The \x
only indicates the caratere to be presented in hexadecimal format and corresponding to the ASCII table.
From the documentation :
\ xXX the Latin-1 character
If we have \x61
, we can look at the ASCII table:
Dec Hex Bin Letra
97 61 01100001 a
98 62 01100010 b
99 63 01100011 c
100 64 01100100 d
101 65 01100101 e
102 66 01100110 f
103 67 01100111 g
And see that it corresponds to the letter a
which is what has 61
in the Hex
column.
let letra = "\x61";
console.log(letra);
This in itself is not encryption, but a less readable way to define the text of a string.
By analyzing the referenced site, you converted from:
function NewObject(prefix)
{
var count=0;
this.SayHello=function(msg)
{
count++;
alert(prefix+msg);
}
this.GetCount=function()
{
return count;
}
}
var obj=new NewObject("Message : ");
obj.SayHello("You are welcome.");
To:
var _0xd439=["\x53\x61\x79\x48\x65\x6C\x6C\x6F","\x47\x65\x74\x43\x6F\x75\x6E\x74","\x4D\x65\x73\x73\x61\x67\x65\x20\x3A\x20","\x59\x6F\x75\x20\x61\x72\x65\x20\x77\x65\x6C\x63\x6F\x6D\x65\x2E"];function NewObject(_0xcd7ax2){var _0xcd7ax3=0;this[_0xd439[0]]= function(_0xcd7ax4){_0xcd7ax3++;alert(_0xcd7ax2+ _0xcd7ax4)};this[_0xd439[1]]= function(){return _0xcd7ax3}}var obj= new NewObject(_0xd439[2]);obj.SayHello(_0xd439[3])
We see that the first thing you do is to create an array with all the strings used with the hexadecimal encoding to be hard to read:
var _0xd439=["\x53\x61\x79\x48\x65\x6C\x6C\x6F","\x47\x65\x74\x43\x6F\x75\x6E\x74","\x4D\x65\x73\x73\x61\x67\x65\x20\x3A\x20","\x59\x6F\x75\x20\x61\x72\x65\x20\x77\x65\x6C\x63\x6F\x6D\x65\x2E"];
console.log(_0xd439);
Then each time you need to use one of the texts access the corresponding position in the array:
SayHello(_0xd439[3])
We also see that variable names have been changed to make readability difficult, such as _0xd439
in the code line presented above. The array of names was also used by the program to define its own names of functions as SayHello
or GetCount
:
this[_0xd439[1]]= function(){return _0xcd7ax3}
Where _0xd439[1]
has GetCount
, which corresponds to have done:
this["GetCount"] = function(){return _0xcd7ax3}