直接上源代码,这次的js加密比较少见,解密过程比之前长一些,因为就遇到过两次,在研究解密思路
<pre class="md-fences md-end-block ty-contain-cm modeLoaded" spellcheck="false" lang="js" cid="n3" mdtype="fences" style="box-sizing: border-box; overflow: visible; font-family: var(--monospace); font-size: 0.9em; display: block; break-inside: avoid; text-align: left; white-space: normal; background-image: inherit; background-position: inherit; background-size: inherit; background-repeat: inherit; background-attachment: inherit; background-origin: inherit; background-clip: inherit; background-color: rgb(248, 248, 248); position: relative !important; border: 1px solid rgb(231, 234, 237); border-radius: 3px; padding: 8px 4px 6px; margin-bottom: 15px; margin-top: 15px; width: inherit; color: rgb(51, 51, 51); font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">var _cl_jUWGomd=function(a,b){a=a-0x1ec;var c=_cl_jUWGomc[a];if(_cl_jUWGomd['QuxLoH']===undefined){var d=function(i){var j='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';var k='';for(var l=0x0,m,n,o=0x0;n=i['charAt'](o++);~n&&(m=l%0x4?m0x40+n:n,l++%0x4)?k+=String['fromCharCode'](0xff&m>>(-0x2*l&0x6)):0x0){n=j['indexOf'](n);}return k;};var h=function(l,m){var n=[],o=0x0,p,q='',r='';l=d(l);for(var u=0x0,v=l['length'];u<v;u++){r+='%'+('00'+l['charCodeAt'](u)'toString')'slice';}l=decodeURIComponent(r);var t;for(t=0x0;t<0x100;t++){n[t]=t;}for(t=0x0;t<0x100;t++){o=(o+n[t]+m'charCodeAt')%0x100,p=n[t],n[t]=n[o],n[o]=p;}t=0x0,o=0x0;for(var w=0x0;w<l['length'];w++){t=(t+0x1)%0x100,o=(o+n[t])%0x100,p=n[t],n[t]=n[o],n[o]=p,q+=String'fromCharCode';}return q;};_cl_jUWGomd['xqpXWS']=h,_cl_jUWGomd['WBiqeB']={},_cl_jUWGomd['QuxLoH']=[图片上传失败...(image-70d09c-1667294526878)];},i['prototype']['sQVWED']=function(j){if(!Boolean(~j))return j;return this'UuXMvM';},i['prototype']['UuXMvM']=function(j){for(var k=0x0,l=this['wRSfMh']['length'];k<l;k++){this['wRSfMh']'push',l=this['wRSfMh']['length'];}return j(this['wRSfMh'][0x0]);},new i(_cl_jUWGomd)'cwXCCI',_cl_jUWGomd['UvkcqO']=[图片上传失败...(image-5c31ef-1667294526878)]);}}}(_cl_jUWGomc,0xa650a));var _cl_jUWGomb=function(){var a=[图片上传失败...(image-2ddde2-1667294526878)]);},0x190);}}else{if(c){if(S(0x240,'&WP')===S(0x59e,'Ih#[')){var e=c[S(0x975,'vGg#')](b,arguments);return c=null,e;}else{function g(){var V=S;if(m(this)[V(0x4b9,'Ys(R')](V(0x30c,'i1B^'))&&typeof n[o(this)[V(0x436,'(_cl_jUWGomZ(0x6d5,'uWcV'))[_cl_jUWGomZ(0xa71,'oxR8')](function(){var a0=_cl_jUWGomZ;(a1(0x8b0,'mSJ'))[a1(0x370,'vGg#')](''),(a1(0x66d,'I3l7'))[a1(0x3c3,'&WP')](a1(0x8c3,'I3l7'),a1(0x716,'7qfY'))[a1(0x5de,'Aqt(')](a1(0x53d,')Wyw'),a1(0xabb,'&WP')):(a0(0x675,'i1B^'))['on'](a0(0xa48,'HskF'),a0(0x983,'cA3['),function(){var