Strange encoding

**David Given** · Jul 23 '05, 05:50 PM

Re: Strange encoding

Luc wrote:
[...][color=blue]
> Is it a strange character set ? an obfuscation ? both ?[/color]

It's obfuscation. The author is trying to prevent you from reading the
source, which I've included at the end, because it's pretty meaty.

I suppose it *might* be an attempt to compress the script --- the
unobfuscated output is much larger than the input --- but doing that in
Javascript is a total waste of time; you're far better off just using a
gzip transport. You get better compression and you don't need the kind of
crap in the script.

Incidentally, if you're tempted to obfuscate your scripts --- don't. You
can't stop people from reading your scripts. At all. There's no point even
trying. All you'll do is make your code more brittle and prone to bugs.

There is one other reason why people try and obfuscate their scripts; it's a
(mostly futile) attempt to work around browser security. Some web proxies
examine the web pages an attempt to remove scripts they think are
malicious. It's much harder for them, of course, to decipher the above.

Incidentally, I decoded it by cut-and-pasting into the js command-line
Javascript interpreter. It took maybe thirty seconds, most of which were
spent in working out where the line breaks were. I then fed it to indent to
pretty-print it. (I haven't got it quite right; I think I may have missed a
couple of characters in the cut-and-paste. But at least it's readable.)

---script follows---
function navigation(navB utton, enabledAlt, disabledAlt)
{
this.linkObj = topNav.document .getElementById (navButton);
this.linkObj.on click = this.navClick;
this.enabled = true;
this.enabledAlt = enabledAlt;
this.disabledAl t = disabledAlt;
this.linkObj.en abledImage = this.linkObj.fi rstChild.src;
varstart =
this.linkObj.fi rstChild.src.su bstring(0,
this.linkObj.fi rstChild.
src.indexOf(thi s.linkObj.
id.
toLowerCase
()));
varend =
this.linkObj.fi rstChild.src.su bstring(this.li nkObj.firstChil d.
src.indexOf(thi s.linkObj.
id.
toLowerCase
()),
this.linkObj.fi rstChild.
src.length);
this.linkObj.di sabledImage = start + 'grey' + end;
this.enable = enable_m;
this.disable = disable_m;
};

navigation.prot otype.navClick = function()
{
eval('root.navA ction("' + this.id + '")');
};

functiondisable _m()
{
this.linkObj.on click = null;
this.linkObj.st yle.cursor = '';
this.enabled = false;
this.linkObj.fi rstChild.alt = this.disabledAl t;
this.linkObj.fi rstChild.title = this.disabledAl t;
this.linkObj.fi rstChild.src = this.linkObj.di sabledImage;
};

functionenable_ m()
{
this.linkObj.on click = this.navClick;
this.linkObj.st yle.cursor = parent.pointer;
this.enabled = true;
this.linkObj.fi rstChild.alt = this.enabledAlt ;
this.linkObj.fi rstChild.title = this.enabledAlt ;
this.linkObj.fi rstChild.src = this.linkObj.en abledImage;
};

functionbookmar kConstructor()
{
this.linkObj = topNav.document .getElementById ('bookmarkButto n');
this.linkObj.cr eateImage = this.linkObj.fi rstChild.src;
this.linkObj.de leteImage = '../images/bookmarkdelete. gif';
this.linkObj.st yle.cursor = parent.pointer;
this.linkObj.pa rentObj = this;
this.enabled = true;
this.linkObj.en abledImage = this.linkObj.fi rstChild.src;
varstart =
this.linkObj.fi rstChild.src.su bstring(0,
this.linkObj.fi rstChild.
src.indexOf('bo okmark'));
varend =
this.linkObj.fi rstChild.src.su bstring(this.li nkObj.firstChil d.
src.indexOf('bo okmark'),
this.linkObj.fi rstChild.
src.length);
this.linkObj.di sabledImage = start + 'grey' + end;
this.setDelete = setDelete_m;
this.setCreate = setCreate_m;
this.enable = enable_m;
this.disable = disable_m;
};

functionsetDele te_m()
{
this.linkObj.fi rstChild.src = this.linkObj.de leteImage;
this.linkObj.on click = deleteBookmark_ m;
this.linkObj.fi rstChild.alt = buttonDeleteBoo kmarkAlt;
this.linkObj.fi rstChild.title = buttonDeleteBoo kmarkAlt;
};

