js逆向-ast混淆还原入门案例(1)

admin 2023年1月12日08:27:37安全文章js逆向-ast混淆还原入门案例(1)已关闭评论6 views15228字阅读50分45秒阅读模式

recast资料太少,在大佬的建议下转到babel了。

搬运各个地方的案例学习后,分享给大家,也给自己一个记录。

案例需2个文件:运行文件1_run.js       源码文件1_read.js

1_read.js

  1. var _0x2075 = ['wrw3EMKc', 'BBdBHWk=', 'wplgd8O5dHbDtFfDucK9CsOS', 'f8KvAcKewoDClg==', 'XcKowo9uOyfChw==', 'XcKowpRzOzDCgMKuw5vCtH8=', 'HmQkw5vDt8OIBDbCpMKdw6Aaw7HDmcKb', 'wpxzdMO4', 'R8KHF1k1w5A=', 'w4LDgcOowrjDhg==', 'w6RKw6PCmVDDpw==', 'w6DDgsKrCsK5wqAwKsOMTkPDilwgB241RVBIw6rCvwpWw5fCo8OSw59pBcK7UlrCucOZHy7DgsO5wpx5J8K5wqbCtMOMwqvCsiUFw5s4JGfDmwQPw7Fawq3CgXlkJyE=', 'VcObYsOHKcKpwpI=', 'KkZfcE52w77ChsKgUQ==', 'CmQsw57DvA==', 'YV7CscOYZg==', 'w5jDt8OUwr46w5c6LsKEPsO0', 'F8OUMQhRw78Q', 'YMKzeTvCpMKzHcKKGSjCj2dJwq3Cj3/ChsKSFVpMw4sZwrg9H8OLw4/DqUlhYlpaa8KYJsO5AcK2wqnCmGhEwqkbdMKKLsO/wpBFMcKlC8OvKUkXZ8KpBsOxw4XDk8K5w4Y6w7VZO8K/wojCqcO2wqQow5Z+w6dew7I3TMObw6Ykw7I=', 'Mk8Bw6QawqU=', 'wo5zw4vCkxvDuSBqwoENw7rCrF3DksKewoPDqMKHNSzCgcK2fcKxPMKbGcKwCW5GZWRpw6fDmgHCjXrCnXE3w4zDqlt3w64lw7JiworDi8Knw5YoW1LDlUbDpkEtGQPDnw==', 'w6lvdMKW', 'w7JFdsOhwrBqwrlMYcKVJRjCuMKQwpLDtMONwprCsMORw4BtRV0oeEQPCgAmMgx2'];

  2. (function(_0xf486e7, _0x2075d7) {

  3. var _0x5c3a18 = function(_0x5b65b1) {

  4. while (--_0x5b65b1) {

  5. _0xf486e7['push'](_0xf486e7['shift']());

  6. _0x5c3a18(++_0x2075d7);

  7. var _0x5c3a = function(_0xf486e7, _0x2075d7) {

  8. _0xf486e7 = _0xf486e7 - 0x0;

  9. var _0x5c3a18 = _0x2075[_0xf486e7];

  10. if (_0x5c3a['vEVEZj'] === undefined) {

  11. var _0x2e1ca4;

  12. var _0x28e173 = Function('return\x20(function()\x20' + '{}.constructor(\x22return\x20this\x22)(\x20)' + ');');

  13. _0x2e1ca4 = _0x28e173();

  14. } catch (_0x16acc9) {

  15. _0x2e1ca4 = window;

  16. var _0x16f958 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';

  17. _0x2e1ca4['atob'] || (_0x2e1ca4['atob'] = function(_0x5a7812) {

  18. var _0x3c7e74 = String(_0x5a7812)['replace'](/=+$/, '');

  19. var _0x5e030c = '';

  20. for (var _0x4eaee2 = 0x0, _0x5954ef, _0x29200e, _0x5a128b = 0x0; _0x29200e = _0x3c7e74['charAt'](_0x5a128b++); ~_0x29200e && (_0x5954ef = _0x4eaee2 % 0x4 ? _0x5954ef * 0x40 + _0x29200e : _0x29200e,

