-3

Any idea what this does?

===

$=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$$:({}+"")[$],$$_$:($[$]+"")[$],_$$:++$,$$$_:(!""+"")[$],$__:++$,$_$:++$,$$__:({}+"")[$],$$_:++$,$$$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.$_[$.__$])+($.$$=($.$+"")[$.__$])+((!$)+"")[$._$$]+($.__=$.$_[$.$$_])+($.$=(!""+"")[$.__$])+($._=(!""+"")[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!""+"")[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$$+"\""+$.$$_$+$._$+$.$$__+$._+"\\"+$.__$+$.$_$+$.$_$+$.$$$_+"\\"+$.__$+$.$_$+$.$$_+$.__+".\\"+$.__$+$.$$_+$.$$$+$.__+"\\"+$.__$+$.$_$+$.__$+$.__+$.$$$_+"('\\"+$.__$+$.___+$._$$+$._$+$._+"\\"+$.__$+$.$_$+$.$$_+$.__+$.$$$_+"\\"+$.__$+$.$$_+$._$_+"');"+"\"")())();

===

  • 2
    You should give at least some information about the context. – curiousguy Jun 28 '12 at 14:41
  • Part of a digital systems security assignment? :P – Kurt Jun 29 '12 at 4:05
6

It almost writes the word "Counter" to the page, but fails because of a tiny typo.

jsbeautified with comments

$ = ~ [];  // -1
$ = {
    ___: ++$,  // 0
    $$$$: (![] + "")[$], // 'f'
    __$: ++$,  // 1
    $_$_: (![] + "")[$], // 'a'
    _$_: ++$,  // 2
    $_$$: ({} + "")[$],  // 'b'
    $$_$: ($[$] + "")[$],  // 'd'
    _$$: ++$,  // 3
    $$$_: (!"" + "")[$], // 'e'
    $__: ++$,  // 4
    $_$: ++$,  // 5
    $$__: ({} + "")[$],  // 'c'
    $$_: ++$, // 6
    $$$: ++$, // 7
    $___: ++$, // 8
    $__$: ++$ // 9
};  // make a lookup of funny names to hex digits
$.$_ = ($.$_ = $ + "")[$.$_$] + ($._$ = $.$_[$.__$]) + ($.$$ = ($.$ + "")[$.__$]) + ((!$) + "")[$._$$] + ($.__ = $.$_[$.$$_]) + ($.$ = (!"" + "")[$.__$]) + ($._ = (!"" + "")[$._$_]) + $.$_[$.$_$] + $.__ + $._$ + $.$; // 'constructor'

$.$$ = $.$ + (!"" + "")[$._$$] + $.__ + $._ + $.$ + $.$$; // 'return'

$.$ = ($.___)[$.$_][$.$_];  // Function (constructor function object)

$.$( // create new function from string...
    $.$( // create new function from string...
        $.$$ + "\"" + $.$$_$ + $._$ + $.$$__ + $._ + "\\" + $.__$ + $.$_$ + $.$_$ + $.$$$_ + "\\" + $.__$ + $.$_$ + $.$$_ + $.__ + ".\\" + $.__$ + $.$$_ + $.$$$ + $.__ + "\\" + $.__$ + $.$_$ + $.__$ + $.__ + $.$$$_ + "('\\" + $.__$ + $.___ + $._$$ + $._$ + $._ + "\\" + $.__$ + $.$_$ + $.$$_ + $.__ + $.$$$_ + "\\" + $.__$ + $.$$_ + $._$_ + "');" + "\""
        // 'return"docu\155e\156t.\167t\151te('\103ou\156te\162');"'
    )() // returns "document.wtite('Counter');"
)(); // executes document.wtite('Counter');

Whoops.

This isn't a malicious script in itself, but it could well be something returned by an access monitoring script used by malware, or an inactive malware drop (eg one that only attacks a different browser), pretending to be a web beacon.

To spoil your fun, there is an online decoder for this particular obfuscation script here.

3

It is obfuscated Javascript, a la: http://utf-8.jp/public/jjencode.html

But, the online decoders I use are not able to decode.

Not the answer you're looking for? Browse other questions tagged or ask your own question.