特别声明:本文章只作为学术研究,不做其他的用途;如有侵权请联系我删除文章
目录:
一、前言
二、OB混淆
三、某里231平摊流
四、JSVMP还原
五、结言
一、前言
function sn(o, n, r) {
const e = [];
var c;
for (let h = n; h < r; h += 3) {
const n = (o[h] << 16 & 16711680) + (o[h + 1] << 8 & 65280) + (255 & o[h + 2]);
e.push(tn[(c = n) >> 18 & 63] + tn[c >> 12 & 63] + tn[c >> 6 & 63] + tn[63 & c])
}
return e.join("")
}
var tn = ["Z", "m", "s", "e", "r", "b", "B", "o", "H", "Q", "t", "N", "P", "+", "w", "O", "c", "z", "a", "/", "L", "p", "n", "g", "G", "8", "y", "J", "q", "4", "2", "K", "W", "Y", "j", "0", "D", "S", "f", "d", "i", "k", "x", "3", "V", "T", "1", "6", "I", "l", "U", "A", "F", "M", "9", "7", "h", "E", "C", "v", "u", "R", "X", "5"];
function fromByteArray(o) {
const n = o.length, r = n % 3, c = [], h = 16383;
for (let t = 0, s = n - r; t < s; t += h) c.push(sn(o, t, t + h > s ? s : t + h));
if (1 === r) {
const r = o[n - 1];
c.push(tn[r >> 2] + tn[r << 4 & 63] + "==")
} else if (2 === r) {
const r = (o[n - 2] << 8) + o[n - 1];
c.push(tn[r >> 10] + tn[r >> 4 & 63] + tn[r << 2 & 63] + "=")
}
return c.join("")
}
var fingerprint = '{"s0":3,"s1":"","x0":"1","x1":"3.2.0","x2":"Mac OS","x3":"xhs-pc-web","x4":"1.3.7","x5":"18749fc69066pdkb6fdchy4n59467g8zlr7rluk4430000295355","x6":1680578520273,"x7":"Zj1+ZBcCZ2Ok1gs+0YTGOgvCsjTLO25lZ6MG02dUZ2s3","x8":"I38rHdgsjopgIvesdVwgIC+oIELmBZ5e3VwXLgFTIxS3bqwErFeexd0ekncAzMFYnqthIhJeSBMDKutRI3KsYorWHPtGrbV0P9WfIi/eWc6eYqtyQApPI37ekmR1QL+5Ii6sdnosjoT5yqtXqqwYrBqoIx++GDi/sVtkIx0sxuwr4qtiIkrwIi/skcc3ICLfI3Oe0utl20DZsL5eDSJejVw0IieexVwL+Ptorqth+cKexY8oICR1IErSgVwBGqtRIxEaeDdeVuwjIC0s1qtnIkpKIkSzee3sYdc6cU5sYqtzaDdefzq1zd/eWWFtIxNeSqtyIEKefPtMbzh7OoVGIvgeiqtu/YgexjqmIkLwIiDPGamjIvhm+I88IizuBVwlIvGF4eveDS7e1utCIC7sDc==","x9":-1001704518,"x10":82}';
var result = fromByteArray(Buffer.from(fingerprint))
console.log(result)
二、OB混淆
function _0x5a9e(_0x1ad680, _0x7dda1b) {
const _0x44139e = _0x4413();
return _0x5a9e = function(_0x5a9e94, _0xb4c599) {
_0x5a9e94 = _0x5a9e94 - 0xab;
let _0xc68e2e = _0x44139e[_0x5a9e94];
return _0xc68e2e;
}
,
_0x5a9e(_0x1ad680, _0x7dda1b);
}
const _0x5c2a35 = _0x5a9e;
function _0x4413() {
const _0x32e00a = ['62055wvNfBH', '{x22s0x22:3,x22s1x22:x22x22,x22x0x22:x221x22,x22x1x22:x223.2.0x22,x22x2x22:x22Macx20OSx22,x22x3x22:x22xhs-pc-webx22,x22x4x22:x221.3.7x22,x22x5x22:x2218749fc69066pdkb6fdchy4n59467g8zlr7rluk4430000295355x22,x22x6x22:1680578520273,x22x7x22:x22Zj1+ZBcCZ2Ok1gs+0YTGOgvCsjTLO25lZ6MG02dUZ2s3x22,x22x8x22:x22I38rHdgsjopgIvesdVwgIC+oIELmBZ5e3VwXLgFTIxS3bqwErFeexd0ekncAzMFYnqthIhJeSBMDKutRI3KsYorWHPtGrbV0P9WfIi/eWc6eYqtyQApPI37ekmR1QL+5Ii6sdnosjoT5yqtXqqwYrBqoIx++GDi/sVtkIx0sxuwr4qtiIkrwIi/skcc3ICLfI3Oe0utl20DZsL5eDSJejVw0IieexVwL+Ptorqth+cKexY8oICR1IErSgVwBGqtRIxEaeDdeVuwjIC0s1qtnIkpKIkSzee3sYdc6cU5sYqtzaDdefzq1zd/eWWFtIxNeSqtyIEKefPtMbzh7OoVGIvgeiqtu/YgexjqmIkLwIiDPGamjIvhm+I88IizuBVwlIvGF4eveDS7e1utCIC7sDc==x22,x22x9x22:-1001704518,x22x10x22:82}', '377086WIVzZz', '78VFmDHu', '12YzXeKE', 'join', 'log', '525348HpEawo', 'length', '2303741nbXhCu', 'push', '6487584siIHNW', '3915jzmTCj', 'from', '30FANqkL', '146485LiUZHV', '1286lhZfTD'];
_0x4413 = function() {
return _0x32e00a;
}
;
return _0x4413();
}
(function(_0x2cadc6, _0x3fca32) {
const _0x1b1e60 = _0x5a9e
, _0x1949ae = _0x2cadc6();
while (!![]) {
try {
const _0x282a13 = parseInt(_0x1b1e60(0xb6)) / 0x1 + -parseInt(_0x1b1e60(0xb3)) / 0x2 * (-parseInt(_0x1b1e60(0xaf)) / 0x3) + -parseInt(_0x1b1e60(0xb8)) / 0x4 * (parseInt(_0x1b1e60(0xb2)) / 0x5) + parseInt(_0x1b1e60(0xb7)) / 0x6 * (-parseInt(_0x1b1e60(0xb4)) / 0x7) + -parseInt(_0x1b1e60(0xae)) / 0x8 + -parseInt(_0x1b1e60(0xbb)) / 0x9 + parseInt(_0x1b1e60(0xb1)) / 0xa * (parseInt(_0x1b1e60(0xac)) / 0xb);
if (_0x282a13 === _0x3fca32)
break;
else
_0x1949ae['push'](_0x1949ae['shift']());
} catch (_0x2939d8) {
_0x1949ae['push'](_0x1949ae['shift']());
}
}
}(_0x4413, 0xbc7c6));
function sn(_0x34e640, _0x5d2254, _0x24bec7) {
const _0x588002 = _0x5a9e
, _0x653148 = [];
var _0x3b3729;
for (let _0x46cc7a = _0x5d2254; _0x46cc7a < _0x24bec7; _0x46cc7a += 0x3) {
const _0x35f4aa = (_0x34e640[_0x46cc7a] << 0x10 & 0xff0000) + (_0x34e640[_0x46cc7a + 0x1] << 0x8 & 0xff00) + (0xff & _0x34e640[_0x46cc7a + 0x2]);
_0x653148['push'](tn[(_0x3b3729 = _0x35f4aa) >> 0x12 & 0x3f] + tn[_0x3b3729 >> 0xc & 0x3f] + tn[_0x3b3729 >> 0x6 & 0x3f] + tn[0x3f & _0x3b3729]);
}
return _0x653148[_0x588002(0xb9)]('');
}
var tn = ['Z', 'm', 's', 'e', 'r', 'b', 'B', 'o', 'H', 'Q', 't', 'N', 'P', '+', 'w', 'O', 'c', 'z', 'a', '/', 'L', 'p', 'n', 'g', 'G', '8', 'y', 'J', 'q', '4', '2', 'K', 'W', 'Y', 'j', '0', 'D', 'S', 'f', 'd', 'i', 'k', 'x', '3', 'V', 'T', '1', '6', 'I', 'l', 'U', 'A', 'F', 'M', '9', '7', 'h', 'E', 'C', 'v', 'u', 'R', 'X', '5'];
function fromByteArray(_0x1ccbdb) {
const _0x1e77d9 = _0x5a9e
, _0x5d480d = _0x1ccbdb[_0x1e77d9(0xab)]
, _0x54ee6f = _0x5d480d % 0x3
, _0x423c1a = []
, _0x47e230 = 0x3fff;
for (let _0x1441dc = 0x0, _0x386f26 = _0x5d480d - _0x54ee6f; _0x1441dc < _0x386f26; _0x1441dc += _0x47e230)
_0x423c1a[_0x1e77d9(0xad)](sn(_0x1ccbdb, _0x1441dc, _0x1441dc + _0x47e230 > _0x386f26 ? _0x386f26 : _0x1441dc + _0x47e230));