  21. _0x4eaee2++ % 0x4) ? _0x5e030c += String['fromCharCode'](0xff & _0x5954ef >> (-0x2 * _0x4eaee2 & 0x6)) : 0x0) {

  22. _0x29200e = _0x16f958['indexOf'](_0x29200e);

  23. return _0x5e030c;

  24. var _0x3acf89 = function(_0x593a19, _0xfee22e) {

  25. var _0x1b5349 = [], _0x4ddb21 = 0x0, _0x28ed27, _0x4b4996 = '', _0xbdd0c6 = '';

  26. _0x593a19 = atob(_0x593a19);

  27. for (var _0x1d6343 = 0x0, _0x3f947e = _0x593a19['length']; _0x1d6343 < _0x3f947e; _0x1d6343++) {

  28. _0xbdd0c6 += '%' + ('00' + _0x593a19['charCodeAt'](_0x1d6343)['toString'](0x10))['slice'](-0x2);

  29. _0x593a19 = decodeURIComponent(_0xbdd0c6);

  30. var _0x1a120c;

  31. for (_0x1a120c = 0x0; _0x1a120c < 0x100; _0x1a120c++) {

  32. _0x1b5349[_0x1a120c] = _0x1a120c;

  33. for (_0x1a120c = 0x0; _0x1a120c < 0x100; _0x1a120c++) {

  34. _0x4ddb21 = (_0x4ddb21 + _0x1b5349[_0x1a120c] + _0xfee22e['charCodeAt'](_0x1a120c % _0xfee22e['length'])) % 0x100;

  35. _0x28ed27 = _0x1b5349[_0x1a120c];

  36. _0x1b5349[_0x1a120c] = _0x1b5349[_0x4ddb21];

  37. _0x1b5349[_0x4ddb21] = _0x28ed27;

  38. _0x1a120c = 0x0;

  39. _0x4ddb21 = 0x0;

  40. for (var _0x585b7f = 0x0; _0x585b7f < _0x593a19['length']; _0x585b7f++) {

  41. _0x1a120c = (_0x1a120c + 0x1) % 0x100;

  42. _0x4ddb21 = (_0x4ddb21 + _0x1b5349[_0x1a120c]) % 0x100;

  43. _0x28ed27 = _0x1b5349[_0x1a120c];

  44. _0x1b5349[_0x1a120c] = _0x1b5349[_0x4ddb21];

  45. _0x1b5349[_0x4ddb21] = _0x28ed27;

  46. _0x4b4996 += String['fromCharCode'](_0x593a19['charCodeAt'](_0x585b7f) ^ _0x1b5349[(_0x1b5349[_0x1a120c] + _0x1b5349[_0x4ddb21]) % 0x100]);

  47. return _0x4b4996;

  48. _0x5c3a['HKkhxp'] = _0x3acf89;

  49. _0x5c3a['eabUGz'] = {};

  50. _0x5c3a['vEVEZj'] = !![];

  51. var _0x5b65b1 = _0x5c3a['eabUGz'][_0xf486e7];

  52. if (_0x5b65b1 === undefined) {

  53. if (_0x5c3a['vszZjY'] === undefined) {

  54. _0x5c3a['vszZjY'] = !![];

  55. _0x5c3a18 = _0x5c3a['HKkhxp'](_0x5c3a18, _0x2075d7);

  56. _0x5c3a['eabUGz'][_0xf486e7] = _0x5c3a18;

  57. _0x5c3a18 = _0x5b65b1;

  58. var _0x2e1ca4 = function() {

  59. var _0x564fd8 = !![];

  60. return function(_0x157886, _0x3f8543) {

  61. var _0x3aa335 = _0x564fd8 ? function() {

  62. if (_0x3f8543) {

  63. var _0x35f411 = _0x3f8543[_0x5c3a('0x15', 'qqhd')](_0x157886, arguments);