functionsetCrea te_m()
{
this.linkObj.fi rstChild.src = this.linkObj.cr eateImage;
this.linkObj.on click = createBookmark_ m;
this.linkObj.fi rstChild.alt = buttonCreateBoo kmarkAlt;
this.linkObj.fi rstChild.title = buttonCreateBoo kmarkAlt;
};

functioncreateB ookmark_m()
{
root.bookmarks[root.bookmarks. length] =
root.currentDoc ument.nodeGloba lID;
root.addBookmar k(root.
findNodeGlobalI D(root.currentD ocument.
nodeGlobalID));
this.parentObj. setDelete();
};

functiondeleteo okmark_m()
{
var arrayString = arrayToStr(root .bookmarks, ':');

deleteroot.book marks;
root.bookmarks = arrayString.spl it(':').reverse ();
for (var counter = 0; counter < root.bookmarks. length; counter++)
{
if (root.bookmarks[counter] ==
root.currentDoc ument.nodeGloba lID)
{
root.bookmarks. splice(counter, 1);
break;
}
}
root.deleteBook mark(root.
findNodeGlobalI D(root.currentD ocument.
nodeGlobalID));
this.parentObj. setCreate();
};
---script ends---

--
+- David Given --McQ-+ "...you could wire up a *dead rat* to a DIMM
| dg@cowlark.com | socket, and the PC BIOS memory test would pass it
| (dg@tao-group.com) | just fine." --- Ethan Benson
+- www.cowlark.com --+

**Randy Webb** · Jul 23 '05, 05:50 PM

Re: Strange encoding

David Given wrote:
[color=blue]
> Luc wrote:
> [...]
>[color=green]
>>Is it a strange character set ? an obfuscation ? both ?[/color]
>
>
> It's obfuscation. The author is trying to prevent you from reading the
> source, which I've included at the end, because it's pretty meaty.[/color]

Meaty and indicative of the ability of the author of it.

[color=blue]
> navigation.prot otype.navClick = function()
> {
> eval('root.navA ction("' + this.id + '")');
> };[/color]

Why they decided they needed eval there is beyond me....... Perhaps
whoever wrote it should read this groups FAQ.

There is more wrong with that code but the above is the best example of it.

--
Randy
comp.lang.javas cript FAQ - http://jibbering.com/faq & newsgroup weekly

**Douglas Crockford** · Jul 23 '05, 05:50 PM

Re: Strange encoding

>> It's obfuscation. The author is trying to prevent you from reading the[color=blue][color=green]
>> source, which I've included at the end, because it's pretty meaty.[/color]
>
>
> Meaty and indicative of the ability of the author of it.
>
>[color=green]
>> navigation.prot otype.navClick = function()
>> {
>> eval('root.navA ction("' + this.id + '")');
>> };[/color]
>
>
> Why they decided they needed eval there is beyond me....... Perhaps
> whoever wrote it should read this groups FAQ.
>
> There is more wrong with that code but the above is the best example of it.[/color]

That is the best reason to obfuscate: to hide ignorance and faulty
technique.

**Luc** · Jul 23 '05, 05:51 PM

Re: Strange encoding

> > Why they decided they needed eval there is beyond me....... Perhaps[color=blue][color=green]
> > whoever wrote it should read this groups FAQ.
> >
> > There is more wrong with that code but the above is the best example of it.[/color]
>
> That is the best reason to obfuscate: to hide ignorance and faulty
> technique.[/color]

Thanks you for your replies.
Finally, I only replaced the eval(S) by an output of the var S, which
printed the same as you did, to be able read the code with no
indentation.

For your information ...
the obfuscated code, was included with many others files ( about 60Mo
!!! ),
to display only a frameset with a menu ( funny menu ... but ... ) and
about 20 html pages.
It takes about 2mns to load on a PIII 1.2Ghz ( the author wrote a
"please wait" text .. thanks ! ). I have to modify 60 *packages* like
this one ( yes ... 1,2Go for all !!! )

Why do I need to modify/look at this bad code?
This code is a part of the documentation of a product, sold anywhere
in the world by one of the most important IT companies. This company
is a member of the w3c consortium ( they claim to follow their
standards, do they ?!! )

I had to modify only a few minor elements to add these documentations
to an intranet ... I'm only a technician in charge of some web
developpements, but i'm so irritated to read such codes ( how much was
paid the man who wrote this code ? more than myself, sure ).

Anyway, thanks you for your answers.

Luc

Strange encoding

Strange encoding

Comment

Comment

Comment

Comment