Windows Scripting Decoder FAQ

Questions

Answers

1. How do I use the decoder ?

On your unix shell, or a windows machine with perl installed, do ./dec.pl [input file] [output file]. The script assumes perl is located in /usr/bin/perl. If perl is located in a different place on your machine (eg /usr/local/bin/perl) please adapt the location in the first line of the script.

2. How do I compile a perl script ?

Perl is an interpreted language and not compiled. For the interpreter please refer to the Perl webpage.

3. How do I compile perl itself ?

Please check out the readme that comes with the perl source and refer to the Perl webpage.

4. Help! The decoder doesn't work for my asp file.

Some people had difficulties with encoded jscript, which was caused by saving the webpage in your browser etc. In this case tabs were no longer tabs but a number of spaces. This will mess up the decoding process, because not only is a single character wrong, but more characters have been introduced. This will mess up the offset in the decoding process. If you obtained the encoded file in such a way, please verify first that your tabs are still tabs and not spaces.

I initially wrote the decoder as a proof of concept, not as a perfect decoder. This means that the parsing bit fails in some rare cases and the decoder does not recognize the beginning of the encoded part. In this case you can help improve the decoder by providing me with a sample of your encoded asp file. See also (6).

5. Help! The encoded string contains unicode characters.

Some asian people mailed me scripts where unicode characters were included in the encoded string. I did not make a mapping & parser for these types of characters. You can create one yourself though using the methods described in the Howto on the main page. This means that you would have to find the three characters each unicode character maps to. I suppose it would be the same for characters that also exist in ascii. If you create such a mapping, it would be nice contribute it back so other people may use it too. If you're interested I can mail you the two simple scripts make_pat and make_list I used to construct the mapping for ascii characters.

6. How can I help improve the decoder ?

One way you can help improve the decoder by providing me with asp samples which now fail to decode. Please first check you have the latest version of the decoder (now 0.3).

7. How can I decode just the encoded string without headers ?

Some people have send me snippets which just contain the encoded string without anything else. The script expects a real encoded asp file. This means that the encoded portion is enclosed in <script language=".....encode"> [...] <%[encoded part]%>[...]</script> , otherwise the script will not start to decode. So if you ripped some encoded string from somewhere, you have to add those tags around it to make it work properly.