  64. _0x3f8543 = null;

  65. return _0x35f411;

  66. return _0x3aa335;

  67. _0x2e1ca4(this, function() {

  68. var _0x13f533 = new RegExp('function\x20*\x5c(\x20*\x5c)');

  69. var _0x28f488 = new RegExp(_0x5c3a('0x13', 'l02m'),'i');

  70. var _0x5783e7 = _0x3acf89('init');

  71. if (!_0x13f533['test'](_0x5783e7 + _0x5c3a('0xb', 'mvpW')) || !_0x28f488['test'](_0x5783e7 + _0x5c3a('0x6', 'S&fJ'))) {

  72. _0x5783e7('0');

  73. window['atob'] = function(_0x44004e) {

  74. e = _0x5c3a('0x8', 'CwZq');

  75. var _0x2761c0 = String(_0x44004e)[_0x5c3a('0x9', 'F%XZ')](/=+$/, '');

  76. if (_0x2761c0[_0x5c3a('0x7', 'KMc0')] % 0x4 == 0x1)

  77. throw new t('\x27atob\x27\x20failed:\x20The\x20string\x20to\x20be\x20decoded\x20is\x20not\x20correctly\x20encoded.');

  78. for (var _0x3568b6, _0x228da4, _0x1076e1 = 0x0, _0x242bbc = 0x0, _0x5766d9 = ''; _0x228da4 = _0x2761c0['charAt'](_0x242bbc++); ~_0x228da4 && (_0x3568b6 = _0x1076e1 % 0x4 ? 0x40 * _0x3568b6 + _0x228da4 : _0x228da4,

  79. _0x1076e1++ % 0x4) ? _0x5766d9 += String[_0x5c3a('0x16', '%Fh)')](0xff & _0x3568b6 >> (-0x2 * _0x1076e1 & 0x6)) : 0x0)

  80. _0x228da4 = e[_0x5c3a('0xe', 'ivHf')](_0x228da4);

  81. window['btoa'] = function(_0x140387) {

  82. e = _0x5c3a('0x11', '1t8u');

  83. for (var _0x5a7683, _0x5c4afc, _0x414c71 = String(_0x140387), _0x3a865d = 0x0, _0x388744 = e, _0x171f9b = ''; _0x414c71[_0x5c3a('0x10', 'G%UZ')](0x0 | _0x3a865d) || (_0x388744 = '=',

  84. _0x3a865d % 0x1); _0x171f9b += _0x388744[_0x5c3a('0x5', '#%vS')](0x3f & _0x5a7683 >> 0x8 - _0x3a865d % 0x1 * 0x8)) {

  85. if (_0x5c4afc = _0x414c71[_0x5c3a('0xa', '(eE#')](_0x3a865d += 0.75),

  86. _0x5c4afc > 0xff)

  87. throw new t(_0x5c3a('0xf', '!zyq'));

  88. _0x5a7683 = _0x5a7683 << 0x8 | _0x5c4afc;

  89. function _0x3acf89(_0x1a61bd) {

  90. function _0x50b4d2(_0x5c1045) {

  91. if (typeof _0x5c1045 === 'string') {

  92. return function(_0xaf1ee8) {}

  93. ['constructor'](_0x5c3a('0x3', 'mvpW'))[_0x5c3a('0xc', 'dtRw')](_0x5c3a('0x1', 'g1Ep'));

  94. if (('' + _0x5c1045 / _0x5c1045)['length'] !== 0x1 || _0x5c1045 % 0x14 === 0x0) {

  95. (function() {

  96. return !![];

  97. ['constructor']('debu' + 'gger')[_0x5c3a('0x4', '%Fh)')](_0x5c3a('0x0', 'zu[n')));

  98. (function() {

  99. return ![];

  100. [_0x5c3a('0x2', 'g1Ep')](_0x5c3a('0x12', 'LPae') + _0x5c3a('0x14', 'N5*X'))['apply'](_0x5c3a('0xd', 'qOO9')));

