Question

I am having an issue with my function. I can’t seem to figure out why it works one way and not another.

When I go to the html source here http://adcrun.ch/ZJzV and place the javascript encoded string into the function It decodes the string just fine.

echo js_unpack('$(34).39(4(){$(\'29.37\').7($(34).7()-$(\'6.41\').7()-($(\'6.44\').7()*2))});$(\'29.37\').39(4(){3 1=-2;3 5=4(){9(1<0){$.26(\'15://25.22/21/24.20.19\',{14:\'46\',13:{16:18,17:23}},4(40){3 28=38(\'(\'+40+\')\');9(28.12&&1!=-2){45(31);3 8=$(\'<6 48="47"><27 36="#">49</27></6><!--43.42-->\');$(\'6.41 33#35\').57().60(\'59\',\'61\').30(8);8.62(4(){$.26(\'15://25.22/21/24.20.19\',{14:\'50\',13:{63:0,16:18,17:23,58:\'\'}},4(5){3 11=38(\'(\'+5+\')\');9(11.12&&1!=-2){52.51.36=11.12.53}});8.30(\'54...\')})}32{1=10}})}32{$(\'33#35\').56(1--)}};5();3 31=55(5,64)});',10,65,explode('|','|a0x1||var|function|rr|div|height|skip_ad|if||jj|message|args|opt|http|lid|oid|4106|php|fly|links|ch|188|ajax|adcrun|post|a|j|iframe|html|si|else|span|document|redirectin|href|fly_frame|eval|ready|r|fly_head|button|end|fly_head_bottom|clearInterval|check_log|continue_button|class|Continue|make_log|location|top|url|Loading|setInterval|text|parent|ref|margin|css|6px|click|aid|1000'));

But hen I use it like this echo js_unpack($full_code); it fails and gives me the following errors.

Warning: Missing argument 2 for js_unpack(),
Warning: Missing argument 3 for js_unpack(),
Warning: Missing argument 4 for js_unpack(),

Here is my php source that I am using.

//function to extract string between 2 delimiters
function extract_unit($string, $start, $end)
{
    $pos = stripos($string, $start);
    $str = substr($string, $pos);
    $str_two = substr($str, strlen($start));
    $second_pos = stripos($str_two, $end);
    $str_three = substr($str_two, 0, $second_pos);
    $unit = trim($str_three);
    return $unit;
}

//html source
$html = file_get_contents('http://adcrun.ch/ZJzV');
//extract everything beteen these two delimiters
$unit = extract_unit($html, 'return p}(\'', '.split');

//full encoded strning
$string = $unit;  
//the part here ne values ill be inserted
$expression = "',10,65,";  
//inserted value
$insertvalue = "explode('|',";  

//newly formatted encoded string
$full_code =  str_replace($expression,$expression.$insertvalue,$string).')';

//function to decode the previous string
function js_unpack($p,$a,$c,$k)
{
  while ($c--)
    if($k[$c]) $p = preg_replace('/\b'.base_convert($c, 10, $a).'\b/', $k[$c], $p);

  return $p;
}

//return decoded
echo js_unpack($full_code);

Answer 1

I didn’t go through all your code, but there is a fundamental difference in your first 2 examples.

This line passes 4 arguments to the js_unpack function:

echo js_unpack( '$(......);', 10, 65, explode( '|', '|............' ) );

This line passes 1 argument to it:

echo js_unpack( $full_code );

I don’t know if this is the root of your other problems, but it’s a poor comparison to say “it works the first way but not the second way”. The Warning is telling you exactly what you need to know: you are missing arguments.

Edit:
Based on your comment, I think you do not understand what is truly going on. You say you “copied the string and placed it in the function”. This is incorrect. What you really copied was 1 string, 2 ints, and 1 array. You placed these 4 arguments in your function.

Maybe it helps if you format your functions this way:

echo js_unpack( 
    '$(......);',                     //  <-- Argument #1 (a long string)
    10,                               //  <-- Argument #2 (int)
    65,                               //  <-- Argument #3 (int)
    explode( '|', '|............' )   //  <-- Argument #4 (array)
);

Compare that with:

echo js_unpack( 
    $full_code                        //  <-- Just 1 argument
);

These are simply not the same signatures. Some PHP functions have default argument values, but this is not the case with js_unpack and it gives you a very clear warning that you are not calling it properly.