if (0x1 === _0x54ee6f) {
const _0x2e3c2d = _0x1ccbdb[_0x5d480d - 0x1];
_0x423c1a[_0x1e77d9(0xad)](tn[_0x2e3c2d >> 0x2] + tn[_0x2e3c2d << 0x4 & 0x3f] + '==');
} else {
if (0x2 === _0x54ee6f) {
const _0x5ee4bc = (_0x1ccbdb[_0x5d480d - 0x2] << 0x8) + _0x1ccbdb[_0x5d480d - 0x1];
_0x423c1a[_0x1e77d9(0xad)](tn[_0x5ee4bc >> 0xa] + tn[_0x5ee4bc >> 0x4 & 0x3f] + tn[_0x5ee4bc << 0x2 & 0x3f] + '=');
}
}
return _0x423c1a['join']('');
}
var fingerprint = _0x5c2a35(0xb5)
, result = fromByteArray(Buffer[_0x5c2a35(0xb0)](fingerprint));
console[_0x5c2a35(0xba)](result);
gpt这里思考了一大堆,把他推理的过程给说了出来,我暂且跳过,我们直接看结果吧。
// 定义一个包含多种信息的JSON字符串
const fingerprint = '{"s0":3,"s1":"","x0":"1","x1":"3.2.0","x2":"Mac OS","x3":"xhs-pc-web","x4":"1.3.7","x5":"18749fc69066pdkb6fdchy4n59467g8zlr7rluk4430000295355","x6":1680578520273,"x7":"Zj1+ZBcCZ2Ok1gs+0YTGOgvCsjTLO25lZ6MG02dUZ2s3","x8":"I38rHdgsjopgIvesdVwgIC+oIELmBZ5e3VwXLgFTIxS3bqwErFeexd0ekncAzMFYnqthIhJeSBMDKutRI3KsYorWHPtGrbV0P9WfIi/eWc6eYqtyQApPI37ekmR1QL+5Ii6sdnosjoT5yqtXqqwYrBqoIx++GDi/sVtkIx0sxuwr4qtiIkrwIi/skcc3ICLfI3Oe0utl20DZsL5eDSJejVw0IieexVwL+Ptorqth+cKexY8oICR1IErSgVwBGqtRIxEaeDdeVuwjIC0s1qtnIkpKIkSzee3sYdc6cU5sYqtzaDdefzq1zd/eWWFtIxNeSqtyIEKefPtMbzh7OoVGIvgeiqtu/YgexjqmIkLwIiDPGamjIvhm+I88IizuBVwlIvGF4eveDS7e1utCIC7sDc==","x9":-1001704518,"x10":82}';
// 定义自定义的字符集
const tn = ['Z', 'm', 's', 'e', 'r', 'b', 'B', 'o', 'H', 'Q', 't', 'N', 'P', '+', 'w', 'O', 'c', 'z', 'a', '/', 'L', 'p', 'n', 'g', 'G', '8', 'y', 'J', 'q', '4', '2', 'K', 'W', 'Y', 'j', '0', 'D', 'S', 'f', 'd', 'i', 'k', 'x', '3', 'V', 'T', '1', '6', 'I', 'l', 'U', 'A', 'F', 'M', '9', '7', 'h', 'E', 'C', 'v', 'u', 'R', 'X', '5'];
// 自定义的编码函数
function customEncode(byteArray) {
const encoded = [];
const base64Chars = tn;
const padding = byteArray.length % 3;
const fullChunks = byteArray.length - padding;
// 处理完整的3字节块
for (let i = 0; i < fullChunks; i += 3) {
const chunk = (byteArray[i] << 16) | (byteArray[i + 1] << 8) | (byteArray[i + 2]);
encoded.push(
base64Chars[(chunk >> 18) & 0x3F] +
base64Chars[(chunk >> 12) & 0x3F] +
base64Chars[(chunk >> 6) & 0x3F] +
base64Chars[chunk & 0x3F]
);
}
// 处理剩余的1或2字节
if (padding === 1) {
const chunk = byteArray[fullChunks] << 16;
encoded.push(
base64Chars[(chunk >> 18) & 0x3F] +
base64Chars[(chunk >> 12) & 0x3F] +
'=='
);
} else if (padding === 2) {
const chunk = (byteArray[fullChunks] << 16) | (byteArray[fullChunks + 1] << 8);
encoded.push(
base64Chars[(chunk >> 18) & 0x3F] +
base64Chars[(chunk >> 12) & 0x3F] +
base64Chars[(chunk >> 6) & 0x3F] +