  101. _0x50b4d2(++_0x5c1045);

  102. return _0x50b4d2;

  103. _0x50b4d2(0x0);

  104. } catch (_0x524e63) {}

1_run.js

  1. * 安装 npm install @babel/core

  2. const parser = require("@babel/parser");

  3. const template = require("@babel/template").default;

  4. const traverse = require("@babel/traverse").default;

  5. const t = require("@babel/types");

  6. const generator = require("@babel/generator").default;

  7. const fs = require("fs");

  8. const path = require('path');

  9. var file_path = 'F:\\FILE\\Python\\Exercises\\js\\js-ast混淆还原\\'

  10. var jscode = fs.readFileSync(file_path+"1_read.js", {

  11. var _0x2075 = ['wrw3EMKc', 'BBdBHWk=', 'wplgd8O5dHbDtFfDucK9CsOS', 'f8KvAcKewoDClg==', 'XcKowo9uOyfChw==', 'XcKowpRzOzDCgMKuw5vCtH8=', 'HmQkw5vDt8OIBDbCpMKdw6Aaw7HDmcKb', 'wpxzdMO4', 'R8KHF1k1w5A=', 'w4LDgcOowrjDhg==', 'w6RKw6PCmVDDpw==', 'w6DDgsKrCsK5wqAwKsOMTkPDilwgB241RVBIw6rCvwpWw5fCo8OSw59pBcK7UlrCucOZHy7DgsO5wpx5J8K5wqbCtMOMwqvCsiUFw5s4JGfDmwQPw7Fawq3CgXlkJyE=', 'VcObYsOHKcKpwpI=', 'KkZfcE52w77ChsKgUQ==', 'CmQsw57DvA==', 'YV7CscOYZg==', 'w5jDt8OUwr46w5c6LsKEPsO0', 'F8OUMQhRw78Q', 'YMKzeTvCpMKzHcKKGSjCj2dJwq3Cj3/ChsKSFVpMw4sZwrg9H8OLw4/DqUlhYlpaa8KYJsO5AcK2wqnCmGhEwqkbdMKKLsO/wpBFMcKlC8OvKUkXZ8KpBsOxw4XDk8K5w4Y6w7VZO8K/wojCqcO2wqQow5Z+w6dew7I3TMObw6Ykw7I=', 'Mk8Bw6QawqU=', 'wo5zw4vCkxvDuSBqwoENw7rCrF3DksKewoPDqMKHNSzCgcK2fcKxPMKbGcKwCW5GZWRpw6fDmgHCjXrCnXE3w4zDqlt3w64lw7JiworDi8Knw5YoW1LDlUbDpkEtGQPDnw==', 'w6lvdMKW', 'w7JFdsOhwrBqwrlMYcKVJRjCuMKQwpLDtMONwprCsMORw4BtRV0oeEQPCgAmMgx2'];

  12. (function(_0xf486e7, _0x2075d7) {

  13. var _0x5c3a18 = function(_0x5b65b1) {

  14. while (--_0x5b65b1) {

  15. _0xf486e7['push'](_0xf486e7['shift']());

  16. _0x5c3a18(++_0x2075d7);

  17. var _0x5c3a = function(_0xf486e7, _0x2075d7) {

  18. _0xf486e7 = _0xf486e7 - 0x0;

  19. var _0x5c3a18 = _0x2075[_0xf486e7];

  20. if (_0x5c3a['vEVEZj'] === undefined) {

  21. var _0x2e1ca4;

  22. var _0x28e173 = Function('return\x20(function()\x20' + '{}.constructor(\x22return\x20this\x22)(\x20)' + ');');

  23. _0x2e1ca4 = _0x28e173();

  24. } catch (_0x16acc9) {

  25. _0x2e1ca4 = window;

  26. var _0x16f958 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';

  27. _0x2e1ca4['atob'] || (_0x2e1ca4['atob'] = function(_0x5a7812) {

  28. var _0x3c7e74 = String(_0x5a7812)['replace'](/=+$/, '');