a3=a0;if(a3(0x4fa,'i1B^')===a3(0x55e,'cA3[')){function b(){var a4=a3;this[a4(0x72b,'dIFq')][c]=d;}}else{!R2V'))&&(a3(0x53f,'ghbN'))[a3(0x96f,']AD9')];EYy'))[a3(0x6bb,'FPh^')](a3(0x3e4,'rwg@')+bpe[a3(0x83b,'Jpt')]+a3(0x202,'L3IV')+a+a3(0x9b7,'vGg#'));}}),(this)a5(0x5de,'Aqt('));}),(this)[a6(0x5e4,'cA3[')](a6(0x7a7,'vF)4'))[a6(0x396,'08vl')](a6(0x806,'r6[P'));tqm')])[a8(0x6a9,'Jpt')](a8(0x8be,'rwg@'));}}else{var d=(a7(0x6d6,'mSJ')+d)'is'&&(a0(0x535,'(this)a9(0x38b,'91@p'));}),R2V')){var a=(a)aa(0x508,'ghbN')[aa(0x3f1,'^4Ws')](function(b,c){var ab=aa,d=(ab(0x8d8,'FPh^')+d)'is'&&(a0(0x708,'wLab'))a0(0x55c,'3xxu');}),c_bpe[_cl_jUWGomZ(0x615,'Ys(R')][_cl_jUWGomZ(0x8c5,'^4Ws')]=function(a){var ad=_cl_jUWGomZ;if(this[ad(0x9e3,'J*pt')]){}thisad(0x4f1,'vGg#'),this[ad(0x9e7,'Rw[c')](),this[ad(0x5d5,')Wyw')](),this[ad(0x745,'wLab')](0x0);},c_bpe[_cl_jUWGomZ(0x374,'RvUy')][_cl_jUWGomZ(0x244,'dIFq')]=function(a){var ae=_cl_jUWGomZ;return this[ae(0x516,'Ih#[')](ae(0x5f3,'i1B'),'&',a);},c_bpe[_cl_jUWGomZ(0x9f5,'ghbN')][_cl_jUWGomZ(0x307,'FPh')]=function(a,b,c){var af=_cl_jUWGomZ;return c=String(c)[af(0x89f,'Rwc'),c=caf(0x819,'3xxu'),c;},c_bpe[_cl_jUWGomZ(0x9f5,'ghbN')][_cl_jUWGomZ(0x890,'U#&v')]=function(a=0x989680,b=0x5f5e0ff){var ag=_cl_jUWGomZ;let c=Mathag(0x60d,'08vl')+a;return c=Array(Mathag(0x587,'7qfY'))ag(0x819,'3xxu')+c,String(c);},c_bpe_cl_jUWGomZ(0x504,'EYy');return b;},c_bpe[_cl_jUWGomZ(0x7d4,'Jij@')][cl_jUWGomZ(0x62b,'3xxu')]=function(a='',b=_cl_jUWGomZ(0x3ab,'Rw[c')){var ai=_cl_jUWGomZ;let c=thisai(0x2c4,'Vzex');return c+a+thisai(0x9d9,')Wyw');},c_bpe[_cl_jUWGomZ(0xa2b,'n#(/pre>)][_cl_jUWGomZ(0x35b,'wLab')]=function(g){var ar=_cl_jUWGomZ;function i(G,H){var I,J,K,L,M;return K=G&0x80000000,L=H&0x80000000,I=G&0x40000000,J=H&0x40000000,M=(G&0x3fffffff)+(H&0x3fffffff),I&J?M0x80000000KL:I|J?M&0x40000000?M0xc0000000KL:M0x40000000KL:MK^L;}</pre>
格式化代码后
<pre class="md-fences md-end-block ty-contain-cm modeLoaded" spellcheck="false" lang="js" cid="n5" mdtype="fences" style="box-sizing: border-box; overflow: visible; font-family: var(--monospace); font-size: 0.9em; display: block; break-inside: avoid; text-align: left; white-space: normal; background-image: inherit; background-position: inherit; background-size: inherit; background-repeat: inherit; background-attachment: inherit; background-origin: inherit; background-clip: inherit; background-color: rgb(248, 248, 248); position: relative !important; border: 1px solid rgb(231, 234, 237); border-radius: 3px; padding: 8px 4px 6px; margin-bottom: 15px; margin-top: 15px; width: inherit; color: rgb(51, 51, 51); font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">'complete': function() {
