c2d[20]](_0x4c2d[18],_0x4c2d[21]);} ;} );$(_0x4c2d[29])[_0x4c2d[28]](_0x4c2d[27]);setInterval(function (){if(!$(_0x4c2d[31])[_0x4c2d[30]]){window[_0x4c2d[1]][_0x4c2d[32]]=_0x4c2d[33];} ;} ,3000);

alguien sabe como puedo descifrarlo?
 
Foi útil? Participe da conversa

Com sua conta grátis você pode responder, mandar mensagem privada ao autor e comprar com Saldo retido: o pagamento é liberado quando você recebe o combinado.

Leva 30 segundos · você volta a este tópico ao terminar
La primera parte es esta:

Inserir CODE, HTML ou PHP:
gcomments","location","605","BLOGGER","FILTERED_POSTMOD","render","comments","display","none","css","#gcontainer","block","#comments","com-on","addClass","#com-norm","removeClass","#com-gplus","src","http://lh3.googleusercontent.com/-nfrkoUYsV-E/UXVi6W7CI8I/AAAAAAAAILo/uCS3thePKXU/s50/blogger_on.png","attr","http://lh6.googleusercontent.com/-wnTb7SHAGEE/UXVi6xoHXAI/AAAAAAAAILY/6vx5Em5w8MI/s50/plus_off.png","click","http://lh3.googleusercontent.com/-ZDxk9ANrLNE/UXVi6ulLzvI/AAAAAAAAILg/jiUy8rJS_Ok/s50/blogger_off.png","http://lh3.googleusercontent.com/-oNlD347wl3k/UXVi7AiBdHI/AAAAAAAAILc/NxAyb8fwEfI/s50/plus_on.png","hasClass","hover","<a href="http://www.mybloggerlab.com">Get This Widget</a>","html","#mblrights","length","#mblrights:visible","href","http://www.mybloggerlab.com"]

Respecto a lo otro, es ofuscación de código y es un poco más complicada de limpiar (no por complejidad, si no por ser muy tediosa).
 
La primera parte es esta:

Inserir CODE, HTML ou PHP:
gcomments","location","605","BLOGGER","FILTERED_POSTMOD","render","comments","display","none","css","#gcontainer","block","#comments","com-on","addClass","#com-norm","removeClass","#com-gplus","src","http://lh3.googleusercontent.com/-nfrkoUYsV-E/UXVi6W7CI8I/AAAAAAAAILo/uCS3thePKXU/s50/blogger_on.png","attr","http://lh6.googleusercontent.com/-wnTb7SHAGEE/UXVi6xoHXAI/AAAAAAAAILY/6vx5Em5w8MI/s50/plus_off.png","click","http://lh3.googleusercontent.com/-ZDxk9ANrLNE/UXVi6ulLzvI/AAAAAAAAILg/jiUy8rJS_Ok/s50/blogger_off.png","http://lh3.googleusercontent.com/-oNlD347wl3k/UXVi7AiBdHI/AAAAAAAAILc/NxAyb8fwEfI/s50/plus_on.png","hasClass","hover","<a rel="nofollow" href="http://www.mybloggerlab.com">Get This Widget</a>","html","#mblrights","length","#mblrights:visible","href","http://www.mybloggerlab.com"]

Respecto a lo otro, es ofuscación de código y es un poco más complicada de limpiar (no por complejidad, si no por ser muy tediosa).

Y como has hecho para obtener esa primera parte amigo?, me interesa aprender ya que tengo un monton de códigos de esa manera! 🙁
 
This is illegal. 🙂
 
depende que material quieras descifrar si es ilegal y puedes tener problemas por algo esta asi.
 
