Saturday 22 September 2018

Decrypt the encrypted JavaScript in Blogger Theme

Many people use Blogger. Particularly, Blogger themes have encrypted JavaScript inside and then they ask how to remove that. So, read this complete post to know how to remove/unpack the JavaScript from these themes.


Why the encrypted JavaScript?

Encrypted JavaScript is used to encrypt some lines of the JavaScript code on the webpage particularly the JavaScript which is used for keeping the credit of the theme(credit gives them a back-link). So if you have purchased the theme then there's no problem. If you removed the script directly then your theme starts to misbehave(some sections of the theme may not appear).

In this post, I'll not only tell you how to remove that credit removing script, but will also tell you how to unpack/decrypt those scripts.


Note : - This tutorial is little outdated, Check this new one!

Types Of Scripts

There are typically 2 types of scripts found in the Blogger templates that are either encrypted or packed into a function. If you can't see any direct executable JavaScript code. If you want to modify any code, it becomes much difficult. I've come up with 2 tools to help you to decrypt or unpack those script.
But first, we need to have a look at those scripts so that you can distinguish them and use the tool.

1.Packed Scripts

You must have seen the following type of scripts in the Blogger template.
eval(function(p,a,c,k,e,r){e=String;if(!''.replace(/^/,String)){while(c--)r[c]=k[c]||c;k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('(0(){4 1="5 6 7 8";0 2(3){9(3)}2(1)})();',10,10,'function|b|something|a|var|some|sample|packed|code|alert'.split('|'),0,{}))
They say function(p,a,c,k,e,d)... and so on at startings.
Steps to unpack this type of packed javascript are-

  1. Copy the whole function starting from eval() to the end of the code.
  2. Go to Javascript unpacker and paste that code into the box and click 'unpack'.
  3. After successfully unpacked, Copy the code in Output and replace that with the main code.
Note: You may take a backup of the theme before replacing the code as if you got mixed up, then you can restore it back.

2.Encrypted Scripts

Encrypted scripts look something lime below and are defined as the object in a variable.
var _0x760d=["\x64\x69\x73\x70\x6C\x61\x79","\x69\x6E\x6C\x69\x6E\x65\x2D\x62\x6C\x6F\x63\x6B","\x63\x73\x73","\x23\x6D\x73\x63\x6F\x6E\x74\x65\x6E\x74","\x43\x72\x65\x61\x74\x65\x64\x20\x62\x79\x20\x3C\x61\x20\x68\x72\x65\x66\x3D\x22\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x6D\x73\x64\x65\x73\x69\x67\x6E\x62\x64\x2E\x63\x6F\x6D\x22\x3E\x4D\x53\x20\x44\x65\x73\x69\x67\x6E\x3C\x2F\x61\x3E","\x68\x74\x6D\x6C","\x6C\x65\x6E\x67\x74\x68","\x23\x6D\x73\x63\x6F\x6E\x74\x65\x6E\x74\x3A\x76\x69\x73\x69\x62\x6C\x65","\x68\x72\x65\x66","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x6D\x73\x64\x65\x73\x69\x67\x6E\x62\x64\x2E\x63\x6F\x6D","\x72\x65\x61\x64\x79"];
Steps for decrypting this type of the text is below. Sometimes this encrypted Javascript is inside the function(p,a,c,k,e,d). That means we need to unpack the scripts to decrypt this type of scripts.
  1. Copy the code between '=' and ';' {equal to and semicolon}.
  2. Paste it into the first textbox in JS decrypter.
  3. Click on decrypt.
  4. After successfully decryption, Copy the code in Output and replace that with the main code.
After decrypting, the above code will look something like below-
display,inline-block,css,#mscontent,Created by <a href="http://www.msdesignbd.com">MS Design</a>,html,length,#mscontent:visible,href,location,http://www.msdesignbd.com,ready

JavaScript decrypter webtool
Screenshot of the script decrypted in JS decrypter.