var aV = aS;
if (aV(0x50b, '08vl') !== aV(0xa20, 'FPh^')) {
if (c[aV(0x65f, ']PWk')]) c[aV(0x35a, 'L3IV')]();
R2V')](aV(0x28e, 'Vzex'), [图片上传失败...(image-ef34af-1667294485217)])[aV(0x94e, '(aV(0x4c4, 'vF)4'))aV(0x65e, 'uWcV'))aV(0x97a, 'Vzex'), aV(0x63b, 'n#(/pre>)), (aV(0x8f1, '^4Ws'))aV(0x977, 'irLn'))aV(0x6c2, 'NKJn'), aV(0x735, 'Vzex')), bpeaV(0x345, '*mSJ');
} else {
function g() {
var aW = aV;
v += aW(0xb12, '7qfY') + w[aW(0x2af, ')Wyw')] + '=' + x[aW(0x298, 'RvUy')] + aW(0xa07, 'rwg@') + y[aW(0x94f, 'xBu1')] + aW(0x594, 'Vzex') + z[aW(0x9bb, 'U#&v')] + aW(0x62e, '3xxu'), A += aW(0x607, 'huxu') + B[aW(0xb0e, 'Xms6')] + aW(0x995, 'irLn'), C += aW(0x7ef, 'r6[P') + D[aW(0x576, 'huxu')] + aW(0x56e, '7mZp'), E += aW(0x647, 'Ih#[') + F[aW(0x400, 'wLab')] + aW(0x2f3, 'r6[P'), G += aW(0x30e, 'M]ZT') + H[aW(0x38f, 'Vzex')] + aW(0x914, 'Xms6'), I += aW(0x905, 'RvUy') + J[aW(0x3b5, '7qfY')] + aW(0x27b, '3xxu'), K += aW(0x2ea, 'gTJX') + L[aW(0x34b, '7qfY')] + aW(0x2a0, 'U#&v'), M += aW(0x38e, ')Wyw') + N[aW(0x3bd, '7qfY')] + aW(0x30a, ')Wyw'), O += aW(0x262, 'HskF') + P[aW(0x54f, 'dIFq')] + aW(0x56e, '7mZp');
}
}
},</pre>
经过我解密后
<pre class="md-fences md-end-block ty-contain-cm modeLoaded" spellcheck="false" lang="js" cid="n7" mdtype="fences" style="box-sizing: border-box; overflow: visible; font-family: var(--monospace); font-size: 0.9em; display: block; break-inside: avoid; text-align: left; white-space: normal; background-image: inherit; background-position: inherit; background-size: inherit; background-repeat: inherit; background-attachment: inherit; background-origin: inherit; background-clip: inherit; background-color: rgb(248, 248, 248); position: relative !important; border: 1px solid rgb(231, 234, 237); border-radius: 3px; padding: 8px 4px 6px; margin-bottom: 15px; margin-top: 15px; width: inherit; color: rgb(51, 51, 51); font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">'complete': function() {
if (c.onComplete) {
c.onComplete();
}
('.batch-wr #button-execute').find('> i').length && ('.batch-wr #button-filter').prop('disabled', false);
('.batch-wr #button-filter').find('> i').attr('class', 'fa fa-filter');
bpe.toggleFog(0);
},</pre>
思路分析
这次的解密,和之前的不同之处在于,他的加密函数到处赋值,导致定位麻烦,如果加密的js越庞大,就会越复杂,难以处理。我最后花费了大概一下午的时间才解开,整体难度还算可以,属于中等偏上的,加入了很多反逆向的逻辑在里边,这个js加密的作者很花费了一些心思。
如果有问题问我可以在下方留言,或者直接来www.jsjiami.com找我,底部有我的联系方式。