js反混淆,没解出,大神烦请指点一下

Question

最近在研究一号.店的登录,想搞清楚Token是怎么计算的,进行跟踪后发现是记录鼠标等行为进行动态加密的,我找到了加密文件https://captcha.yhd.com/captcha/js/captcha.js?20161102

但是代码经过了混淆,就是这样子的

看了一下是把一些函数参数弄到数组里面再进行组合,于是我写了替换器进行代码还原,还原之后看起来好像是还原成功了,但仔细发现还是存在很多问题,比如我不能判断数组里面的哪些是字符串,哪些是变量,也就是不知道哪个数组替换后要加 双引号 (字符串) ,哪些不用(变量)

网上找了很多没找到可用的解混淆器,大大们有什么好的方法可以用呢

Answer 1

我用的是这个工具 http://www.danstools.com/java...

选中Unescape printable chars encoded as \xNN or \uNNNN?

结果:

var _$_53a7 = ["object", "0", "valueOf", "toJSON", "prototype", "function", "getUTCFullYear", "-", "getUTCMonth", "getUTCDate", "T", "getUTCHours", ":", "getUTCMinutes", "getUTCSeconds", "Z", "lastIndex", "test", "\"", "string", "\\u", "slice", "0000", "toString", "charCodeAt", "replace", "call", "null", "number", "boolean", "apply", "[object Array]", "length", "[]", "[\x0A", ",\x0A", "join", "\x0A", "]", "[", ",", ": ", "push", "hasOwnProperty", "{}", "{\x0A", "}", "{", "stringify", "\\b", "\\t", "\\n", "\\f", "\\r", "\\\"", "\\\\", "", " ", "JSON.stringify", "parse", "@", "(", ")", "JSON.parse", "lib", "Base", "mixIn", "init", "$super", "extend", "WordArray", "words", "sigBytes", "clamp", "ceil", "clone", "random", "enc", "Hex", "substr", "Latin1", "fromCharCode", "Utf8", "Malformed UTF-8 data", "BufferedBlockAlgorithm", "_data", "_nDataBytes", "concat", "blockSize", "_minBufferSize", "max", "min", "_doProcessBlock", "splice", "Hasher", "cfg", "reset", "_doReset", "_append", "_process", "_doFinalize", "finalize", "HMAC", "algo", "Base64", "_map", "charAt", "indexOf", "create", "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=", "sin", "abs", "MD5", "_hash", "floor", "_createHelper", "HmacMD5", "_createHmacHelper", "EvpKDF", "hasher", "keySize", "iterations", "update", "compute", "Cipher", "_ENC_XFORM_MODE", "_DEC_XFORM_MODE", "_xformMode", "_key", "encrypt", "decrypt", "StreamCipher", "mode", "_iv", "_prevBlock", "BlockCipherMode", "Encryptor", "Decryptor", "_cipher", "encryptBlock", "decryptBlock", "CBC", "Pkcs7", "pad", "BlockCipher", "iv", "createEncryptor", "createDecryptor", "_mode", "processBlock", "padding", "unpad", "CipherParams", "formatter", "OpenSSL", "format", "ciphertext", "salt", "SerializableCipher", "_parse", "kdf", "PasswordBasedCipher", "ivSize", "execute", "key", "AES", "_nRounds", "_keySchedule", "_invKeySchedule", "_doCryptBlock", "_lBlock", "_rBlock", "DES", "_subKeys", "_invSubKeys", "TripleDES", "_des1", "_des2", "_des3", "ECB", "document", "1.2.0", "captcha.yhd.com", "host", "location", ".samsclub.cn", "security.samsclub.cn", ".yihaodian.com.hk", "captcha.yihaodian.com.hk", "https:", "protocol", "https://", "http://", "/security/public/", "/public/", "undefined", "split", "f", "520f14f9f19f8f0", "518f7f17f16f15f12f7f16f17", "509f-3f9f11f-8f3f-3f-2", "505f-10f3f2", "522f17f21f75f22f10f12", "516f18f6f0f16f7f-2f17f69f16f5", "506f-5f5f4f-15f26f3", "ABCDEFGHIJKLMNOPQRSTUVWXYZ", "generateFpCheckCode", "a", "z", "9", "/captcha/js/fl.swf", "options", "nativeForEach", "forEach", "nativeMap", "map", "fpObject", "userAgentKey", "languageKey", "colorDepthKey", "screenResolutionKey", "timezoneOffsetKey", "sessionStorageKey", "localStorageKey", "indexedDbKey", "addBehaviorKey", "openDatabaseKey", "cpuClassKey", "platformKey", "doNotTrackKey", "pluginsKey", "canvasKey", "webglKey", "~~~", "x64hash128", "fgp", "cc", "fontsKey", "excludeUserAgent", "userAgent", "excludeLanguage", "language", "excludeColorDepth", "colorDepth", "excludeScreenResolution", "getScreenResolution", "x", "detectScreenOrientation", "height", "width", "excludeTimezoneOffset", "getTimezoneOffset", "excludeSessionStorage", "hasSessionStorage", "hasLocalStorage", "excludeIndexedDB", "hasIndexedDB", "body", "excludeAddBehavior", "addBehavior", "excludeOpenDatabase", "openDatabase", "excludeCpuClass", "getNavigatorCpuClass", "excludePlatform", "getNavigatorPlatform", "excludeDoNotTrack", "getDoNotTrack", "excludeCanvas", "isCanvasSupported", "getCanvasFp", "excludeWebGL", "getWebglFp", "excludeFlashFonts", "excludeJsFonts", "jsFontsKey", "hasSwfObjectLoaded", "hasMinFlashInstalled", "swfPath", "flashFontsKey", ";", "loadSwfAndDetectFonts", "monospace", "sans-serif", "serif", "mmmmmmmmmmlli", "72px", "getElementsByTagName", "span", "createElement", "visibility", "style", "hidden", "fontSize", "color", "#FFFFFF", "innerHTML", "fontFamily", "appendChild", "offsetWidth", "offsetHeight", "removeChild", "Abadi MT Condensed Light", "Academy Engraved LET", "ADOBE CASLON PRO", "Adobe Garamond", "ADOBE GARAMOND PRO", "Agency FB", "Aharoni", "Albertus Extra Bold", "Albertus Medium", "Algerian", "Amazone BT", "American Typewriter", "American Typewriter Condensed", "AmerType Md BT", "Andale Mono", "Andalus", "Angsana New", "AngsanaUPC", "Antique Olive", "Aparajita", "Apple Chancery", "Apple Color Emoji", "Apple SD Gothic Neo", "Arabic Typesetting", "ARCHER", "Arial", "Arial Black", "Arial Hebrew", "Arial MT", "Arial Narrow", "Arial Rounded MT Bold", "Arial Unicode MS", "ARNO PRO", "Arrus BT", "Aurora Cn BT", "AvantGarde Bk BT", "AvantGarde Md BT", "AVENIR", "Ayuthaya", "Bandy", "Bangla Sangam MN", "Bank Gothic", "BankGothic Md BT", "Baskerville", "Baskerville Old Face", "Batang", "BatangChe", "Bauer Bodoni", "Bauhaus 93", "Bazooka", "Bell MT", "Bembo", "Benguiat Bk BT", "Berlin Sans FB", "Berlin Sans FB Demi", "Bernard MT Condensed", "BernhardFashion BT", "BernhardMod BT", "Big Caslon", "BinnerD", "Bitstream Vera Sans Mono", "Blackadder ITC", "BlairMdITC TT", "Bodoni 72", "Bodoni 72 Oldstyle", "Bodoni 72 Smallcaps", "Bodoni MT", "Bodoni MT Black", "Bodoni MT Condensed", "Bodoni MT Poster Compressed", "Book Antiqua", "Bookman Old Style", "Bookshelf Symbol 7", "Boulder", "Bradley Hand", "Bradley Hand ITC", "Bremen Bd BT", "Britannic Bold", "Broadway", "Browallia New", "BrowalliaUPC", "Brush Script MT", "Calibri", "Californian FB", "Calisto MT", "Calligrapher", "Cambria", "Cambria Math", "Candara", "CaslonOpnface