PoliCTF Grabbag 300

The challenge in this problem was pretty clearly JavaScript unpacking. There was an image in base64 format in the html file given, and thus there was also the possibility of a steganography challenge.

Here’s the block we were given:

eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseint(c a)))+((c="c%a)">35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k1||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k1)p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k1);return p}('5l(5g(p,a,c,k,e,r){e=5g(c){5f(c<a?\'\':e(5p(c a)))+((c="c%a)">35?5k.5o(c+29):c.5q(36))};5j(!\'\'.5i(/^/,5k)){5h(c--)r[e(c)]=k1||e(c);k=[5g(e){5f r[e]}];e=5g(){5f\'\\\\w+\'};c=1};5h(c--)5j(k1)p=p.5i(5r 5m(\'\\\\b\'+e(c)+\'\\\\b\',\'g\'),k1);5f p}(\'34(2Q(p,a,c,k,e,r){e=2Q(33){2R(c<a?\\\'\\\':e(2x(c a)))+((c="c%a)">35?2U.2W(c+29):c.2Y(36))};2S(!\\\'\\\'.2V(/^/,2U)){2T(c--)r[e(c)]=k1||e(c);k=[2Q(e){2R r[e]}];e=2Q(){2R\\\'\\\\\\\\w+\\\'};c=1};2T(c--)2S(k1)p=p.2V(2Z 30(\\\'\\\\\\\\b\\\'+e(c)+\\\'\\\\\\\\b\\\',\\\'g\\\'),k1);2R p}(\\\'q A="";q M=0;A+="1n";s R(a){r S(19(L(a)))}s 1k(a,b){r S(Y(L(a),L(b)))}s 1Q(){r R("2t").2H()=="1i"}s 19(a){r Q(H(J(a),a.x*8))}s Y(c,f){q e=J(c);D(e.x>16){e=H(e,c.x*8)}q a=O(16),d=O(16);E(q b=0;b<16;b++){a[b]=e[b]^2I;d[b]=e[b]^2J}q g=H(a.X(J(f)),W+f.x*8);r Q(H(d.X(g),W+z))}s S(c){1p{M}1v(g){M=0}q f=M?"1F":"1I";q b="";q a;E(q d=0;d<c.x;d++){a=c.k(d);b+=f.v((a>>>4)&15)+f.V(a&15)}r b}s L(c){q b="";q d=-1;q a,e;2L(++d<c.x){a=c.k(d);e=d+1<c.x?c.k(d+1):0;d(1b<=a&&a<=1c&&1e<=e&&e<=1f){a=1g+((a&u)<<10)+(e&u);d++}d(a<=1m){b+=g.f(a)}p{d(a<=1q){b+=g.f(1t|((a>>>6)&1w),z|(a&B))}P{D(a<=N){b+=G.F(1M|((a>>>12)&15),z|((a>>>6)&B),z|(a&B))}P{D(a<=28){b+=G.F(2c|((a>>>18)&7),z|((a>>>12)&B),z|((a>>>6)&B),z|(a&B))}}}}}r b}s J(b){q a=O(b.x>>2);E(q c=0;c<a.x;c++){a1=0}e(q c="0;c<b.x*8;c+=8){a1|=(b.K(c/8)&T)<<(c%C)}r" a}s="" q(b){q="" a="" ;e(q="">>>(c%C))&T)}r a};A+="2M";s H(p,k){p[k>>5]|=z<<((k)%C);p[(((k+1d)>>>9)<<4)+14]=k;q o=1h;q n=-1j;q m=-1l;q l=2P;E(q g=0;g<p.x;g+=16){q j="o;q" h="n;q" f="m;q" e="l;o=t(o,n,m,l,p[g+0],7,-1r);l=t(l,o,n,m,p[g+1],12,-1s);m=t(m,l,o,n,p[g+2],17,1u);n=t(n,m,l,o,p[g+3],22,-1x);o=t(o,n,m,l,p[g+4],7,-1y);l=t(l,o,n,m,p[g+5],12,1z);m=t(m,l,o,n,p[g+6],17,-1A);n=t(n,m,l,o,p[g+7],22,-1B);o=t(o,n,m,l,p[g+8],7,1C);l=t(l,o,n,m,p[g+9],12,-1D);m=t(m,l,o,n,p[g+10],17,-1E);n=t(n,m,l,o,p[g+11],22,-1G);o=t(o,n,m,l,p[g+12],7,1H);l=t(l,o,n,m,p[g+13],12,-1J);m=t(m,l,o,n,p[g+14],17,-1K);n=t(n,m,l,o,p[g+15],22,1L);o=w(o,n,m,l,p[g+1],5,-1N);l=w(l,o,n,m,p[g+6],9,-1O);m=w(m,l,o,n,p[g+11],14,1P);n=w(n,m,l,o,p[g+0],20,-1R);o=w(o,n,m,l,p[g+5],5,-1S);l=w(l,o,n,m,p[g+10],9,1T);m=w(m,l,o,n,p[g+15],14,-1U);n=w(n,m,l,o,p[g+4],20,-1V);o=w(o,n,m,l,p[g+9],5,1W);l=w(l,o,n,m,p[g+14],9,-1X);m=w(m,l,o,n,p[g+3],14,-1Y);n=w(n,m,l,o,p[g+8],20,1Z);o=w(o,n,m,l,p[g+13],5,-24);l=w(l,o,n,m,p[g+2],9,-25);m=w(m,l,o,n,p[g+7],14,26);n=w(n,m,l,o,p[g+12],20,-27);o=u(o,n,m,l,p[g+5],4,-29);l=u(l,o,n,m,p[g+8],11,-2a);m=u(m,l,o,n,p[g+11],16,2b);n=u(n,m,l,o,p[g+14],23,-2d);o=u(o,n,m,l,p[g+1],4,-2e);l=u(l,o,n,m,p[g+4],11,2f);m=u(m,l,o,n,p[g+7],16,-2g);n=u(n,m,l,o,p[g+10],23,-2h);o=u(o,n,m,l,p[g+13],4,2i);l=u(l,o,n,m,p[g+0],11,-2j);m=u(m,l,o,n,p[g+3],16,-2k);n=u(n,m,l,o,p[g+6],23,2l);o=u(o,n,m,l,p[g+9],4,-2m);l=u(l,o,n,m,p[g+12],11,-2n);m=u(m,l,o,n,p[g+15],16,2o);n=u(n,m,l,o,p[g+2],23,-2p);o=v(o,n,m,l,p[g+0],6,-2q);l=v(l,o,n,m,p[g+7],10,2r);m=v(m,l,o,n,p[g+14],15,-2s);n=v(n,m,l,o,p[g+5],21,-2u);o=v(o,n,m,l,p[g+12],6,2v);l=v(l,o,n,m,p[g+3],10,-2w);m=v(m,l,o,n,p[g+10],15,-2x);n=v(n,m,l,o,p[g+1],21,-2y);o=v(o,n,m,l,p[g+8],6,2z);l=v(l,o,n,m,p[g+15],10,-2A);m=v(m,l,o,n,p[g+6],15,-2B);n=v(n,m,l,o,p[g+13],21,2C);o=v(o,n,m,l,p[g+4],6,-2D);l=v(l,o,n,m,p[g+11],10,-2E);m=v(m,l,o,n,p[g+2],15,2F);n=v(n,m,l,o,p[g+9],21,-2G);o=y(o,j);n=y(n,h);m=y(m,f);l=y(l,e)}r" o(o,n,m,l)}s="" i(h,e,d,c,g,f){r="" y(z(y(y(e,h),y(c,f)),g),d)};a+="2K" ;s="" t(g,f,k,j,e,i,h){r="" i((f&k)|((~f)&j),g,f,e,i,h)}s="" w(g,f,k,j,e,i,h){r="" i((f&j)|(k&(~j)),g,f,e,i,h)}s="" u(g,f,k,j,e,i,h){r="" i(f^k^j,g,f,e,i,h)}s="" v(g,f,k,j,e,i,h){r="" i(k^(f|(~j)),g,f,e,i,h)}s="" y(a,d){q="" c="(a&N)+(d&N);q" b="(a">>16)+(d>>16)+(c>>16);r(b<<16)|(c&N)};s Z(a,b){r(a<<b)|(a>>>(C-b))};1a=A;A=R(1a);s 2N(a,b){r(a<<b)|(a>>>(C-b))};2O.1o(A);\\\',37,38,\\\'||||||||||||||||||||||||||39|2R|2Q|3a|3b|3c|3d|3e|3f|3g|3h|3i|32|2S|3j|2W|2U|3k|3l|3m|3n|3o|3p|3q|3r|3s|3t|3u|3v|3w|3x|3y|3z|3A|3B|3C||||||||||3D|3E|3F|3G|3H|3I|3J|3K|3L|3M|3N|3O|3P|3Q|3R|3S|3T|3U|3V|3W|3X|3Y|3Z|31|40|41|42|43|44|45|46|47|48|49|4a|4b|4c|4d|4e|4f|4g|4h|4i|4j|4k|4l|4m|4n|4o|4p|4q|4r|4s|||||4t|4u|4v|4w|4x|4y|4z|4A|4B|4C|4D|4E|4F|4G|4H|4I|4J|4K|4L|4M|4N|4O|4P|4Q|4R|4S|4T|4U|4V|4W|4X|4Y|4Z|50|51|52|53|54|55|56|57|58|59|2T|5a|5b|5c|5d\\\'.5e(\\\'|\\\'),0,{}))\',62,5s,\'||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||5g|5f|5j|5h|5k|5i|5o|5p|5q|5r|5m|||5t|5l|||62|5u|5v|5w|5x|5y|5z|5A|5B|5C|5D|63|5E|5F|5G|5H|5I|5J|5K|5L|5M|5N|5O|5P|5Q|5R|5S|5T|5U|5V|5W|5X|5Y|5Z|60|61|64|65|66|67|68|69|6a|6b|6c|6d|6e|6f|6g|6h|6i|6j|6k|6l|6m|6n|6o|6p|6q|6r|6s|6t|6u|6v|6w|6x|6y|6z|6A|6B|6C|6D|6E|6F|6G|6H|6I|6J|6K|6L|6M|6N|6O|6P|6Q|6R|6S|6T|6U|6V|6W|6X|6Y|6Z|70|71|72|73|74|75|76|77|78|79|7a|7b|7c|7d|7e|7f|7g|7h|7i|7j|7k|7l|7m|7n|7o|7p|7q|7r|7s|7t|7u|7v|7w|7x|7y|7z|7A|5n\'.5n(\'|\'),0,{}))',62,471,'|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||return|function|while|replace|if|String|eval|RegExp|split|fromCharCode|parseInt|toString|new|325|duckrolled|176|var|sha1_ff|sha1_hh|sha1_ii|sha1_gg|length|safe_add|128|key|for|binl_sha1|sha1_cmn|rstr2binl|charCodeAt|str2rstr_utf8|hexcase|65535|Arrray|else|binl2rstr|hex_sha1|rstr2hex|255|1023|charAt|512|concat|rstr_hmac_sha1|bit_rol|rstr_sha1|key1|55296|56319||||56320|57343|65536|1732584193|900150983cd24fb0d6963f7d28e17f72|271733879|hex_hmac_sha1|1732584194|127|0xB1|write|try|2047|680876936|389564586|192|606105819|catch|1044525330|176418897|1200080426|1473231341|45705983|1770035416|1958414417|42063|0123456789ABCDEF|1990404162|1804603682|0123456789abcdef|40341101|1502002290|1236535329|224|165796510|1069501632|643717713|sha1_vm_test|373897302|701558691|38016083|660478335|405537848|568446438|1019803690|187363961|1163531501|1444681467|51403784|1735328473|1926607734|2097151|378558|2022574463|1839030562|240|35309556|1530992060|1272893353|155497632|1094730640|681279174|358537222|722521979|76029189|640364487|421815835|530742520|995338651|198630844|1126891415|1416354905|abc|57434055|1700485571|1894986606|1051523|2054922799|1873313359|30611744|1560198380|1309151649|145523070|1120210379|718787259|343485551|toLowerCase|909522486|1549556828|OB5|4B0|duckrolled|document|271733878'.split('|'),0,{}))
This is pretty clearly “packed”(consider the comma-separated characters) or obfuscated so that it’s hard to read. Doing some Google research on JavaScript packing you’ll quickly find one of the most common is

Dean Edwards’ packer. Using that unpacker, we get some slightly different code… the key to this challenge is realizing it’s just packed and re-packed a few times. So, we unpack and then unpack the result until we get an error: too much recursion.**
**

The code is as follows at this step:

eval(function(p,a,c,k,e,r){e=function(duckrolled){return(c<a?'':e(parseint(c a)))+((c="c%a)">35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k1||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k1)p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k1);return p}('q A="";q M=0;A+="1n";s R(a){r S(19(L(a)))}s 1k(a,b){r S(Y(L(a),L(b)))}s 1Q(){r R("2t").2H()=="1i"}s 19(a){r Q(H(J(a),a.x*8))}s Y(c,f){q e=J(c);D(e.x>16){e=H(e,c.x*8)}q a=O(16),d=O(16);E(q b=0;b<16;b++){a[b]=e[b]^2I;d[b]=e[b]^2J}q g=H(a.X(J(f)),W+f.x*8);r Q(H(d.X(g),W+z))}s S(c){1p{M}1v(g){M=0}q f=M?"1F":"1I";q b="";q a;E(q d=0;d<c.x;d++){a=c.k(d);b+=f.v((a>>>4)&15)+f.V(a&15)}r b}s L(c){q b="";q d=-1;q a,e;2L(++d<c.x){a=c.k(d);e=d+1<c.x?c.k(d+1):0;d(1b<=a&&a<=1c&&1e<=e&&e<=1f){a=1g+((a&u)<<10)+(e&u);d++}d(a<=1m){b+=g.f(a)}p{d(a<=1q){b+=g.f(1t|((a>>>6)&1w),z|(a&B))}P{D(a<=N){b+=G.F(1M|((a>>>12)&15),z|((a>>>6)&B),z|(a&B))}P{D(a<=28){b+=G.F(2c|((a>>>18)&7),z|((a>>>12)&B),z|((a>>>6)&B),z|(a&B))}}}}}r b}s J(b){q a=O(b.x>>2);E(q c=0;c<a.x;c++){a1=0}e(q c="0;c<b.x*8;c+=8){a1|=(b.K(c/8)&T)<<(c%C)}r" a}s="" q(b){q="" a="" ;e(q="">>>(c%C))&T)}r a};A+="2M";s H(p,k){p[k>>5]|=z<<((k)%C);p[(((k+1d)>>>9)<<4)+14]=k;q o=1h;q n=-1j;q m=-1l;q l=2P;E(q g=0;g<p.x;g+=16){q j="o;q" h="n;q" f="m;q" e="l;o=t(o,n,m,l,p[g+0],7,-1r);l=t(l,o,n,m,p[g+1],12,-1s);m=t(m,l,o,n,p[g+2],17,1u);n=t(n,m,l,o,p[g+3],22,-1x);o=t(o,n,m,l,p[g+4],7,-1y);l=t(l,o,n,m,p[g+5],12,1z);m=t(m,l,o,n,p[g+6],17,-1A);n=t(n,m,l,o,p[g+7],22,-1B);o=t(o,n,m,l,p[g+8],7,1C);l=t(l,o,n,m,p[g+9],12,-1D);m=t(m,l,o,n,p[g+10],17,-1E);n=t(n,m,l,o,p[g+11],22,-1G);o=t(o,n,m,l,p[g+12],7,1H);l=t(l,o,n,m,p[g+13],12,-1J);m=t(m,l,o,n,p[g+14],17,-1K);n=t(n,m,l,o,p[g+15],22,1L);o=w(o,n,m,l,p[g+1],5,-1N);l=w(l,o,n,m,p[g+6],9,-1O);m=w(m,l,o,n,p[g+11],14,1P);n=w(n,m,l,o,p[g+0],20,-1R);o=w(o,n,m,l,p[g+5],5,-1S);l=w(l,o,n,m,p[g+10],9,1T);m=w(m,l,o,n,p[g+15],14,-1U);n=w(n,m,l,o,p[g+4],20,-1V);o=w(o,n,m,l,p[g+9],5,1W);l=w(l,o,n,m,p[g+14],9,-1X);m=w(m,l,o,n,p[g+3],14,-1Y);n=w(n,m,l,o,p[g+8],20,1Z);o=w(o,n,m,l,p[g+13],5,-24);l=w(l,o,n,m,p[g+2],9,-25);m=w(m,l,o,n,p[g+7],14,26);n=w(n,m,l,o,p[g+12],20,-27);o=u(o,n,m,l,p[g+5],4,-29);l=u(l,o,n,m,p[g+8],11,-2a);m=u(m,l,o,n,p[g+11],16,2b);n=u(n,m,l,o,p[g+14],23,-2d);o=u(o,n,m,l,p[g+1],4,-2e);l=u(l,o,n,m,p[g+4],11,2f);m=u(m,l,o,n,p[g+7],16,-2g);n=u(n,m,l,o,p[g+10],23,-2h);o=u(o,n,m,l,p[g+13],4,2i);l=u(l,o,n,m,p[g+0],11,-2j);m=u(m,l,o,n,p[g+3],16,-2k);n=u(n,m,l,o,p[g+6],23,2l);o=u(o,n,m,l,p[g+9],4,-2m);l=u(l,o,n,m,p[g+12],11,-2n);m=u(m,l,o,n,p[g+15],16,2o);n=u(n,m,l,o,p[g+2],23,-2p);o=v(o,n,m,l,p[g+0],6,-2q);l=v(l,o,n,m,p[g+7],10,2r);m=v(m,l,o,n,p[g+14],15,-2s);n=v(n,m,l,o,p[g+5],21,-2u);o=v(o,n,m,l,p[g+12],6,2v);l=v(l,o,n,m,p[g+3],10,-2w);m=v(m,l,o,n,p[g+10],15,-2x);n=v(n,m,l,o,p[g+1],21,-2y);o=v(o,n,m,l,p[g+8],6,2z);l=v(l,o,n,m,p[g+15],10,-2A);m=v(m,l,o,n,p[g+6],15,-2B);n=v(n,m,l,o,p[g+13],21,2C);o=v(o,n,m,l,p[g+4],6,-2D);l=v(l,o,n,m,p[g+11],10,-2E);m=v(m,l,o,n,p[g+2],15,2F);n=v(n,m,l,o,p[g+9],21,-2G);o=y(o,j);n=y(n,h);m=y(m,f);l=y(l,e)}r" o(o,n,m,l)}s="" i(h,e,d,c,g,f){r="" y(z(y(y(e,h),y(c,f)),g),d)};a+="2K" ;s="" t(g,f,k,j,e,i,h){r="" i((f&k)|((~f)&j),g,f,e,i,h)}s="" w(g,f,k,j,e,i,h){r="" i((f&j)|(k&(~j)),g,f,e,i,h)}s="" u(g,f,k,j,e,i,h){r="" i(f^k^j,g,f,e,i,h)}s="" v(g,f,k,j,e,i,h){r="" i(k^(f|(~j)),g,f,e,i,h)}s="" y(a,d){q="" c="(a&N)+(d&N);q" b="(a">>16)+(d>>16)+(c>>16);r(b<<16)|(c&N)};s Z(a,b){r(a<<b)|(a>>>(C-b))};1a=A;A=R(1a);s 2N(a,b){r(a<<b)|(a>>>(C-b))};2O.1o(A);',62,176,'||||||||||||||||||||||||||var|return|function|sha1_ff|sha1_hh|sha1_ii|sha1_gg|length|safe_add|128|key|63|32|if|for|fromCharCode|String|binl_sha1|sha1_cmn|rstr2binl|charCodeAt|str2rstr_utf8|hexcase|65535|Arrray|else|binl2rstr|hex_sha1|rstr2hex|255|1023|charAt|512|concat|rstr_hmac_sha1|bit_rol||||||||||rstr_sha1|key1|55296|56319|64|56320|57343|65536|1732584193|900150983cd24fb0d6963f7d28e17f72|271733879|hex_hmac_sha1|1732584194|127|0xB1|write|try|2047|680876936|389564586|192|606105819|catch|31|1044525330|176418897|1200080426|1473231341|45705983|1770035416|1958414417|42063|0123456789ABCDEF|1990404162|1804603682|0123456789abcdef|40341101|1502002290|1236535329|224|165796510|1069501632|643717713|sha1_vm_test|373897302|701558691|38016083|660478335|405537848|568446438|1019803690|187363961|1163531501|||||1444681467|51403784|1735328473|1926607734|2097151|378558|2022574463|1839030562|240|35309556|1530992060|1272893353|155497632|1094730640|681279174|358537222|722521979|76029189|640364487|421815835|530742520|995338651|198630844|1126891415|1416354905|abc|57434055|1700485571|1894986606|1051523|2054922799|1873313359|30611744|1560198380|1309151649|145523070|1120210379|718787259|343485551|toLowerCase|909522486|1549556828|OB5|while|4B0|duckrolled|document|271733878'.split('|'),0,{}))

If you’re interested in trying to actually read this code, it may be helpful to run it through jsbeautifier.org, but that isn’t necessary to complete the challenge. You can quickly see that in comparison to the previous snippets, there is an argument called “duckrolled.” In the previous snippets, this was simply “c.” Changing “duckrolled” to “c” and running it through the jsbeautifier(which is also an unpacker) gives us some human readable code…

var key = "";
var hexcase = 0;
key += "0xB1";

function hex_sha1(a) {
    return rstr2hex(rstr_sha1(str2rstr_utf8(a)))
}
function hex_hmac_sha1(a, b) {
    return rstr2hex(rstr_hmac_sha1(str2rstr_utf8(a), str2rstr_utf8(b)))
}
function sha1_vm_test() {
    return hex_sha1("abc").toLowerCase() == "900150983cd24fb0d6963f7d28e17f72"
}
function rstr_sha1(a) {
    return binl2rstr(binl_sha1(rstr2binl(a), a.length * 8))
}
function rstr_hmac_sha1(c, f) {
    var e = rstr2binl(c);
    if (e.length > 16) {
        e = binl_sha1(e, c.length * 8)
    }
    var a = Arrray(16),
        d = Arrray(16);
    for (var b = 0; b < 16; b++) {
        a[b] = e[b] ^ 909522486;
        d[b] = e[b] ^ 1549556828
    }
    var g = binl_sha1(a.concat(rstr2binl(f)), 512 + f.length * 8);
    return binl2rstr(binl_sha1(d.concat(g), 512 + 128))
}
function rstr2hex(c) {
    try {
        hexcase
    } catch (g) {
        hexcase = 0
    }
    var f = hexcase ? "0123456789ABCDEF" : "0123456789abcdef";
    var b = "";
    var a;
    for (var d = 0; d < c.length; d++) {
        a = c.charCodeAt(d);
        b += f.charAt((a >>> 4) & 15) + f.charAt(a & 15)
    }
    return b
}
function str2rstr_utf8(c) {
    var b = "";
    var d = -1;
    var a, e;
    while (++d < c.length) {
        a = c.charCodeAt(d);
        e = d + 1 < c.length ? c.charCodeAt(d + 1) : 0;
        if (55296 <= a && a <= 56319 && 56320 <= e && e <= 57343) {
            a = 65536 + ((a & 1023) << 10) + (e & 1023);
            d++
        }
        if (a <= 127) {
            b += String.fromCharCode(a)
        } else {
            if (a <= 2047) {
                b += String.fromCharCode(192 | ((a >>> 6) & 31), 128 | (a & 63))
            } else {
                if (a <= 65535) {
                    b += String.fromCharCode(224 | ((a >>> 12) & 15), 128 | ((a >>> 6) & 63), 128 | (a & 63))
                } else {
                    if (a <= 2097151) {
                        b += String.fromCharCode(240 | ((a >>> 18) & 7), 128 | ((a >>> 12) & 63), 128 | ((a >>> 6) & 63), 128 | (a & 63))
                    }
                }
            }
        }
    }
    return b
}
function rstr2binl(b) {
    var a = Arrray(b.length >> 2);
    for (var c = 0; c < a.length; c++) {
        a1 = 0
    }
    for (var c = 0; c < b.length * 8; c += 8) {
        a1 |= (b.charCodeAt(c / 8) & 255) << (c % 32)
    }
    return a
}
function binl2rstr(b) {
    var a = "";
    for (var c = 0; c < b.length * 32; c += 8) {
        a += String.fromCharCode((b1 >>> (c % 32)) & 255)
    }
    return a
};
key += "4B0";

function binl_sha1(p, k) {
    p[k >> 5] |= 128 << ((k) % 32);
    p[(((k + 64) >>> 9) << 4) + 14] = k;
    var o = 1732584193;
    var n = -271733879;
    var m = -1732584194;
    var l = 271733878;
    for (var g = 0; g < p.length; g += 16) {
        var j = o;
        var h = n;
        var f = m;
        var e = l;
        o = sha1_ff(o, n, m, l, p[g + 0], 7, -680876936);
        l = sha1_ff(l, o, n, m, p[g + 1], 12, -389564586);
        m = sha1_ff(m, l, o, n, p[g + 2], 17, 606105819);
        n = sha1_ff(n, m, l, o, p[g + 3], 22, -1044525330);
        o = sha1_ff(o, n, m, l, p[g + 4], 7, -176418897);
        l = sha1_ff(l, o, n, m, p[g + 5], 12, 1200080426);
        m = sha1_ff(m, l, o, n, p[g + 6], 17, -1473231341);
        n = sha1_ff(n, m, l, o, p[g + 7], 22, -45705983);
        o = sha1_ff(o, n, m, l, p[g + 8], 7, 1770035416);
        l = sha1_ff(l, o, n, m, p[g + 9], 12, -1958414417);
        m = sha1_ff(m, l, o, n, p[g + 10], 17, -42063);
        n = sha1_ff(n, m, l, o, p[g + 11], 22, -1990404162);
        o = sha1_ff(o, n, m, l, p[g + 12], 7, 1804603682);
        l = sha1_ff(l, o, n, m, p[g + 13], 12, -40341101);
        m = sha1_ff(m, l, o, n, p[g + 14], 17, -1502002290);
        n = sha1_ff(n, m, l, o, p[g + 15], 22, 1236535329);
        o = sha1_gg(o, n, m, l, p[g + 1], 5, -165796510);
        l = sha1_gg(l, o, n, m, p[g + 6], 9, -1069501632);
        m = sha1_gg(m, l, o, n, p[g + 11], 14, 643717713);
        n = sha1_gg(n, m, l, o, p[g + 0], 20, -373897302);
        o = sha1_gg(o, n, m, l, p[g + 5], 5, -701558691);
        l = sha1_gg(l, o, n, m, p[g + 10], 9, 38016083);
        m = sha1_gg(m, l, o, n, p[g + 15], 14, -660478335);
        n = sha1_gg(n, m, l, o, p[g + 4], 20, -405537848);
        o = sha1_gg(o, n, m, l, p[g + 9], 5, 568446438);
        l = sha1_gg(l, o, n, m, p[g + 14], 9, -1019803690);
        m = sha1_gg(m, l, o, n, p[g + 3], 14, -187363961);
        n = sha1_gg(n, m, l, o, p[g + 8], 20, 1163531501);
        o = sha1_gg(o, n, m, l, p[g + 13], 5, -1444681467);
        l = sha1_gg(l, o, n, m, p[g + 2], 9, -51403784);
        m = sha1_gg(m, l, o, n, p[g + 7], 14, 1735328473);
        n = sha1_gg(n, m, l, o, p[g + 12], 20, -1926607734);
        o = sha1_hh(o, n, m, l, p[g + 5], 4, -378558);
        l = sha1_hh(l, o, n, m, p[g + 8], 11, -2022574463);
        m = sha1_hh(m, l, o, n, p[g + 11], 16, 1839030562);
        n = sha1_hh(n, m, l, o, p[g + 14], 23, -35309556);
        o = sha1_hh(o, n, m, l, p[g + 1], 4, -1530992060);
        l = sha1_hh(l, o, n, m, p[g + 4], 11, 1272893353);
        m = sha1_hh(m, l, o, n, p[g + 7], 16, -155497632);
        n = sha1_hh(n, m, l, o, p[g + 10], 23, -1094730640);
