Converter Update - 12/2011
Thank you all for your support in the release of the Converter tool! I received a lot of good comments and based on some of your feedback, I’ve updated the tool with the ideas you gave me as well as some functions I needed to handle real-world scripts. Consider this my Christmas present to you!
Here’s a quick rundown of the new features:
Escape/Unescape
You can escape and unescape text. This turned out to be a big time saver for me when analyzing obfuscated Javascript.
Regular Expressions
You can now use regular expressions in the search/replace function. I’ve added a help screen under the Extras menu.
Keep Every x Row
I recently found a need to remove every other row of text so I added this capability. You can have it keep every 3rd, 4th, or 10th row if you want to.
Swapping Characters
I’m sure you’ve seen obfuscated Javascript that uses an algorithm that swaps characters around. You can actually deobfuscate some scripts by reversing the swaps or increasing the number of times it loops.
Mixed Format to Text
This feature allows you to convert a glob of decimal, hex, and octal values. The requirement is that decimal values must have three digits, hex must be preceded with 0x, and octal values must have four digits. I’m sure this will get limited use but at least one script I came across used this technique.
Hex Format
Many times you will encounter hex values in obfuscated Javascript. Now you can easily convert it one of several different formats. It will split every two characters and preceed them with the appropriate symbols. BE = Big Endian, LE = Little Endian.
Beautify Javascript
Instead of having to go to an online tool to make Javascript look pretty, I’ve added the code from JSBeautifier.org (credit to them). Since the limit of textboxes is 65K, don’t try to convert anything greater than that or it will truncate. This is meant for short scripts.
Convert Base
You can convert any decimal value to Base2 through 36 (and vice versa).
Custom Base64 Converter
Added the ability to convert text to Base64 using a custom character set (and vice versa). Requirement is that the character set needs to contain exactly 65 characters.
Mathematical Alphanumeric Symbols
I came across a phishing page that used these symbols to hide the URL it was POSTing to. You could always paste the string in Google but I’ve added the ability to convert in both directions. This can only convert letters and numbers (no symbols or special characters).
There’s a few more things I’ve included but the above covers the significant additions. I hope you find this tool useful! Same disclaimer as before…as-is without any warranties. Again, I packed this using UPX so AV may trigger.