BT", "Castellar", "Centaur", "Century", "Century Gothic", "Century Schoolbook", "Cezanne", "CG Omega", "CG Times", "Chalkboard", "Chalkboard SE", "Chalkduster", "Charlesworth", "Charter Bd BT", "Charter BT", "Chaucer", "ChelthmITC Bk BT", "Chiller", "Clarendon", "Clarendon Condensed", "CloisterBlack BT", "Cochin", "Colonna MT", "Comic Sans", "Comic Sans MS", "Consolas", "Constantia", "Cooper Black", "Copperplate", "Copperplate Gothic", "Copperplate Gothic Bold", "Copperplate Gothic Light", "CopperplGoth Bd BT", "Corbel", "Cordia New", "CordiaUPC", "Cornerstone", "Coronet", "Courier", "Courier New", "Cuckoo", "Curlz MT", "DaunPenh", "Dauphin", "David", "DB LCD Temp", "DELICIOUS", "Denmark", "Devanagari Sangam MN", "DFKai-SB", "Didot", "DilleniaUPC", "DIN", "DokChampa", "Dotum", "DotumChe", "Ebrima", "Edwardian Script ITC", "Elephant", "English 111 Vivace BT", "Engravers MT", "EngraversGothic BT", "Eras Bold ITC", "Eras Demi ITC", "Eras Light ITC", "Eras Medium ITC", "Estrangelo Edessa", "EucrosiaUPC", "Euphemia", "Euphemia UCAS", "EUROSTILE", "Exotc350 Bd BT", "FangSong", "Felix Titling", "Fixedsys", "FONTIN", "Footlight MT Light", "Forte", "Franklin Gothic", "Franklin Gothic Book", "Franklin Gothic Demi", "Franklin Gothic Demi Cond", "Franklin Gothic Heavy", "Franklin Gothic Medium", "Franklin Gothic Medium Cond", "FrankRuehl", "Fransiscan", "Freefrm721 Blk BT", "FreesiaUPC", "Freestyle Script", "French Script MT", "FrnkGothITC Bk BT", "Fruitger", "FRUTIGER", "Futura", "Futura Bk BT", "Futura Lt BT", "Futura Md BT", "Futura ZBlk BT", "FuturaBlack BT", "Gabriola", "Galliard BT", "Garamond", "Gautami", "Geeza Pro", "Geneva", "Geometr231 BT", "Geometr231 Hv BT", "Geometr231 Lt BT", "Georgia", "GeoSlab 703 Lt BT", "GeoSlab 703 XBd BT", "Gigi", "Gill Sans", "Gill Sans MT", "Gill Sans MT Condensed", "Gill Sans MT Ext Condensed Bold", "Gill Sans Ultra Bold", "Gill Sans Ultra Bold Condensed", "Gisha", "Gloucester MT Extra Condensed", "GOTHAM", "GOTHAM BOLD", "Goudy Old Style", "Goudy Stout", "GoudyHandtooled BT", "GoudyOLSt BT", "Gujarati Sangam MN", "Gulim", "GulimChe", "Gungsuh", "GungsuhChe", "Gurmukhi MN", "Haettenschweiler", "Harlow Solid Italic", "Harrington", "Heather", "Heiti SC", "Heiti TC", "HELV", "Helvetica", "Helvetica Neue", "Herald", "High Tower Text", "Hiragino Kaku Gothic ProN", "Hiragino Mincho ProN", "Hoefler Text", "Humanst 521 Cn BT", "Humanst521 BT", "Humanst521 Lt BT", "Impact", "Imprint MT Shadow", "Incised901 Bd BT", "Incised901 BT", "Incised901 Lt BT", "INCONSOLATA", "Informal Roman", "Informal011 BT", "INTERSTATE", "IrisUPC", "Iskoola Pota", "JasmineUPC", "Jazz LET", "Jenson", "Jester", "Jokerman", "Juice ITC", "Kabel Bk BT", "Kabel Ult BT", "Kailasa", "KaiTi", "Kalinga", "Kannada Sangam MN", "Kartika", "Kaufmann Bd BT", "Kaufmann BT", "Khmer UI", "KodchiangUPC", "Kokila", "Korinna BT", "Kristen ITC", "Krungthep", "Kunstler Script", "Lao UI", "Latha", "Leelawadee", "Letter Gothic", "Levenim