Envían a enviar una queja, es el derecho de los desarrolladores
 
Hola chicos buen dia. Tengo el mismo inconveniente. Compre un plugin y esta encriptado de la misma forma. Prove con Ddecode y parece que no funciona. Alguien puede ayudarme. Una linea del plugin es asi:
function webhook() {
header("\103\x6f\x6e\164\x65\156\164\55\x74\x79\x70\x65\72\x20\x61\x70\160\154\x69\x63\x61\x74\x69\x6f\156\57\152\x73\x6f\156", "\110\124\x54\x50\x2f\x31\56\61\x20\62\60\x30\x20\x4f\113");
$postBodyRaw = file_get_contents("\160\x68\x70\x3a\x2f\x2f\x69\x6e\x70\x75\164");
if ($postBodyRaw) {
$qr_reponse = json_decode($postBodyRaw);
if ($qr_reponse - > action && $qr_reponse - > live_mode) {
if ($qr_reponse - > data - > id) {
$curl = curl_init();
curl_setopt_array($curl, array(CURLOPT_URL => "\150\x74\x74\160\163\72\x2f\57\141\x70\x69\56\155\x65\162\143\141\144\157\x70\141\x67\x6f\56\143\x6f\x6d\x2f\166\x31\x2f\160\141\x79\155\145\156\x74\x73\57".$qr_reponse - > data - > id, CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => '', CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 0, CURLOPT_FOLLOWLOCATION => true, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "\107\x45\124", CURLOPT_HTTPHEADER => array("\x41\165\164\150\157\162\x69\172\141\164\x69\157\156\72\40\x42\145\141\162\x65\x72\x20\101\x50\120\137\125\x53\x52\55\x35\62\x33\70\x31\63\67\x30\x36\x34\x36\66\x32\71\x33\66\x2d\x30\x34\62\60\61\60\55\67\x64\x31\x32\x36\x30\x35\x30\x36\146\62\60\67\63\63\x38\144\145\x61\65\x30\145\71\141\62\x62\66\x31\x66\x39\x64\146\137\137\x4c\101\x5f\x4c\x43\x5f\x5f\x2d\x31\67\71\x33\65\x30\66\x37\65")));
$response = curl_exec($curl);
curl_close($curl);
$paymentdata = json_decode($response);
$order_id = trim($paymentdata - > external_reference, "\x51\122\55");
update_post_meta($order_id, "\x71\162\x5f\162\145\x73\x70\157\x73\x65", $response);
if ($paymentdata - > status == "\141\x70\160\162\157\166\x65\x64") {
update_post_meta($order_id, "\x71\162\x5f\x73\164\x61\164\165\x73", $paymentdata - > status);
$order = wc_get_order($order_id);
$order - > add_order_note("\x4d\x65\x72\143\x61\x64\x6f\x20\x50\x61\x67\157\x20\x51\x52\x3a\x20".__("\120\x61\171\x6d\145\x6e\164\40\x61\160\160\x72\x6f\x76\x65\x64\x2e", "\x77\x61\156\144\x65\162\x6c\x75\163\x74\x2d\161\162"));
$order = wc_get_order($order_id);
$order - > payment_complete();
 
Hola chicos buen dia. Tengo el mismo inconveniente. Compre un plugin y esta encriptado de la misma forma. Prove con Ddecode y parece que no funciona. Alguien puede ayudarme. Una linea del plugin es asi:
Busca como decodificar secuencias de escape en hexadecimal.

El problema con el código ofuscado es que es muy tedioso de "convertir" a texto legible (esa es la intención), y solo cambiar esas secuencias de escape no garantiza que puedas recuperar el código original, porque se usan otras técnicas.

Lo que si podrías hacer es ingeniería inversa, fijate qué y como hace las cosas, e intenta replicarlo por cuenta propia.
 
Busca como decodificar secuencias de escape en hexadecimal.

El problema con el código ofuscado es que es muy tedioso de "convertir" a texto legible (esa es la intención), y solo cambiar esas secuencias de escape no garantiza que puedas recuperar el código original, porque se usan otras técnicas.

Lo que si podrías hacer es ingeniería inversa, fijate qué y como hace las cosas, e intenta replicarlo por cuenta propia.
Muchas veces desencriptar no lo hace bien, peor en plugins.
 