Tools Used

The tools used above are:-

  1. Javascript Unpacker (to unpack the JavaScript)
  2. Javascript Decrypter (to decrypt the encrypted JavaScript)

Demonstration

Here I've taken a free Blogger theme and going to unpack all the encrypted scripts in it.
First I'm going to search for the encrypted script. That's not there anywhere in the document so I searched for eval.
eval(packed)
After selecting and copying that code, unpack that(see the picture below.).
JS Unpacker
Okay so you can see the unpacked function of remove HTML tag which was encrypted.So if you had removed the script directly, the theme would have misbehaved.Now when I scroll down, you can see the encrypted script there.Its noting but the simple text when decrypted.(Click on Images to open).
JavaScript variable
Copy this and paste into JS Decrypter.
JS decrypter for blogger
Finally, replace the decrypted text and Unpacked text with the original once!

Conclusion

This is how you can decrypt those scripts. If you want to decrypt those scripts to remove the footer credit(I've already made a post on how to hide them!), you're free to!
This post may go a little advanced for some:/
This is just a general post for sharing a way of decryption and there are many other techniques to decrypt the same functions.
Thanks for reading this, if found it helpful - tell me in the comment section below.

60 comments:

  1. Thank you for the useful information in this post! I found it to be very helpful, and I have saved the post for the future, and will share with friends who need help :)

    ReplyDelete
  2. how you got adsense approval in .blogspot.com domain??? its not possible.. i tried so much time but failed

    ReplyDelete
    Replies
    1. go this site i will tell you how to get adsense blogspot.com
      http://technonews5731.blogspot.com

      Delete
    2. It's lot easier to do that...just consistent with your content :)

      Delete
  3. www.mynaijarecent.blogspot.com pls help me

    ReplyDelete
  4. I don't know what to comment creatively, I didn't even know how I landed on this page, but I am glad I did, it was a fantastic article, appreciate it... Cheers...

    ReplyDelete
  5. i have also palki template but cant remove footer credit

    ReplyDelete
    Replies
    1. This is with the reference to Palki theme only.Just try again & follow all the steps :)

      Delete
  6. great indeed its abeutiful website great information

    ReplyDelete
  7. https://www.cssmagzdemo.ml/p/javascript-deyrypter-for-blogger-themes.html
    not working help

    ReplyDelete
  8. the link of javascript decrypter is not working please provide another link for js decrypter ASAP

    ReplyDelete
    Replies
    1. Thanks for letting us know, Its working fie now :)

      Delete
  9. i follow all the steps and i also repeat it but unfortunately i couldn't find the template credit of my blog. Any help please

    ReplyDelete
    Replies
    1. You can search the exact words in the source code as they appear on the template.
      You can use ctrl + f to use find tool.

      Delete
    2. Please check out my site (https://www.guidetricks.com/) i can't find the footer credit for msdesign

      Delete
    3. Yes, your template is from template mark and not from msdesign .So you need to search for Template Mark.

      Delete
    4. Still i can't locate it sir can you assist?

      Delete
    5. Yes, you can message on Facebook.

      Delete
  10. Hey bro. I have done everything that you said but what to do to after replacing the code.

    ReplyDelete
    Replies
    1. still, when i remove id=mycontent, my website gets redirected

      Delete
    2. Yes it will redirect as you didn't removed the link till now.
      You need to identify and remove the link to which it is redirecting.
      Use ctrl+f and find that link and delete it :)

      Delete
  11. Hi admin,
    Thank you for valuable info. However I'm unable to decrypt the code though I followed your instruction above. Is it possible to send you the text file and if I'm doing right or code is possible to decrypt?
    Thanks again.