MT", "LilyUPC", "Lithograph", "Lithograph Light", "Long Island", "Lucida Bright", "Lucida Calligraphy", "Lucida Console", "Lucida Fax", "LUCIDA GRANDE", "Lucida Handwriting", "Lucida Sans", "Lucida Sans Typewriter", "Lucida Sans Unicode", "Lydian BT", "Magneto", "Maiandra GD", "Malayalam Sangam MN", "Malgun Gothic", "Mangal", "Marigold", "Marion", "Marker Felt", "Market", "Marlett", "Matisse ITC", "Matura MT Script Capitals", "Meiryo", "Meiryo UI", "Microsoft Himalaya", "Microsoft JhengHei", "Microsoft New Tai Lue", "Microsoft PhagsPa", "Microsoft Sans Serif", "Microsoft Tai Le", "Microsoft Uighur", "Microsoft YaHei", "Microsoft Yi Baiti", "MingLiU", "MingLiU_HKSCS", "MingLiU_HKSCS-ExtB", "MingLiU-ExtB", "Minion", "Minion Pro", "Miriam", "Miriam Fixed", "Mistral", "Modern", "Modern No. 20", "Mona Lisa Solid ITC TT", "Monaco", "Mongolian Baiti", "MONO", "Monotype Corsiva", "MoolBoran", "Mrs Eaves", "MS Gothic", "MS LineDraw", "MS Mincho", "MS Outlook", "MS PGothic", "MS PMincho", "MS Reference Sans Serif", "MS Reference Specialty", "MS Sans Serif", "MS Serif", "MS UI Gothic", "MT Extra", "MUSEO", "MV Boli", "MYRIAD", "MYRIAD PRO", "Nadeem", "Narkisim", "NEVIS", "News Gothic", "News GothicMT", "NewsGoth BT", "Niagara Engraved", "Niagara Solid", "Noteworthy", "NSimSun", "Nyala", "OCR A Extended", "Old Century", "Old English Text MT", "Onyx", "Onyx BT", "OPTIMA", "Oriya Sangam MN", "OSAKA", "OzHandicraft BT", "Palace Script MT", "Palatino", "Palatino Linotype", "Papyrus", "Parchment", "Party LET", "Pegasus", "Perpetua", "Perpetua Titling MT", "PetitaBold", "Pickwick", "Plantagenet Cherokee", "Playbill", "PMingLiU", "PMingLiU-ExtB", "Poor Richard", "Poster", "PosterBodoni BT", "PRINCETOWN LET", "Pristina", "PTBarnum BT", "Pythagoras", "Raavi", "Rage Italic", "Ravie", "Ribbon131 Bd BT", "Rockwell", "Rockwell Condensed", "Rockwell Extra Bold", "Rod", "Roman", "Sakkal Majalla", "Santa Fe LET", "Savoye LET", "Sceptre", "Script", "Script MT Bold", "SCRIPTINA", "Segoe Print", "Segoe Script", "Segoe UI", "Segoe UI Light", "Segoe UI Semibold", "Segoe UI Symbol", "Serifa", "Serifa BT", "Serifa Th BT", "ShelleyVolante BT", "Sherwood", "Shonar Bangla", "Showcard Gothic", "Shruti", "Signboard", "SILKSCREEN", "SimHei", "Simplified Arabic", "Simplified Arabic Fixed", "SimSun", "SimSun-ExtB", "Sinhala Sangam MN", "Sketch Rockwell", "Skia", "Small Fonts", "Snap ITC", "Snell Roundhand", "Socket", "Souvenir Lt BT", "Staccato222 BT", "Steamer", "Stencil", "Storybook", "Subway", "Swis721 BlkEx BT", "Swiss911 XCm BT", "Sylfaen", "Symbol", "Synchro LET", "System", "Tahoma", "Tamil Sangam MN", "Technical", "Teletype", "Telugu Sangam MN", "Tempus Sans ITC", "Terminal", "Thonburi", "Times", "Times New Roman", "Times New Roman PS", "Traditional Arabic", "Trajan", "TRAJAN PRO", "Trebuchet MS", "Tristan", "Tubular", "Tunga", "Tw Cen MT", "Tw Cen MT Condensed", "Tw Cen MT Condensed Extra Bold", "TypoUpright BT", "Unicorn", "Univers", "Univers CE 55 