  29. var _0x5e030c = '';

  30. for (var _0x4eaee2 = 0x0, _0x5954ef, _0x29200e, _0x5a128b = 0x0; _0x29200e = _0x3c7e74['charAt'](_0x5a128b++); ~_0x29200e && (_0x5954ef = _0x4eaee2 % 0x4 ? _0x5954ef * 0x40 + _0x29200e : _0x29200e,

  31. _0x4eaee2++ % 0x4) ? _0x5e030c += String['fromCharCode'](0xff & _0x5954ef >> (-0x2 * _0x4eaee2 & 0x6)) : 0x0) {

  32. _0x29200e = _0x16f958['indexOf'](_0x29200e);

  33. return _0x5e030c;

  34. var _0x3acf89 = function(_0x593a19, _0xfee22e) {

  35. var _0x1b5349 = [], _0x4ddb21 = 0x0, _0x28ed27, _0x4b4996 = '', _0xbdd0c6 = '';

  36. _0x593a19 = atob(_0x593a19);

  37. for (var _0x1d6343 = 0x0, _0x3f947e = _0x593a19['length']; _0x1d6343 < _0x3f947e; _0x1d6343++) {

  38. _0xbdd0c6 += '%' + ('00' + _0x593a19['charCodeAt'](_0x1d6343)['toString'](0x10))['slice'](-0x2);

  39. _0x593a19 = decodeURIComponent(_0xbdd0c6);

  40. var _0x1a120c;

  41. for (_0x1a120c = 0x0; _0x1a120c < 0x100; _0x1a120c++) {

  42. _0x1b5349[_0x1a120c] = _0x1a120c;

  43. for (_0x1a120c = 0x0; _0x1a120c < 0x100; _0x1a120c++) {

  44. _0x4ddb21 = (_0x4ddb21 + _0x1b5349[_0x1a120c] + _0xfee22e['charCodeAt'](_0x1a120c % _0xfee22e['length'])) % 0x100;

  45. _0x28ed27 = _0x1b5349[_0x1a120c];

  46. _0x1b5349[_0x1a120c] = _0x1b5349[_0x4ddb21];

  47. _0x1b5349[_0x4ddb21] = _0x28ed27;

  48. _0x1a120c = 0x0;

  49. _0x4ddb21 = 0x0;

  50. for (var _0x585b7f = 0x0; _0x585b7f < _0x593a19['length']; _0x585b7f++) {

  51. _0x1a120c = (_0x1a120c + 0x1) % 0x100;

  52. _0x4ddb21 = (_0x4ddb21 + _0x1b5349[_0x1a120c]) % 0x100;

  53. _0x28ed27 = _0x1b5349[_0x1a120c];

  54. _0x1b5349[_0x1a120c] = _0x1b5349[_0x4ddb21];

  55. _0x1b5349[_0x4ddb21] = _0x28ed27;

  56. _0x4b4996 += String['fromCharCode'](_0x593a19['charCodeAt'](_0x585b7f) ^ _0x1b5349[(_0x1b5349[_0x1a120c] + _0x1b5349[_0x4ddb21]) % 0x100]);

  57. return _0x4b4996;

  58. _0x5c3a['HKkhxp'] = _0x3acf89;

  59. _0x5c3a['eabUGz'] = {};

  60. _0x5c3a['vEVEZj'] = !![];

  61. var _0x5b65b1 = _0x5c3a['eabUGz'][_0xf486e7];

  62. if (_0x5b65b1 === undefined) {

  63. if (_0x5c3a['vszZjY'] === undefined) {

  64. _0x5c3a['vszZjY'] = !![];

  65. _0x5c3a18 = _0x5c3a['HKkhxp'](_0x5c3a18, _0x2075d7);

  66. _0x5c3a['eabUGz'][_0xf486e7] = _0x5c3a18;

  67. _0x5c3a18 = _0x5b65b1;

  68. function traverse_all(ast) {

  69. // 遍历节点,当遇到下列类型的时候会调用函数

  70. CallExpression: {

  71. enter: [replace_function_to_string]

  72. MemberExpression: {

  73. enter: [replace]

  74. // a["length"]转变为a.length

  75. const node = path.node;

  76. let property = path.get('property')

  77. if(t.isStringLiteral(node.property)) {

  78. let value = node.property.value;

  79. console.log(value)

  80. //原为true,改后的效果把[]变为.