    ReplyDelete
  12. can you unpack this ??

    https://pastebin.com/7bQUNSvp

    ReplyDelete
    Replies
    1. Yes, this can be successfully unpacked using this tool - Javascript Decrypter

      Delete
  13. hi ... can u unpack this ?

    https://drive.google.com/open?id=12wMIx-22xTZqCBLaQhjA_POk3zIl9JzH

    ReplyDelete
    Replies
    1. Yes, see this https://pastebin.com/dyjCEFbU

      Delete
    2. well i have decrypted till here but would like to decrypt it completely i mean those _0x1be2x1

      Delete
    3. Unfortunately, they are variables and you cannot further decrypt them,

      Delete
  14. Can you explain way to crypt those javascript? Thank you.

    ReplyDelete
  15. Replies
    1. Hi, this might be not working for you because your theme may have some other decrypting technique. I suggest you to watch the video at the end of this page. This will definitely help you.

      Delete
  16. Hi there,
    I follow your instraction but i'm not removed succefully footer credits. This is my site url https://www.techinfoio.com/ Can you help me.

    ReplyDelete
    Replies
    1. I can see that you removed the footer credit!

      Thanks for the comment!

      Delete
  17. Pls how do I customize my blogger template

    ReplyDelete
    Replies
    1. For customization , you can use layout section in the Blogger Dashboard.

      Delete
  18. This comment has been removed by the author.

    ReplyDelete
  19. not working slider is still locked :(
    https://itest010.blogspot.com/

    ReplyDelete
  20. Hello sir, when I try decrypt to this js code it not looks like your decrypted code. here is my code. please let me know how can I decrypt this code.

    var _0x26a9=["\x39\x44\x28\x37\x69\x28\x70\x2C\x61\x2C\x63\x2C\x6B\x2C\x65\x2C\x64\x29\x7B\x65\x3D\x37\x69\x28\x63\x29\x7B\x37\x68\x28\x63\x3C\x61\x3F\x27\x27\x3A\x65\x28\x37\x6C\x28\x63\x2F\x61\x29\x29\x29\x2B\x28\x28\x63\x3D\x63\x25\x61\x29\x3E\x33\x35\x3F\x39\x48\x2E\x39\x49\x28\x63\x2B\x32\x39\x29\x3A\x63\x2E\x39\x4E\x28\x33\x36\x29\x29\x7D\x3B\x39\x4C\x28\x63\x2D\x2D\x29\x7B\x37\x6A\x28\x6B\x5B\x63\x5D\x29\x7B\x70\x3D\x70\x2E\x39\x4A\x28\x37\x6B\x20\x39\x4B\x28\x27\x5C\x5C\x62\x27\x2B\x65\x28\x63\x29\x2B\x27\x5C\x5C\x62\x27\x2C\x27\x67\x27\x29\x2C\x6B\x5B\x63\x5D\x29\x7D\x7D\x37\x68\x20\x70\x7D\x28\x27\x47\x20\x34\x68\x3D\x5B\x5C\x27\x5C\x5C\x31\x30\x5C\x5C\x31\x62\x5C\x5C\x6F\x5C\x5C\x36\x5C\x5C\x39\x5C\x27\x2C\x5C\x27\x5C\x5C\x36\x5C\x5C\x33\x5C\x5C\x31\x5C\x5C\x36\x5C\x27\x2C\x5C\x27\x5C\x5C\x38\x5C\x5C\x74\x5C\x5C\x34\x5C\x5C\x68\x5C\x5C\x4F\x5C\x5C"]\x36\x5C\x27\x2C\x5C\x27\x5C\x5C\x6E\x5C\x5C\x34\x5C\x5C\x68\x5C\x5C\x33\x5C\x5C\x66\x5C\x5C\x36\x5C\x27\x2C\x5C\x27\x5C\x5C\x34\x5C\x5C\x6E\x5C\x5C\x6E\x5C\x5C\x33\x5C\x5C\x66\x5C\x5C\x63\x5C\x27\x2C\x5C\x27\x5C\x5C\x48\x5C\x5C\x76\x5C\x5C\x65\x5C\x5C\x71\x5C\x5C\x38\x5C\x5C\x65\x5C\x5C\x34\x5C\x5C\x37\x5C\x5C\x37\x5C\x5C\x4C\x5C\x27\x2C\x5C\x27\x5C\x5C\x79\x5C\x5C\x37\x5C\x5C\x76\x5C\x5C\x6B\x5C\x5C\x6A\x5C\x5C\x6C\x5C\x5C\x33\x5C\x5C\x66\x5C\x5C\x76\x5C\x5C\x75\x5C\x27\x2C\x5C\x27\x5C\x5C\x71\x5C\x5C\x6C\x5C\x5C\x6A\x5C\x5C\x37\x5C\x5C\x76\x5C\x5C\x6B\x5C\x5C\x79\x5C\x5C\x78\x5C\x5C\x43\x5C\x27\x2C\x5C\x27\x5C\x5C\x68\x5C\x5C\x33\x5C\x5C\x6E\x5C\x5C\x65\x5C\x5C\x34\x5C\x5C\x38\x5C\x5C\x33\x5C\x27\x2C\x5C\x27\x5C\x5C\"]