Medium", "Univers Condensed", "Utsaah", "Vagabond", "Vani", "Verdana", "Vijaya", "Viner Hand ITC", "VisualUI", "Vivaldi", "Vladimir Script", "Vrinda", "Westminster", "WHITNEY", "Wide Latin", "Wingdings", "Wingdings 2", "Wingdings 3", "ZapfEllipt BT", "ZapfHumnst BT", "ZapfHumnst Dm BT", "Zapfino", "Zurich BlkEx BT", "Zurich Ex BT", "ZWAdobeF", "仿宋", "华文中宋", "华文仿宋", "华文宋体", "华文彩云", "华文新魏", "华文楷体", "华文琥珀", "华文细黑", "华文行楷", "华文隶书", "宋体", "幼圆", "微软雅黑", "新宋体", "方正兰亭超细黑简体", "方正姚体", "方正舒体", "楷体", "隶书", "黑体", "isIE", "getIEPluginsString", "getRegularPluginsString", "plugins", "~", "type", "suffixes", "::", "name", "description", "ActiveXObject", "AcroPDF.PDF", "Adodb.Stream", "DevalVRXCtrl.DevalVRXCtrl.1", "MacromediaFlashPaper.MacromediaFlashPaper", "Msxml2.DOMDocument", "Msxml2.XMLHTTP", "PDF.PdfCtrl", "QuickTime.QuickTime", "QuickTimeCheckObject.QuickTimeCheck.1", "RealPlayer", "RealPlayer.RealPlayer(tm) ActiveX Control (32-bit)", "RealVideo.RealVideo(tm) ActiveX Control (32-bit)", "Scripting.Dictionary", "SWCtl.SWCtl", "Shell.UIHelper", "ShockwaveFlash.ShockwaveFlash", "Skype.Detection", "TDCCtl.TDCCtl", "WMPlayer.OCX", "rmocx.RealPlayer G2 Control", "rmocx.RealPlayer G2 Control.1", "sessionStorage", "localStorage", "indexedDB", "cpuClass", "navigatorCpuClass: ", "navigatorCpuClass: unknown", "platform", "navigatorPlatform: ", "navigatorPlatform: unknown", "doNotTrack", "doNotTrack: ", "doNotTrack: unknown", "canvas", "2d", "getContext", "Cwm fjordbank glyphs vext quiz, https://github.com/valve", "textBaseline", "top", "font", "70px \'Arial\'", "alphabetic", "fillStyle", "#f60", "fillRect", "#069", "fillText", "rgba(102, 204, 0, 0.7)", "toDataURL", "clearColor", "DEPTH_TEST", "enable", "LEQUAL", "depthFunc", "COLOR_BUFFER_BIT", "DEPTH_BUFFER_BIT", "clear", ", ", "EXT_texture_filter_anisotropic", "getExtension", "WEBKIT_EXT_texture_filter_anisotropic", "MOZ_EXT_texture_filter_anisotropic", "MAX_TEXTURE_MAX_ANISOTROPY_EXT", "getParameter", "getWebglCanvas", "attribute vec2 attrVertex;varying vec2 varyinTexCoordinate;uniform vec2 uniformOffset;void main(){varyinTexCoordinate=attrVertex+uniformOffset;gl_Position=vec4(attrVertex,0,1);}", "precision mediump float;varying vec2 varyinTexCoordinate;void main() {gl_FragColor=vec4(varyinTexCoordinate,0,1);}", "createBuffer", "ARRAY_BUFFER", "bindBuffer", "STATIC_DRAW", "bufferData", "numItems", "createProgram", "VERTEX_SHADER", "createShader", "shaderSource", "compileShader", "FRAGMENT_SHADER", "attachShader", "linkProgram", "useProgram", "vertexPosAttrib", "attrVertex", "getAttribLocation", "offsetUniform", "uniformOffset", "getUniformLocation", "vertexPosArray", "enableVertexAttribArray", "FLOAT", "vertexAttribPointer", "uniform2f", "TRIANGLE_STRIP", "drawArrays", "extensions:", "getSupportedExtensions", "webgl aliased line width range:", "ALIASED_LINE_WIDTH_RANGE", "webgl aliased point size range:", "ALIASED_POINT_SIZE_RANGE", "webgl alpha bits:", "ALPHA_BITS", "webgl