  81. node.computed = false

  82. //如果写成path.replaceWith是将整个MemberExpression节点换为value,节点类型也变为Identifier,例:window.btoa变为btoa

  83. //我们仅需要替换property节点

  84. property.replaceWith(t.Identifier(value))

  85. function replace_function_to_string(path)

  86. const node = path.node;

  87. if (!t.isIdentifier(node.callee,{name:"_0x5c3a"})) return;

  88. let first_arg = node.arguments[0].value;

  89. let second_arg = node.arguments[1].value;

  90. let value = _0x5c3a(first_arg,second_arg);

  91. console.log(node.callee.name,first_arg,second_arg,value);

  92. //替换CallExpression节点,为StringLiteral类型的value

  93. path.replaceWith(t.StringLiteral(value));

  94. let ast = parser.parse(jscode);

  95. let {code} = generator(ast);

  96. fs.writeFile(file_path+'1_decoded.js', code, (err)=>{});

生成1_decoded.js

  1. var _0x2075 = ['wrw3EMKc', 'BBdBHWk=', 'wplgd8O5dHbDtFfDucK9CsOS', 'f8KvAcKewoDClg==', 'XcKowo9uOyfChw==', 'XcKowpRzOzDCgMKuw5vCtH8=', 'HmQkw5vDt8OIBDbCpMKdw6Aaw7HDmcKb', 'wpxzdMO4', 'R8KHF1k1w5A=', 'w4LDgcOowrjDhg==', 'w6RKw6PCmVDDpw==', 'w6DDgsKrCsK5wqAwKsOMTkPDilwgB241RVBIw6rCvwpWw5fCo8OSw59pBcK7UlrCucOZHy7DgsO5wpx5J8K5wqbCtMOMwqvCsiUFw5s4JGfDmwQPw7Fawq3CgXlkJyE=', 'VcObYsOHKcKpwpI=', 'KkZfcE52w77ChsKgUQ==', 'CmQsw57DvA==', 'YV7CscOYZg==', 'w5jDt8OUwr46w5c6LsKEPsO0', 'F8OUMQhRw78Q', 'YMKzeTvCpMKzHcKKGSjCj2dJwq3Cj3/ChsKSFVpMw4sZwrg9H8OLw4/DqUlhYlpaa8KYJsO5AcK2wqnCmGhEwqkbdMKKLsO/wpBFMcKlC8OvKUkXZ8KpBsOxw4XDk8K5w4Y6w7VZO8K/wojCqcO2wqQow5Z+w6dew7I3TMObw6Ykw7I=', 'Mk8Bw6QawqU=', 'wo5zw4vCkxvDuSBqwoENw7rCrF3DksKewoPDqMKHNSzCgcK2fcKxPMKbGcKwCW5GZWRpw6fDmgHCjXrCnXE3w4zDqlt3w64lw7JiworDi8Knw5YoW1LDlUbDpkEtGQPDnw==', 'w6lvdMKW', 'w7JFdsOhwrBqwrlMYcKVJRjCuMKQwpLDtMONwprCsMORw4BtRV0oeEQPCgAmMgx2'];

  2. (function (_0xf486e7, _0x2075d7) {

  3. var _0x5c3a18 = function (_0x5b65b1) {

  4. while (--_0x5b65b1) {

  5. _0xf486e7.push(_0xf486e7.shift());

  6. _0x5c3a18(++_0x2075d7);

  7. var _0x5c3a = function (_0xf486e7, _0x2075d7) {

  8. _0xf486e7 = _0xf486e7 - 0x0;

  9. var _0x5c3a18 = _0x2075[_0xf486e7];