'='
);
}
return encoded.join('');
}
// 将 fingerprint 字符串转换为字节数组
const byteArray = Buffer.from(fingerprint, 'utf8');
// 使用自定义编码函数进行编码
const encodedFingerprint = customEncode(byteArray);
// 输出编码结果
console.log(encodedFingerprint);
三、某里231的平摊流
case 4:
void (21 == da ? ia = w < Je["length"] ? 104450 : 135681 : da < 21 ? 10 == da ? ia = (j = E = j) ? 99138 : 111680 : da < 10 ? 4 == da ? (kr = Er, cr = cr["concat"](kr), ia = 43584) : da < 4 ? 1 == da ? ia = (w = 4 == e) ? 140034 : 67585 : da < 1 ? (Ar = ue + kr, kr = je[cr](2), ue = kr[ze](2), kr = gr[cr](2), C = kr[ze](2), kr = ue["split"](re), go = C["split"](re), C = 0, Be = kr[Br], ia = Be ? 18048 : 51776) : 2 == da ? (j = void 0, we = He, je = ne, ne = [], ue = 2, C = (or = er)["slice"](0, ue), or = C[0] << 8, ue = or | C[1], or = ue[bo](), C = or["split"](uo), or = void 0, ue = C, C = 322379711, ia = 112514) : da > 2 && (ia = (se = oe) ? 177664 : 47808) : 7 == da ? (Oe = !Ye, ir = 12, Ur = b instanceof Object, b = A[86], Te = (Pe = Oe * Oe) + (Yr = ir * ir), Pe = Ur * Ur, Yr = (Ae = 23 == Ae) * Ae, ia = 139649) : da < 7 ? 5 == da ? ia = x ? 156993 : 47297 : da > 5 && (Ze = void 0, ia = (Je = fa)[43] ? 71042 : 169153) : 8 == da ? (K = ie = [ee], ia = 704) : da > 8 && (ia = Be < re["length"] ? 165314 : 136833) : 15 == da ? ia = (w = oe) ? 127040 : 168577 : da < 15 ? 12 == da ? ia = (fe = A) ? 146113 : 103296 : da < 12 ? (j = (gr = xe + dr)[ze](0, 8), gr = _r(j, 2), E["push"](gr), ne = Xe = E, gr = void 0, Xe = He, He = er, E = ne, ia = 76353) : 13 == da ? (K = 1, ia = 152192) : da > 13 && (we = !!gr[E = we] << 4, ne |= we, Xe[126] = ne, gr = Tr, Xe = He, ne = "̶̢̩͇̳̩̥͊͑̈́͂͜", we = "", xe = 0, ce = 0, ia = 22336) : 18 == da ? (m[110] = [], ia = 26880) : da < 18 ? 16 == da ? (_r = ze[Ar](p), ia = _r ? 90753 : 177346) : da > 16 && (_r++, ia = 155777) : 19 == da ? (Je = "tc", Je += "e", Je += "Rtneil", Je += "Cg", Je += "nidn", Je += "uoB", Je = (Je += "teg")["split"]("")["reverse"]()["join"](""), qe = no[Je], ia = 172418) : da > 19 && (Y[1] = Z, (O = T[20])[Y[2]] = 1, Ho = void 0, ia = 32834) : 32 == da ? ia = ae < qe["length"] ? 165057 : 112129 : da < 32 ? 26 == da ? (dr = we[oe], re = dr[Br](ke, or), Ae = (Te = (Oe = ze === Ve) + (Yr = 11 >= Yr)) * Te, dr = void 0, je = re, Pe = 3 * (Ur = Oe * Yr), ia = 119298) : da < 26 ? 23 == da ? (Ze = "i", Ze += "sT", Ze += "r", Ze += "uste", qe = !1 === We[Ze += "d"], ia = qe ? 58817 : 70786) : da < 23 ? (se = "ta", se += "ob", se += "ao.", se += "co", se += "m", O = _[P](se), ia = O ? 