How to decompile this?

Question

I am decompiling a google chrome extension, because it seems suspicious. The extension was written in javascript, but can somebody tell me exactly what symbols like this are, and how to "translate" them back to normal strings?

"\x63\x68\x61\x72\x43\x6F\x64\x65"

Jsbin of the full file: http://jsbin.com/OnEviRa/1/

Just paste that string into the browser console. It's the string, "charCode". — Pointy, Sep 21 '13 at 12:06
Or if that doesn't work, paste it into a stackoverflow question. — redolent, Jan 23 '14 at 18:00

score 0 · Answer 1 · answered Sep 21 '13 at 12:48

the code seems to be using an array to hide all the strings, and they seemed to have changed variable names to hide their meaning.

I can't give you a good automated way to change variable names to something meaningful, but the strings are easy.

you can evaluate the array, then use a regex to replace all occurences of _0x13d2[number] with "evaluated result".

here is a fiddle of it

How to decompile this?

1 Answers1