  10. if (_0x5c3a.vEVEZj === undefined) {

  11. var _0x28e173 = Function('return\x20(function()\x20' + '{}.constructor(\x22return\x20this\x22)(\x20)' + ');');

  12. _0x2e1ca4 = _0x28e173();

  13. } catch (_0x16acc9) {

  14. _0x2e1ca4 = window;

  15. var _0x16f958 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';

  16. _0x2e1ca4.atob || (_0x2e1ca4.atob = function (_0x5a7812) {

  17. var _0x3c7e74 = String(_0x5a7812).replace(/=+$/, '');

  18. var _0x5e030c = '';

  19. for (var _0x4eaee2 = 0x0, _0x5954ef, _0x29200e, _0x5a128b = 0x0; _0x29200e = _0x3c7e74.charAt(_0x5a128b++); ~_0x29200e && (_0x5954ef = _0x4eaee2 % 0x4 ? _0x5954ef * 0x40 + _0x29200e : _0x29200e, _0x4eaee2++ % 0x4) ? _0x5e030c += String.fromCharCode(0xff & _0x5954ef >> (-0x2 * _0x4eaee2 & 0x6)) : 0x0) {

  20. _0x29200e = _0x16f958.indexOf(_0x29200e);

  21. return _0x5e030c;

  22. var _0x3acf89 = function (_0x593a19, _0xfee22e) {

  23. var _0x1b5349 = [],

  24. _0x4ddb21 = 0x0,

  25. _0x4b4996 = '',

  26. _0xbdd0c6 = '';

  27. _0x593a19 = atob(_0x593a19);

  28. for (var _0x1d6343 = 0x0, _0x3f947e = _0x593a19.length; _0x1d6343 < _0x3f947e; _0x1d6343++) {

  29. _0xbdd0c6 += '%' + ('00' + _0x593a19.charCodeAt(_0x1d6343).toString(0x10)).slice(-0x2);

  30. _0x593a19 = decodeURIComponent(_0xbdd0c6);

  31. for (_0x1a120c = 0x0; _0x1a120c < 0x100; _0x1a120c++) {

  32. _0x1b5349[_0x1a120c] = _0x1a120c;

  33. for (_0x1a120c = 0x0; _0x1a120c < 0x100; _0x1a120c++) {

  34. _0x4ddb21 = (_0x4ddb21 + _0x1b5349[_0x1a120c] + _0xfee22e.charCodeAt(_0x1a120c % _0xfee22e.length)) % 0x100;

  35. _0x28ed27 = _0x1b5349[_0x1a120c];

  36. _0x1b5349[_0x1a120c] = _0x1b5349[_0x4ddb21];

  37. _0x1b5349[_0x4ddb21] = _0x28ed27;

  38. for (var _0x585b7f = 0x0; _0x585b7f < _0x593a19.length; _0x585b7f++) {

  39. _0x1a120c = (_0x1a120c + 0x1) % 0x100;

  40. _0x4ddb21 = (_0x4ddb21 + _0x1b5349[_0x1a120c]) % 0x100;

  41. _0x28ed27 = _0x1b5349[_0x1a120c];

  42. _0x1b5349[_0x1a120c] = _0x1b5349[_0x4ddb21];

  43. _0x1b5349[_0x4ddb21] = _0x28ed27;

  44. _0x4b4996 += String.fromCharCode(_0x593a19.charCodeAt(_0x585b7f) ^ _0x1b5349[(_0x1b5349[_0x1a120c] + _0x1b5349[_0x4ddb21]) % 0x100]);

  45. _0x5c3a.HKkhxp = _0x3acf89;

  46. _0x5c3a.vEVEZj = !![];

  47. var _0x5b65b1 = _0x5c3a.eabUGz[_0xf486e7];

  48. if (_0x5b65b1 === undefined) {

  49. if (_0x5c3a.vszZjY === undefined) {

  50. _0x5c3a.vszZjY = !![];