176512 : 82626) : 24 == da ? (l++, ia = 116864) : da > 24 && (N++, ia = 120002) : 29 == da ? (Ne = Sr[lo], ne = "s", ne += "pec", ne += "ie", ne += "s", xr = Ne[Zr](ne), ia = 65728) : da < 29 ? 27 == da ? (oe = De[ye], Ee = oe[sr], oe = Ee[Mo](), Ee = oe["indexOf"](Dr), se = -1 !== Ee, ia = 22658) : da > 27 && (be = 128 + (N = k % 128), ie = (N = 63 & (ee = (te = k - N) / 128)) + (ee = 64 * K), (te = [])["push"](be, ie), u = te, ia = 99522) : 30 == da ? (Cr = ro[82], mr = Cr["length"], ia = (Cr = mr > 1024) ? 108032 : 62016) : da > 30 && (A++, ia = 120130) : 38 == da ? (M = 0, ia = (m = p) ? 129665 : 108610) : da < 38 ? 35 == da ? (Rr = 128 + (ur = je % 128), ur = 127 & (A = (Ge = je - ur) / 128), (Ge = [])["push"](Rr, ur), ue = Ge, ia = 172994) : da < 35 ? 33 == da ? (he = 949 ^ qe["charCodeAt"](de), Je += String["fromCharCode"](he), ia = 1664) : da > 33 && (ia = 129409) : 36 == da ? (fe = void 0, ia = (l = (p = 0 | (l = Er)) < 128) ? 157825 : 41153) : da > 36 && (mr = 1, ia = 153088) : 41 == da ? (Xe += 4, ia = 166144) : da < 41 ? 39 == da ? (ir = (Oe = yo !== k) * Oe, Ae = !Bo, ce = 1 === we[126], ia = (Yr = ir >= (Ur = (Pe = Oe * Ae) - (Ae *= Ae))) ? 35264 : 26626) : da > 39 && (ro = 0 | Cr[84], Cr[84] = ro + 1, ia = 90688) : 42 == da ? (f = A[110], C = f["length"], (f = A[110])[C] = x, ia = 164736) : da > 42 && (ia = Tr ? 90561 : 12482));
break;
case 5:
void (21 == da ? (Me = Re["split"](P), Ie = 2 != Me["length"], ia = Ie ? 168576 : 54657) : da < 21 ? 10 == da ? (cr = void 0, _r = 0, ia = 17) : da < 10 ? 4 == da ? (f = 0, Oe = (ir = (Ae = Ae <= 14) * Ae) > -133, C = k["push"](1, f), ia = Oe ? 54401 : 63681) : da < 4 ? 1 == da ? (re = 8 === ce, ia = 151746) : da < 1 ? (Ze = "ϵϷϭϫϽϼϷϯ϶", qe = "", Je = 0, ia = 63362) : 2 == da ? (or = xe["charCodeAt"](ze) - 957, Oe = (Oe = (ir = ir <= 18) * ir) > (Ur = (Te = 1 | (ir = tr === ko)) << 31), ce += String["fromCharCode"](or), ia = Oe ? 20736 : 5056) : da > 2 && (qe = "", ia = 71298) : 7 == da ? (k++, ia = 70784) : da < 7 ? 5 == da ? ia = (Xe = He) ? 94210 : 127681 : da > 5 && (ia = me ? 61504 : 20992) : 8 == da ? (j = p = [255], ia = 139776) : da > 8 && (ia = rr < E["length"] ? 161921 : 113025) : 15 == da ? ia = (rr = j) ? 113344 : 148738 : da < 15 ? 12 == da ? (ir = (Ae = (Ur <<= 18) * Ur) > -9, k = b[m], p["push"](k), b = cr[x](35632, 36338), k = b[f], p["push"](k), b = cr[x](35632, 36337), k = b[u], ia = 172864) : da < 12 ? (A = re[76], ia = A ? 78528 : 69824) : 13 == da ? ia = (yr = f < 0) ? 51329 : 99905 : da > 13 && (ie = 9, _e = 1, ia = 33985) : 18 == da ? (u = A[110], C = u["length"], (u = A[110])[C] = x, ia = 10752) : da < 18 ? 16 == da ? (C["push"](A
