Skip to content

Instantly share code, notes, and snippets.

@Tithen-Firion
Last active November 4, 2022 09:44
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Tithen-Firion/7ecd8cf00cfcde1955e0be7027d4bf23 to your computer and use it in GitHub Desktop.
Save Tithen-Firion/7ecd8cf00cfcde1955e0be7027d4bf23 to your computer and use it in GitHub Desktop.
$(document).ready(function() {
var _0x531f91 = $('#' + g).text();
var _0x5d72cd = _0x531f91.charCodeAt(0);
_0x5d72cd = _0x531f91;
var _0x1bf6e5 = '';
var _0x41e0ff = 7 * 8;
var _0xccbe62 = _0x5d72cd.length;
var _0x439a49 = _0x5d72cd.substring(0, _0x41e0ff);
var _0x3d7b02 = [];
var _0x31f4aa = {
'k': _0x439a49,
'ke': []
};
for (i = 0; i < _0x439a49.length; i += 8) {
_0x41e0ff = i * 8;
var _0x40b427 = _0x439a49.substring(i, i + 8);
var _0x577716 = parseInt(_0x40b427, 16);
with(_0x31f4aa) {
if (!('write' in document) || !('toString' in Math.cos && Math.cos.toString().indexOf('[native code') != -1 && document.getElementsByTagName.toString().indexOf('[native code') != -1)) {
_0x577716 = 0;
}
ke.push(_0x577716);
}
}
_0x3d7b02 = _0x31f4aa.ke;
with(Math) {
if ('toString' in sin && sin.toString().indexOf('[native code') != -1 && document.getElementById.toString().indexOf('[native code') == -1) {
_0x3d7b02 = [];
}
};
_0x41e0ff = 7 * 8;
_0x5d72cd = _0x5d72cd.substring(_0x41e0ff);
var _0x439a49 = 0;
var _0x145894 = 0;
while (_0x439a49 < _0x5d72cd.length) {
var _0x5eb93a = 64;
var _0x37c346 = 127;
var _0x896767 = 0;
var _0x1a873b = 0;
var _0x3c9d8e = 0;
var _0x31f4aa = {
'mm': 128,
'xx': 63
};
do {
if (_0x439a49 + 1 >= _0x5d72cd.length) {
_0x5eb93a = 143;
}
var _0x1fa71e = _0x5d72cd.substring(_0x439a49, _0x439a49 + 2);
_0x439a49++;
_0x439a49++;
_0x3c9d8e = parseInt(_0x1fa71e, 16);
with(_0x31f4aa) {
if (!('write' in document) || !(jQuery == $)) {
_0x3c9d8e += 10;
xx = 17;
}
if (_0x1a873b < 6 * 5) {
var _0x332549 = _0x3c9d8e & xx;
_0x896767 += _0x332549 << _0x1a873b;
} else {
var _0x332549 = _0x3c9d8e & xx;
_0x896767 += _0x332549 * Math.pow(2, _0x1a873b);
}
}
_0x1a873b += 6;
} while (_0x3c9d8e >= _0x5eb93a);
var _0x59ce16 = 681741804;
var _0x4bfb36 = 4170777108;
var _0x30725e = _0x896767 ^ _0x3d7b02[_0x145894 % 7];
_0x30725e = (_0x30725e ^ _0x59ce16) ^ _0x4bfb36;
var _0x2de433 = (_0x5eb93a * 2) + _0x37c346;
for (i = 0; i < 4; i++) {
var _0x1a9381 = _0x30725e & _0x2de433;
var _0x1a0e90 = (_0x41e0ff / 7) * i;
_0x1a9381 = _0x1a9381 >> _0x1a0e90;
var _0x3fa834 = String.fromCharCode(_0x1a9381);
if (_0x3fa834 != '%') _0x1bf6e5 += _0x3fa834;
_0x2de433 = _0x2de433 << _0x41e0ff / 7;
}
_0x145894 += 1;
}
$('#streamurl').text(_0x1bf6e5);
});
@Tithen-Firion
Copy link
Author

Tithen-Firion commented Mar 28, 2017

My deobfuscator is still WIP. It uses regular expressions, needs minified (removed unnecessary whitespaces) input, can't handle order of operations if nested ((1 + 2) * 3 in original source, after obfuscation and deobfuscation you get 1 + 2 * 3). But other then that it works fine, as you can see.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment