1
xssp OP 有大佬帮忙看下吗?
|
2
xssp OP 有人吗
|
3
imdong 2019-08-29 00:40:52 +08:00 1
那丫自己写的,用 rc4 把代码加密了而已。
解密密钥也在代码里,刚刚翻了一半没心情了... |
4
locoz 2019-08-29 00:42:21 +08:00 via Android 1
手机上看没有格式化过的代码就是一坨…
大概看了一下应该就十六进制命名混淆、关键词 base64+加密以及貌似有轻微的控制流平坦化,属于目前 js 加密界的常规中端操作,了解一下 AST (语法树)相关操作就能还原出正常些的代码了(直接用正则批量替换也行)。 如果你能找到你需要的部分的入口点的话,断点断下来之后手动抄一份也行,这个代码看起来不多的样子。 |
7
imdong 2019-08-29 15:31:14 +08:00 1
```
var encode_version = 'sojson.v5', ialeh = 'b_data', b_data = [ 'cwvDng==', 'bDAaM8Oq', 'AGk8w7sv', 'RgXDuFXDnA==', 'wrsfMT8+', 'wpjCmsKTaMKowoLDncO4wqAhw7jDgnrChw==', 'cSLDtcKRw6rDpUPCq8OffV/DjBnCsA==', 'wpV+fcOVwp4=', 'w5skTcKcZw==', 'QcKrU8KCwps=', 'w4NKKcK5Z0YxwrzDlhJVwr7Dpj4=', 'Uh/Dtk7Dkg==', 'YsKsw6wfSAMlw4NG', 'CcOUUXRj', '5Lmw6IOt5Ymy6ZuWw7XDjgTChy5Fw7PDjzk=', // 从这里开始 'csKsw6gKTgo=', 'woAgIVTCucKtw5krRVvDoMOIwpJw', 'w7Y0woFcOA==', 'I8Odw4jDpMOfwpbDv2hrLsKpO8Kew7Q=', 'w7BiGQ==' ]; (function(b_data, b_num) { var b_call = function(b_num) { while (--b_num) { b_data.push(b_data.shift()); } }; b_call(++b_num); } (b_data, 455)); // 455 / b_data.length 截取重组 var decode_obj /* _0x5e34 */ = function(de_id /* _0x27f050 */, de_key /* _0xd83274 */) { de_id = de_id - 0; var data_item /* _0x2060f1 */ = b_data[de_id]; console.log(de_id, data_item); if (decode_obj.initialized === undefined) { // init base64 decode (function() { var window /* _0x17a143 */ = typeof window !== 'undefined' ? window : typeof process === 'object' && typeof require === 'function' && typeof global === 'object' ? global: this; var _0x1822e8 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='; window.atob || (window.atob = function(_0x2bcf1f) { var _0x1758b7 = String(_0x2bcf1f).replace(/=+$/, ''); for (var _0x4513cf = 0, _0x27feda, _0x30b0b7, _0x275cfd = 0, _0x31ca09 = ''; _0x30b0b7 = _0x1758b7.charAt(_0x275cfd++);~_0x30b0b7 && (_0x27feda = _0x4513cf % 0x4 ? _0x27feda * 0x40 + _0x30b0b7: _0x30b0b7, _0x4513cf++%0x4) ? _0x31ca09 += String.fromCharCode(0xff & _0x27feda >> ( - 0x2 * _0x4513cf & 0x6)) : 0) { _0x30b0b7 = _0x1822e8.indexOf(_0x30b0b7); } return _0x31ca09; }); } ()); var rc4 /* _0x2e4cdf */= function(data_item /* _0x417bb1 */, de_key /* _0x5f16c8 */) { console.log('rc4', data_item); var arr_tmp /* _0x5eb132 */ = [], key_num /* _0x486e97 */ = 0, _0x578b31, _0x1e5da8 = '', urlcode /* _0x1a181c */ = ''; data_item = atob(data_item); for (var i = 0, length = data_item.length; i < length; i++) { urlcode += '%' + ('00' + data_item.charCodeAt(i).toString(16)).slice(-2); } data_item = decodeURIComponent(urlcode); for (var n /* _0x7c88b1 */ = 0; n < 256; n++) { arr_tmp[n] = n; } for (n = 0; n < 256; n++) { key_num = (key_num + arr_tmp[n] + de_key.charCodeAt(n % de_key.length)) % 256; _0x578b31 = arr_tmp[n]; arr_tmp[n] = arr_tmp[key_num]; arr_tmp[key_num] = _0x578b31; } n = 0; key_num = 0; for (var _0x1da9bb = 0; _0x1da9bb < data_item.length; _0x1da9bb++) { n = (n + 0x1) % 256; key_num = (key_num + arr_tmp[n]) % 256; _0x578b31 = arr_tmp[n]; arr_tmp[n] = arr_tmp[key_num]; arr_tmp[key_num] = _0x578b31; _0x1e5da8 += String.fromCharCode(data_item.charCodeAt(_0x1da9bb) ^ arr_tmp[(arr_tmp[n] + arr_tmp[key_num]) % 256]); } return _0x1e5da8; }; decode_obj.rc4 = rc4; decode_obj.data = {}; decode_obj.initialized = true; // !![]; } var item /* _0x25e533 */ = decode_obj.data[de_id]; console.log(de_id, data_item, item); if (item === undefined) { if (decode_obj.once === undefined) { decode_obj.once = true; } data_item = decode_obj.rc4(data_item, de_key); decode_obj.data[de_id] = data_item; } else { data_item = item; } return data_item; }; // 用户加密的代码 开始 wx.config({ 'jsApiList': ['hideOptionMenu'] }); wx.ready(function() { wx.hideOptionMenu(); }); var d_id /* d_id */ = 0; function check /* _0x153e6c */() { var d_obj /* _0xaa06b3 */ = { 'BtDbY': function _0x5b6c88(_0x7f979b, _0x402b7c) { return _0x7f979b % _0x402b7c; }, 'FxGAC': function _0x4f8ef4(_0x16748e, _0x5c35e8) { return _0x16748e !== _0x5c35e8; }, 'scHmt': 'pPm', 'JtBdW': 'ckP', 'INwnv': function _0x3cdc7e(_0x566bf1, _0xde4bbc) { return _0x566bf1 + _0xde4bbc; }, 'DOPnM': function _0x136a1f(_0x491586, _0x32d6e3) { return _0x491586 === _0x32d6e3; }, 'etRas': 'Fmn', 'gyFvz': function _0x3d4ad5(_0x3f651d, _0x485c68) { return _0x3f651d + _0x485c68; } }; if (d_obj.BtDbY(d_id, 2)) { if (d_obj.FxGAC(d_obj.scHmt, d_obj.JtBdW)) { wx.showOptionMenu(); } else { if (d_id % 2) { wx.showOptionMenu(); } else { wx.hideOptionMenu(); } d_id = d_obj.INwnv(d_id, 1); } } else { if (d_obj.DOPnM(d_obj.etRas, 'sQj')) { wx.hideOptionMenu(); } else { wx.hideOptionMenu(); } } d_id = d_obj.gyFvz(d_id, 1); } setInterval(check, 150); // 用户加密的代码 结束 if (! (typeof encode_version !== 'undefined' && encode_version === 'sojson.v5')) { window.alert('不能删除 sojson.v5'); }; encode_version = 'sojson.v5'; ``` |