Re: decyphering spam

[Nicos Gollan]

On Thursday June 2 2005 22:18, michael wrote:
> how do i decypher what the following HTML/javascript attempts (original
> 'write' was all one line)?

First, you shove it through that Perl script with the line intact (isn't 
downloading Videos from "secure" pages fun...):

#!/usr/bin/perl -w

use strict;

foreach (<STDIN>) {
        s/\%([0-9a-fA-F]{1,2})/print STDOUT chr(hex($1))/ge;
}

Afterwards, you search the resulting JavaScript fragment for what the dF 
function actually does. It decodes to this:

<SCRIPT LANGUAGE="javascript">document.write('empty..');</SCRIPT>
<script language="javascript">
function dF(s){
  var s1=unescape(s.substr(0,s.length-1));
  var t= '';
 for(i=0;i<s1.length;i++)
    t += String.fromCharCode(
        s1.charCodeAt(i)-s.substr(s.length-1,1) );
  document.write(unescape(t));}
</script>{]

Have fun. I found that it's actually pretty simple to just re-implement 
whatever it does in a programming language of your choice and just dump 
everything to stdout.

-- 
Got Backup?

Jabber: Shadowdancer at jabber.fsinf.de

pgp8iuOCMYIkQ.pgp
Description: PGP signature