antialiasing:", "antialias", "getContextAttributes", "yes", "no", "webgl blue bits:", "BLUE_BITS", "webgl depth bits:", "DEPTH_BITS", "webgl green bits:", "GREEN_BITS", "webgl max anisotropy:", "webgl max combined texture image units:", "MAX_COMBINED_TEXTURE_IMAGE_UNITS", "webgl max cube map texture size:", "MAX_CUBE_MAP_TEXTURE_SIZE", "webgl max fragment uniform vectors:", "MAX_FRAGMENT_UNIFORM_VECTORS", "webgl max render buffer size:", "MAX_RENDERBUFFER_SIZE", "webgl max texture image units:", "MAX_TEXTURE_IMAGE_UNITS", "webgl max texture size:", "MAX_TEXTURE_SIZE", "webgl max varying vectors:", "MAX_VARYING_VECTORS", "webgl max vertex attribs:", "MAX_VERTEX_ATTRIBS", "webgl max vertex texture image units:", "MAX_VERTEX_TEXTURE_IMAGE_UNITS", "webgl max vertex uniform vectors:", "MAX_VERTEX_UNIFORM_VECTORS", "webgl max viewport dims:", "MAX_VIEWPORT_DIMS", "webgl red bits:", "RED_BITS", "webgl renderer:", "RENDERER", "webgl shading language version:", "SHADING_LANGUAGE_VERSION", "webgl stencil bits:", "STENCIL_BITS", "webgl vendor:", "VENDOR", "webgl version:", "VERSION", "\xA7", "appName", "Microsoft Internet Explorer", "Netscape", "swfobject", "9.0.0", "hasFlashPlayerVersion", "div", "id", "__yct_swfContainerId__", "setAttribute", "___fp_swf_loaded", "addFlashDivNode", "always", "false", "1", "embedSWF", "webgl", "experimental-webgl", "each", "x64Xor", "x64Multiply", "x64Rotl", "x64Add", "x64LeftShift", "x64Fmix", "00000000", "abcdefghijklmnopqrstuvwxyz", "version:", "version", "Number: ", "Description: ", "message", "lineNumber", "lineNumber: ", "stack", "stack: ", "src", "jserror.do?error=", "&random=", "|", "12|3|4|5|6|7|8|9|0|a|b|c|d|e|f", "ds1", "ds2", "ds", "__yct_container__", "getElementById", "script", "getenv.do?f=", "&callback=captchaCallback&t=", "k", "t", "m", "o", "fp", "h", "kdc", "mdc", "mpt", "mp", "dsr", "0123456789", "+/", "get", "addEventListener", "on", "attachEvent", "mousemove", "mousedown", "keydown", "touchmove", "touchstart", "touchend", "event", "shift", "pageX", "pageY", "clientX", "clientY", "documentElement", "scrollLeft", "clientLeft", "scrollTop", "clientTop", "touches", "__yct_str__", "value", "display", "none", "input", "js_version"];
if (typeof JSON !== _$_53a7[0]) {
    JSON = {}
...(太长了,其他的自己去试试吧)

Answer 2

不用那么复杂。
直接copy一下丢控制台一执行就全出来了，这么混淆只是用来混淆你我程序员的，从来混淆不了机器。
我的截图传不上来。2333

用百度当图床，不知道能管多久

---

帮你写了段nodejs的脚本，你把那个captcha.js存下来，跑一下这个就搞定了。

const fs = require('fs');

fs.readFile('./captcha.js', (err, str) => {
  if (err) return console.log(err, str);
  str = str.toString();
  let index = str.indexOf(';');

  let reg = /\_\$\_53a7\[(\d*)\]/gi;

  eval(str.slice(0, index));

  _$_53a7 = _$_53a7.map(v => {
    return v.replace('\n', '');
  });

  let jsStr = str.slice(index + 1).replace(reg, (a, b) => {
    return `\`${_$_53a7[~~b].replace(/\\/g, '\\\\')}\``;
  });

  fs.writeFile('./test.js', jsStr, (err, data) => {
    if (err) console.log(err, data);
    console.log('保存成功');
  });
});