    ReplyDelete
  21. This comment has been removed by the author.

    ReplyDelete
  22. I succeed to remove my template footer credit by filling this Form. It may takes few time but it works great.

    ReplyDelete
  23. how to encrypt it.... Not working on piki newspaper 10 template


    !function(a,b,c,d){function e(b,c){this.settings=null,this.options=a.extend({},e.Defaults,c),this.$element=a(b),this.drag=a.extend({},m),this.state=a.extend({},n),this.e=a.extend({},o),this._plugins={},this._supress={},this._current=null,this._speed=null,this._coordinates=[],this._breakpoint=null,this._width=null,this._items=[],this._clones=[],this._mergers=[],this._invalidated={},this._pipe=[],a.each(e.Plugins,a.proxy(function(a,b){this._plugins[a[0].toLowerCase()+a.slice(1)]=new b(this)},this)),a.each(e.Pipe,a.proxy(function(b,c){this._pipe.push({filter:c.filter,run:a.proxy(c.run,this)})},this)),this.setup(),this.initialize()}function f(a){if(a.touches!==d)return{x:a.touches[0].pageX,y:a.touches[0].pageY};if(a.touches===d){if(a.pageX!==d)return{x:a.pageX,y:a.pageY};if(a.pageX===d)return{x:a.clientX,y:a.clientY}}}function g(a){var b,d,e=c.createElement("div"),f=a;for(b in f)if(d=f[b],"undefined"!=typeof e.style[d])return e=null,[d,b];return[!1]}function h(){return g(["transition","WebkitTransition",


    not able to do ...

    ReplyDelete
    Replies
    1. It is already decrypted. If you want to encrypt you can follow this tutorial.

      Delete
  24. How to decode pikitemplate footer script..
    I can't please help me!
    Thank You

    ReplyDelete
  25. Please look into it
    https://wiselooters.blogspot.com

    ReplyDelete
  26. HI,
    Sir i want this template to decode for remove footer cradit redirection code
    plzzzz help me

    Template name ::: cooking template by piki templates

    i also provide you html code .

    ReplyDelete
  27. What about this? Already unpacked, but still don't understand which line to Remove, heres, packed script

