1. ## Interesting Crypto Function

I encountered this function in a Javascript packer/protector (yes, they do exist! easy to unpack though...)
Code:
```function x(x) {
var l=x.length,b=1024,
i,j,r,p=0,s=0,w=0,
t=Array(63,32,52,0,57,54,51,13,20,26,0,0,0,0,0,0,5,39,41,45,11,10,16,37,29,55,12,33,42,60,19,3,49,47,22,21,56,50,4,18,44,48,61,0,0,0,0,30,0,34,27,14,25,15,46,9,59,6,7,62,36,58,43,8,28,35,40,38,24,23,1,2,31,17,53);

for(j=Math.ceil(l/b);j>0;j--) {
r='';
for(i=Math.min(l,b);i>0;i--,l--) {
w|=(t[x.charCodeAt(p++)-48])<<s;
if(s) {
r+=String.fromCharCode(165^w&255);
w>>=8;s-=2
} else {
s=6
}
}
document.write(r);
}
}```
It takes as input a huge long string (the ciphertext, which appears to be base-64) and transforms it into cleartext HTML.

I'm just wondering if anyone here can figure out how it operates, as my knowledge of Javascript is much less than Asm or C/C++.

2. Well,
* it takes each char of the string (x.charCodeAt(p++)) and sub '0' from it;
* it uses such result as index in t[];
* the result in t[] is shifted left by s (0 first time);
* if s!=0 add to r string a char: 165^w&0xFF and then
** w>>=8, s-=2
** else s=6
basically,
r+=String.fromCharCode(165^w&255); == add a char to a string
document.write(r); == fwrite to the output stream
x.charCodeAt(p++) == x[p++] (where x is a char *)
j=Math.ceil(l/b) == ((int)(l/b))+1
Math.min(l,b) == min(l,b)

3. input >> base64decode >> XOR 165 >> html

#### Posting Permissions

• You may not post new threads
• You may not post replies
• You may not post attachments
• You may not edit your posts
•