  51. _0x5c3a18 = _0x5c3a.HKkhxp(_0x5c3a18, _0x2075d7);

  52. _0x5c3a.eabUGz[_0xf486e7] = _0x5c3a18;

  53. _0x5c3a18 = _0x5b65b1;

  54. var _0x2e1ca4 = function () {

  55. return function (_0x157886, _0x3f8543) {

  56. var _0x3aa335 = _0x564fd8 ? function () {

  57. var _0x35f411 = _0x3f8543.apply(_0x157886, arguments);

  58. _0x3f8543 = null;

  59. return _0x35f411;

  60. setInterval(function () {

  61. _0x2e1ca4(this, function () {

  62. var _0x13f533 = new RegExp('function\x20*\x5c(\x20*\x5c)');

  63. var _0x28f488 = new RegExp("\\+\\+ *(?:[a-zA-Z_$][0-9a-zA-Z_$]*)", 'i');

  64. var _0x5783e7 = _0x3acf89('init');

  65. if (!_0x13f533.test(_0x5783e7 + "chain") || !_0x28f488.test(_0x5783e7 + "input")) {

  66. window.atob = function (_0x44004e) {

  67. e = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";

  68. var _0x2761c0 = String(_0x44004e).replace(/=+$/, '');

  69. if (_0x2761c0.length % 0x4 == 0x1) throw new t('\x27atob\x27\x20failed:\x20The\x20string\x20to\x20be\x20decoded\x20is\x20not\x20correctly\x20encoded.');

  70. for (var _0x3568b6, _0x228da4, _0x1076e1 = 0x0, _0x242bbc = 0x0, _0x5766d9 = ''; _0x228da4 = _0x2761c0.charAt(_0x242bbc++); ~_0x228da4 && (_0x3568b6 = _0x1076e1 % 0x4 ? 0x40 * _0x3568b6 + _0x228da4 : _0x228da4, _0x1076e1++ % 0x4) ? _0x5766d9 += String.fromCharCode(0xff & _0x3568b6 >> (-0x2 * _0x1076e1 & 0x6)) : 0x0) _0x228da4 = e.indexOf(_0x228da4);

  71. window.btoa = function (_0x140387) {

  72. e = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";

  73. for (var _0x5a7683, _0x5c4afc, _0x414c71 = String(_0x140387), _0x3a865d = 0x0, _0x388744 = e, _0x171f9b = ''; _0x414c71.charAt(0x0 | _0x3a865d) || (_0x388744 = '=', _0x3a865d % 0x1); _0x171f9b += _0x388744.charAt(0x3f & _0x5a7683 >> 0x8 - _0x3a865d % 0x1 * 0x8)) {

  74. if (_0x5c4afc = _0x414c71.charCodeAt(_0x3a865d += 0.75), _0x5c4afc > 0xff) throw new t("'btoa' failed: The string to be encoded contains characters outside of the Latin1 range.");

  75. _0x5a7683 = _0x5a7683 << 0x8 | _0x5c4afc;

  76. function _0x3acf89(_0x1a61bd) {

  77. function _0x50b4d2(_0x5c1045) {

  78. if (typeof _0x5c1045 === 'string') {

  79. return function (_0xaf1ee8) {}.constructor("while (true) {}").apply("counter");

  80. if (('' + _0x5c1045 / _0x5c1045).length !== 0x1 || _0x5c1045 % 0x14 === 0x0) {

  81. }).constructor('debu' + 'gger').call("action");

  82. }).constructor("debu" + "gger").apply("stateObject");

  83. _0x50b4d2(++_0x5c1045);

特别标注: 本站(CN-SEC.COM)所有文章仅供技术研究,若将其信息做其他用途,由用户承担全部法律及连带责任,本站不承担任何法律及连带责任,请遵守中华人民共和国安全法.
  • 我的微信
  • 微信扫一扫
  • weinxin
  • 我的微信公众号
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2023年1月12日08:27:37
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                  js逆向-ast混淆还原入门案例(1) http://cn-sec.com/archives/1441721.html