, u["length"]), C = C["concat"](u), ia = 83970) : da > 16 && (ia = xo < 3 ? 63361 : 45505) : 19 == da ? (m = b, b = void 0, ia = (u = (k = 0 | (u = m)) < 128) ? 174529 : 25601) : da > 19 && (Q = Z, z["push"](1334, 3308430160856, 2, 1), B(36, 2, -1), Z = z["pop"](), pe = Z, ia = Q ? 80449 : 58688) : 32 == da ? (Ce[pe] = le, pe = "de", le = "͛̾̓ͤ̑ͼ̶̳͓̫̩͒͛͌̿͌́ͮ̃͟͢", Fe = "", ve = 0, Me = 0, ia = 58433) : da < 32 ? 26 == da ? ia = (Yr = (Ae = Oe * (Yr += Ae = Pe * Pe)) >= (Oe = (Te = (Yr = ir * Ur) + (Oe = Te * Pe)) * Te)) ? 117184 : 74114 : da < 26 ? 23 == da ? (N = A, te = 1, ia = 26560) : da < 23 ? ia = l < A["length"] ? 94978 : 99969 : 24 == da ? (dr = or[Ne], ia = 25089) : da > 24 && (u = 255 & p, p = 255 & l, M["push"](b, m, u, p), j = M = A = M, ia = 154240) : 29 == da ? (ce = xe[69], ia = 96001) : da < 29 ? 27 == da ? ia = m < p["length"] ? 152320 : 73729 : da > 27 && (qr = 0 === Nr, ia = (Yr = (ir = (Ur ^= 13) * Ur) >= (Oe = (Ur *= Te = Te > 31) - (Oe = Te * Te))) ? 17985 : 51009) : 30 == da ? (_++, ia = 168192) : da > 30 && (m = -1, ia = 120641) : 38 == da ? (Q = "q", Q += "uo", Q += "t", Q += "a", T[11] = Z[Q], Q = (Q = "egasu")["split"]("")["reverse"]()["join"](""), T[5] = Z[Q], ia = 169536) : da < 38 ? 35 == da ? (f = void 0, ia = (K = (Se = 0 | (K = u)) < 128) ? 157824 : 62272) : da < 35 ? 33 == da ? ia = 95297 : da > 33 && (Ne = !0, ia = (gr = He = Dr) ? 176385 : 35328) : 36 == da ? (Ae = (Ur = (Te = !f) * Te) >= (Ae = (ir = 2 * (Ae = Te * (Oe = 12 <= Oe))) - (Ae = Oe * Oe)), Br = wr[0], ia = Ae ? 168706 : 115200) : da > 36 && (ia = re ? 38337 : 17089) : 41 == da ? (T = void 0, ia = 50753) : da < 41 ? 39 == da ? (m = Le["indexOf"](_e), be = m, ia = 83009) : da > 39 && (M = 758, ia = 156290) : 42 == da ? ia = l ? 87169 : 31041 : da > 42 && (p["push"](u), b = cr[x](35632, 36339), m = b[f], p["push"](m), ia = 123393));
break;
case 6:
void (21 == da ? (We++, ia = 137154) : da < 21 ? 10 == da ? (_++, ia = 20800) : da < 10 ? 4 == da ? (De = w[ge], ge = "hxitwwOtk", oe = "", se = 0, ia = 6208) : da < 4 ? 1 == da ? (ne["push"](0), ia = 95362) : da < 1 ? ia = Ye < mr["length"] ? 136450 : 31 : 2 == da ? ia = N ? 41216 : 149953 : da > 2 && (m++, ia = 74496) : 7 == da ? (se = 4, ia = 141312) : da < 7 ? 5 == da ? (C = f, f = m["length"], ia = (K = x) ? 152192 : 53505) : da > 5 && (fe = 0, ia = 111426) : 8 == da ? (C = 1, ia = 94209) : da > 8 && (te = 9, ee = 1, ia = 136704) : 15 == da ? ia = T ? 