Hola chicos buen dia. Tengo el mismo inconveniente. Compre un plugin y esta encriptado de la misma forma. Prove con Ddecode y parece que no funciona. Alguien puede ayudarme. Una linea del plugin es asi:
function webhook() {
header("\103\x6f\x6e\164\x65\156\164\55\x74\x79\x70\x65\72\x20\x61\x70\160\154\x69\x63\x61\x74\x69\x6f\156\57\152\x73\x6f\156", "\110\124\x54\x50\x2f\x31\56\61\x20\62\60\x30\x20\x4f\113");
$postBodyRaw = file_get_contents("\160\x68\x70\x3a\x2f\x2f\x69\x6e\x70\x75\164");
if ($postBodyRaw) {
$qr_reponse = json_decode($postBodyRaw);
if ($qr_reponse - > action && $qr_reponse - > live_mode) {
if ($qr_reponse - > data - > id) {
$curl = curl_init();
curl_setopt_array($curl, array(CURLOPT_URL => "\150\x74\x74\160\163\72\x2f\57\141\x70\x69\56\155\x65\162\143\141\144\157\x70\141\x67\x6f\56\143\x6f\x6d\x2f\166\x31\x2f\160\141\x79\155\145\156\x74\x73\57".$qr_reponse - > data - > id, CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => '', CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 0, CURLOPT_FOLLOWLOCATION => true, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "\107\x45\124", CURLOPT_HTTPHEADER => array("\x41\165\164\150\157\162\x69\172\141\164\x69\157\156\72\40\x42\145\141\162\x65\x72\x20\101\x50\120\137\125\x53\x52\55\x35\62\x33\70\x31\63\67\x30\x36\x34\x36\66\x32\71\x33\66\x2d\x30\x34\62\60\61\60\55\67\x64\x31\x32\x36\x30\x35\x30\x36\146\62\60\67\63\63\x38\144\145\x61\65\x30\145\71\141\62\x62\66\x31\x66\x39\x64\146\137\137\x4c\101\x5f\x4c\x43\x5f\x5f\x2d\x31\67\71\x33\65\x30\66\x37\65")));
$response = curl_exec($curl);
curl_close($curl);
$paymentdata = json_decode($response);
$order_id = trim($paymentdata - > external_reference, "\x51\122\55");
update_post_meta($order_id, "\x71\162\x5f\162\145\x73\x70\157\x73\x65", $response);
if ($paymentdata - > status == "\141\x70\160\162\157\166\x65\x64") {
update_post_meta($order_id, "\x71\162\x5f\x73\164\x61\164\165\x73", $paymentdata - > status);
$order = wc_get_order($order_id);
$order - > add_order_note("\x4d\x65\x72\143\x61\x64\x6f\x20\x50\x61\x67\157\x20\x51\x52\x3a\x20".__("\120\x61\171\x6d\145\x6e\164\40\x61\160\160\x72\x6f\x76\x65\x64\x2e", "\x77\x61\156\144\x65\162\x6c\x75\163\x74\x2d\161\162"));
$order = wc_get_order($order_id);
$order - > payment_complete();
JavaScript:
header("Content-type: application/json", "HTTP/1.1 200 OK");

$postBodyRaw = file_get_contents("php://input");

curl_setopt_array($curl, array(CURLOPT_URL => "https://api.mercadopago.com/v1/payments/".$qr_reponse - > data - > id, CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => '', CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 0, CURLOPT_FOLLOWLOCATION => true, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "\107\x45\124", CURLOPT_HTTPHEADER => array("Authorization: Bearer APP_USR-5238137064662936-042010-7d1260506f207338dea50e9a2b61f9df__LA_LC__-179350675")));

$order_id = trim($paymentdata - > external_reference, "QR-");

update_post_meta($order_id, "qr_respose", $response);

if ($paymentdata - > status == "approved") {

update_post_meta($order_id, "qr_status", $paymentdata - > status);

$order - > add_order_note("Mercado Pago QR: ".__("Payment approved.", "wanderlust-qr"));

🤭
 
JavaScript:
header("Content-type: application/json", "HTTP/1.1 200 OK");

$postBodyRaw = file_get_contents("php://input");

curl_setopt_array($curl, array(CURLOPT_URL => "https://api.mercadopago.com/v1/payments/".$qr_reponse - > data - > id, CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => '', CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 0, CURLOPT_FOLLOWLOCATION => true, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "\107\x45\124", CURLOPT_HTTPHEADER => array("Authorization: Bearer APP_USR-5238137064662936-042010-7d1260506f207338dea50e9a2b61f9df__LA_LC__-179350675")));

$order_id = trim($paymentdata - > external_reference, "QR-");

update_post_meta($order_id, "qr_respose", $response);

if ($paymentdata - > status == "approved") {

update_post_meta($order_id, "qr_status", $paymentdata - > status);

$order - > add_order_note("Mercado Pago QR: ".__("Payment approved.", "wanderlust-qr"));

🤭
Por quee los programadores mas pro del internet tiene fotos Darks dee perfil?

Y por que el tiene siempre buenas y bonitas imágenes de perfil?
9679.jpg
 
Voltar
Topo