        o = sha1_hh(o, n, m, l, p[g + 13], 4, 681279174);
        l = sha1_hh(l, o, n, m, p[g + 0], 11, -358537222);
        m = sha1_hh(m, l, o, n, p[g + 3], 16, -722521979);
        n = sha1_hh(n, m, l, o, p[g + 6], 23, 76029189);
        o = sha1_hh(o, n, m, l, p[g + 9], 4, -640364487);
        l = sha1_hh(l, o, n, m, p[g + 12], 11, -421815835);
        m = sha1_hh(m, l, o, n, p[g + 15], 16, 530742520);
        n = sha1_hh(n, m, l, o, p[g + 2], 23, -995338651);
        o = sha1_ii(o, n, m, l, p[g + 0], 6, -198630844);
        l = sha1_ii(l, o, n, m, p[g + 7], 10, 1126891415);
        m = sha1_ii(m, l, o, n, p[g + 14], 15, -1416354905);
        n = sha1_ii(n, m, l, o, p[g + 5], 21, -57434055);
        o = sha1_ii(o, n, m, l, p[g + 12], 6, 1700485571);
        l = sha1_ii(l, o, n, m, p[g + 3], 10, -1894986606);
        m = sha1_ii(m, l, o, n, p[g + 10], 15, -1051523);
        n = sha1_ii(n, m, l, o, p[g + 1], 21, -2054922799);
        o = sha1_ii(o, n, m, l, p[g + 8], 6, 1873313359);
        l = sha1_ii(l, o, n, m, p[g + 15], 10, -30611744);
        m = sha1_ii(m, l, o, n, p[g + 6], 15, -1560198380);
        n = sha1_ii(n, m, l, o, p[g + 13], 21, 1309151649);
        o = sha1_ii(o, n, m, l, p[g + 4], 6, -145523070);
        l = sha1_ii(l, o, n, m, p[g + 11], 10, -1120210379);
        m = sha1_ii(m, l, o, n, p[g + 2], 15, 718787259);
        n = sha1_ii(n, m, l, o, p[g + 9], 21, -343485551);
        o = safe_add(o, j);
        n = safe_add(n, h);
        m = safe_add(m, f);
        l = safe_add(l, e)
    }
    return Arrray(o, n, m, l)
}
function sha1_cmn(h, e, d, c, g, f) {
    return safe_add(bit_rol(safe_add(safe_add(e, h), safe_add(c, f)), g), d)
};
key += "OB5";

function sha1_ff(g, f, k, j, e, i, h) {
    return sha1_cmn((f & k) | ((~f) & j), g, f, e, i, h)
}
function sha1_gg(g, f, k, j, e, i, h) {
    return sha1_cmn((f & j) | (k & (~j)), g, f, e, i, h)
}
function sha1_hh(g, f, k, j, e, i, h) {
    return sha1_cmn(f ^ k ^ j, g, f, e, i, h)
}
function sha1_ii(g, f, k, j, e, i, h) {
    return sha1_cmn(k ^ (f | (~j)), g, f, e, i, h)
}
function safe_add(a, d) {
    var c = (a & 65535) + (d & 65535);
    var b = (a >> 16) + (d >> 16) + (c >> 16);
    return (b << 16) | (c & 65535)
};

function bit_rol(a, b) {
    return (a << b) | (a >>> (32 - b))
};
key1 = key;
key = hex_sha1(key1);

function duckrolled(a, b) {
    return (a << b) | (a >>> (32 - b))
};
document.write(key);

 

In the above code the function “Array” is typo’d to have 3 ‘r’s. s/Arrray/Array/g and we’ve got working code. Running it in Chrome/Firefox’s Javascript console produces our key: 69454623829323481e291a32e7b40aa0.