37 : 72002 : da < 15 ? 12 == da ? (A = C, k = k["concat"](A), C = void 0, A = p, x = "ˈˁʷʸʹʼˁʸʷ", m = "", f = 0, ia = 22273) : da < 12 ? (ye = _, Ur = (Ae = 28 == Ae) * Ae, Yr = 2 * (Pe = Ae * (Oe = Ue !== Jr)), Pe = Oe * Oe, z["push"](2479, 3004675319692, 2, 2), Ae = Ur >= (Yr -= Pe), ia = 131392) : 13 == da ? (w = 378, ia = 30722) : da > 13 && (ke = A[93], C = ke, ke = void 0, f = C, ia = (A = p)[110] ? 51392 : 143936) : 18 == da ? (l = A[24], Yr = 19 == Yr, ia = (ir = (Yr *= Yr) > -221) ? 12738 : 137473) : da < 18 ? 16 == da ? (be = 10, ia = 123970) : da > 16 && (ce = 1, ia = 66) : 19 == da ? (b = 0, ia = 78145) : da > 19 && (ie = 499 ^ Se["charCodeAt"](ee), te += String["fromCharCode"](ie), ia = 25856) : 32 == da ? (pr = b["indexOf"](p), fe = pr, ia = 136065) : da < 32 ? 26 == da ? (ae++, ia = 86145) : da < 26 ? 23 == da ? ia = ee < Se["length"] ? 82305 : 69697 : da < 23 ? (m = C, k = k["concat"](m), z["push"](21, 1066685897689, 563239542, 3, 2), B(36, 2, -1), C = z["pop"](), m = C, C = window[m], ia = C ? 38528 : 16705) : 24 == da ? (re = _r, cr = cr["concat"](re), re = xe[39], _r = void 0, Ar = re, re = (wr = xe)[35], Er = void 0, Qr = 0, kr = Ar, C = re, ia = 174082) : da > 24 && (se = void 0, mo = void 0, Dr = d, Sr = s, Tr = t, vo = r, fo = "at", fo += "tach", fo += "Eve", Ne = fo += "nt", ia = 38145) : 29 == da ? ia = (re = j) ? 86720 : 46912 : da < 29 ? 27 == da ? (ge = 183, ia = 164290) : da > 27 && (j = C = [256 - (ue *= 3)], ia = 148545) : 30 == da ? (_++, ia = 33536) : da > 30 && (ia = (oe = De) ? 75009 : 27264) : 38 == da ? (xe = Er = Ar, ia = 70722) : da < 38 ? 35 == da ? (E = void 0, j = gr, xe = Xe, Xe = [], ce = xe[14], ia = ce ? 86657 : 95234) : da < 35 ? 33 == da ? (A = (A = "elbisiv")["split"]("")["reverse"]()["join"](""), ia = (p = l === A) ? 107392 : 43329) : da > 33 && (ia = (Oe = (Te *= Yr = Pe + Yr) >= (Pe = (Oe = (Yr = Oe * Ur) + (Pe = ir * Ae)) * Oe)) ? 156418 : 116034) : 36 == da ? (ne["push"](1), ne = ne["concat"](E), ia = 59072) : da > 36 && (ia = (j = E) ? 42050 : 125632) : 41 == da ? (xr = He["charCodeAt"](Zr), ne = xr ^ Xe, Xe = xr, gr += String["fromCharCode"](ne), ia = 149888) : da < 41 ? 39 == da ? (p = 255 & l, A["push"](p), ia = 128386) : da > 39 && (yr = 10, ia = 87490) : 42 == da ? (ne["push"](1), ne = ne["concat"](C), ia = 12994) : da > 42 && (ia = k < f["length"] ? 38466 : 5697));
break;
四、JSVMP
五、结言
既然已经看到了这里,不妨留个关注吧
原文始发于微信公众号(逆向与爬虫的故事):逆向百例之基于chatgpt还原vmp
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论