Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Any idea what this does?

===

$=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$$:({}+"")[$],$$_$:($[$]+"")[$],_$$:++$,$$$_:(!""+"")[$],$__:++$,$_$:++$,$$__:({}+"")[$],$$_:++$,$$$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.$_[$.__$])+($.$$=($.$+"")[$.__$])+((!$)+"")[$._$$]+($.__=$.$_[$.$$_])+($.$=(!""+"")[$.__$])+($._=(!""+"")[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!""+"")[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$$+"\""+$.$$_$+$._$+$.$$__+$._+"\\"+$.__$+$.$_$+$.$_$+$.$$$_+"\\"+$.__$+$.$_$+$.$$_+$.__+".\\"+$.__$+$.$$_+$.$$$+$.__+"\\"+$.__$+$.$_$+$.__$+$.__+$.$$$_+"('\\"+$.__$+$.___+$._$$+$._$+$._+"\\"+$.__$+$.$_$+$.$$_+$.__+$.$$$_+"\\"+$.__$+$.$$_+$._$_+"');"+"\"")())();

===

share|improve this question
2  
You should give at least some information about the context. –  curiousguy Jun 28 '12 at 14:41
    
Part of a digital systems security assignment? :P –  Prowla Jun 29 '12 at 4:05
add comment

closed as not a real question by Scott Pack, Jeff Ferland, AviD Aug 18 '12 at 20:44

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

It is obfuscated Javascript, a la: http://utf-8.jp/public/jjencode.html

But, the online decoders I use are not able to decode.

share|improve this answer
add comment

It almost writes the word "Counter" to the page, but fails because of a tiny typo.

jsbeautified with comments

$ = ~ [];  // -1
$ = {
    ___: ++$,  // 0
    $$$$: (![] + "")[$], // 'f'
    __$: ++$,  // 1
    $_$_: (![] + "")[$], // 'a'
    _$_: ++$,  // 2
    $_$$: ({} + "")[$],  // 'b'
    $$_$: ($[$] + "")[$],  // 'd'
    _$$: ++$,  // 3
    $$$_: (!"" + "")[$], // 'e'
    $__: ++$,  // 4
    $_$: ++$,  // 5
    $$__: ({} + "")[$],  // 'c'
    $$_: ++$, // 6
    $$$: ++$, // 7
    $___: ++$, // 8
    $__$: ++$ // 9
};  // make a lookup of funny names to hex digits
$.$_ = ($.$_ = $ + "")[$.$_$] + ($._$ = $.$_[$.__$]) + ($.$$ = ($.$ + "")[$.__$]) + ((!$) + "")[$._$$] + ($.__ = $.$_[$.$$_]) + ($.$ = (!"" + "")[$.__$]) + ($._ = (!"" + "")[$._$_]) + $.$_[$.$_$] + $.__ + $._$ + $.$; // 'constructor'

$.$$ = $.$ + (!"" + "")[$._$$] + $.__ + $._ + $.$ + $.$$; // 'return'

$.$ = ($.___)[$.$_][$.$_];  // Function (constructor function object)

$.$( // create new function from string...
    $.$( // create new function from string...
        $.$$ + "\"" + $.$$_$ + $._$ + $.$$__ + $._ + "\\" + $.__$ + $.$_$ + $.$_$ + $.$$$_ + "\\" + $.__$ + $.$_$ + $.$$_ + $.__ + ".\\" + $.__$ + $.$$_ + $.$$$ + $.__ + "\\" + $.__$ + $.$_$ + $.__$ + $.__ + $.$$$_ + "('\\" + $.__$ + $.___ + $._$$ + $._$ + $._ + "\\" + $.__$ + $.$_$ + $.$$_ + $.__ + $.$$$_ + "\\" + $.__$ + $.$$_ + $._$_ + "');" + "\""
        // 'return"docu\155e\156t.\167t\151te('\103ou\156te\162');"'
    )() // returns "document.wtite('Counter');"
)(); // executes document.wtite('Counter');

Whoops.

This isn't a malicious script in itself, but it could well be something returned by an access monitoring script used by malware, or an inactive malware drop (eg one that only attacks a different browser), pretending to be a web beacon.

To spoil your fun, there is an online decoder for this particular obfuscation script here.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.