!Impressions! PageParser is a nice example of obfuscation. Whilst the
altered page is not really encrypted it is damned hard to read. The
decryption technique is once again all too simple to get around, although
it does require a little 'work' to find the right way to do it. I am
not going to explain how as this has been fully covered in my
previous essays:
What have they done?
!Impressions! have made use of the javascript escape & unescape functions
these return the hexadecimal encoding of an argument in the ISO-Latin-1
character set and the ASCII string for the specified hexadecimal encoding
value respectively.
For example:
The following example returns "&":
unescape("%26")
The following example returns "!#":
unescape("%21%23")
And this example of the escape function:
escape("The_rain. In Spain, Ma'am")
returns the following:
"The_rain.%20In%20Spain%2C%20Ma%92am"
Taking the last example you can see if get a whole web page and convert
every ISO-Latin-1 character into it's hexadecimal equivalent, and also
strip all line feeds, you end up with a right old mess!
Of course it's not just a simple matter of converting these values and
dropping them onto your html page, as an amount of processing has to be
done to pass them to the unescape function.
(Otherwise you will just see garbage)
As before however the whole obfuscation is let down for the simple reason
that to pass the 'clear' text to the screen you have to use the document.write function. Yes, that's the hint ;)
I wont even bother explaining you
that you should BUY this target program if you intend to use it for a
longer period
than the allowed one. Should you want to STEAL this software instead, you
don't need to crack its protection scheme
at all: you'll find it on most Warez sites, complete and
already regged, farewell.
';
document.writeln(my_chunk);
}
}
// -->
Fravia's (frozen) homepage