    eval(function(p,a,c,k,e,d){e=function(c){return(c35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('5 K;5 m;5 l;5 w;5 s=1p.9;5 y="/";1d();G 1b(a){5 b=\'\';J=M(W/2);4(J==W-J){W=J*2+1}D=l-J;4(D<1)D=1;j=M(a/n)+1;4(j-1==a/n)j=j-1;E=D+W-1;4(E>j)E=j;b+=\'\'+17[0]+\' \'+l+\' \'+17[1]+\' \'+j+\'\';5 c=M(l)-1;4(l>1){4(l==2){4(m==\'3\'){b+=\'\'}h{b+=\'\'}}h{4(m==\'3\'){b+=\'\'}h{b+=\'\'}}}4(D>1){4(m=="3"){b+=\'1\'}h{b+=\'1\'}}4(D>2){b+=\'...\'}1a(5 d=D;d<=E;d++){4(l==d){b+=\'\'+d+\'\'}h 4(d==1){4(m==\'3\'){b+=\'1\'}h{b+=\'1\'}}h{4(m==\'3\'){b+=\'\'+d+\'\'}h{b+=\'\'+d+\'\'}}}4(E...\'}4(E\'+j+\'\'}h{b+=\'\'+j+\'\'}}5 e=M(l)+1;4(l\'}h{b+=\'\'}}b+=\'\';5 f=A.1s(\'1t\');5 g=A.1r(\'1A-1D\');1a(5 p=0;p0){b=\'\'}4(g){g.1c=b}}G 12(a){5 b=a.1f;5 c=M(b.1E$1B.$t,10);1b(c)}G 1d(){5 a=s;4(a.k(\'/v/u/\')!=-1){4(a.k(\'?T-i\')!=-1){w=a.H(a.k(\'/v/u/\')+14,a.k(\'?T-i\'))}h{w=a.H(a.k(\'/v/u/\')+14,a.k(\'?&i\'))}}4(a.k(\'?q=\')==-1&&a.k(\'.1C\')==-1){4(a.k(\'/v/u/\')==-1){m=\'3\';4(s.k(\'#F=\')!=-1){l=s.H(s.k(\'#F=\')+8,s.O)}h{l=1}A.18(\'<\\/r>\')}h{m=\'u\';4(a.k(\'&i-o=\')==-1){n=1F}4(s.k(\'#F=\')!=-1){l=s.H(s.k(\'#F=\')+8,s.O)}h{l=1}A.18(\'<\\/r>\')}}}G L(a){Z=(a-1)*n;K=a;5 b=A.1h(\'1q\')[0];5 c=A.1o(\'r\');c.1e=\'1m/1n\';c.1i(\'Q\',y+\'P/R/N?1j-1k=\'+Z+\'&i-o=1&X=Y-S-r&V=13\');b.1l(c)}G I(a){Z=(a-1)*n;K=a;5 b=A.1h(\'1q\')[0];5 c=A.1o(\'r\');c.1e=\'1m/1n\';c.1i(\'Q\',y+\'P/R/N/-/\'+w+\'?1j-1k=\'+Z+\'&i-o=1&X=Y-S-r&V=13\');b.1l(c)}G 13(a){11=a.1f.1x[0];5 b=11.1g.$t.H(0,19)+11.1g.$t.H(1z,1w);5 c=1y(b);4(m==\'3\'){5 d=\'/v?T-i=\'+c+\'&i-o=\'+n+\'#F=\'+K}h{5 d=\'/v/u/\'+w+\'?T-i=\'+c+\'&i-o=\'+n+\'#F=\'+K}1p.9=d}',62,104,'|||page|if|var|class|num||href||||||||else|max|lastPageNo|indexOf|currentPageNo|currentPage|postResults|results|||script|locationUrl||label|search|postLabel|false|home_page|onclick|document|return|span|pageStart|pageEnd|PageNo|function|substring|getLabelPage|pageNumber|noPage|getPage|parseInt|summary|length|feeds|src|posts|in|updated|prev|callback|numOfPages|alt|json|jsonstart||post|dataFeed|findPostDate||next|dots|pageOf|write||for|startPagination|innerHTML|pageCurrentBlogger|type|feed|published|getElementsByTagName|setAttribute|start|index|appendChild|text|javascript|createElement|location|head|getElementById|getElementsByName|pageArea|of|active|29|entry|encodeURIComponent|23|blog|totalResults|html|pager|openSearch|20'.split('|'),0,{}))



    Still don't understand 🤣🙏

    ReplyDelete
  28. https://oksurya.com/d/9-how-to-decrypt-javascript-in-blogger-template

    ReplyDelete
  29. hi bro... can you unpack this https://pastebin.com/D9s4YRaY

    ReplyDelete

Comment something useful and creative :)