pT*p acw"/>
T*pT*p acw
T*pT*p acw_sc__v2参数逆向记录
采集T*pT*p游戏排行榜时遇到的acw_sc__v2参数逆向
目标地址：https://d3d3LnRhcHRhcC5jbg==/top/played
目标请求：
python模拟：
import requests
headers = {"authority": "d3d3LnRhcHRhcC5jbg==","accept": "application/json, text/plain, */*","accept-language": "zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6","cache-control": "no-cache","pragma": "no-cache","referer": "https://d3d3LnRhcHRhcC5jbg==/top/played","sec-ch-ua": "^\\^Microsoft","sec-ch-ua-mobile": "?0","sec-ch-ua-platform": "^\\^Windows^^","sec-fetch-dest": "empty","sec-fetch-mode": "cors","sec-fetch-site": "same-origin","user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0","x-requested-with": "XMLHttpRequest",# "x-xsrf-token": "eipr0vnapxvsxrtudblt"
}cookies = {# "acw_tc": "2760820216998668260555124eea3468214fb93d7ca32b6f59d7adbf51a768",# "web_app_uuid": "d3b19cef-4b57-4065-8196-92bd0ce2d904",# "locale": "zh_CN",# "apk_download_url_postfix": "/organic-direct",# "T*p_theme": "dark","acw_sc__v2": "6551e8cacfb5f3b125fed536976af7df3a51f7a3",# "XSRF-TOKEN": "eipr0vnapxvsxrtudblt",# "_gid": "GA1.2.522478040.1699866826",# "_ga": "GA1.1.1511074475.1699866826",# "_ga_6G9NWP07QM": "GS1.1.1699866826.1.0.1699866826.0.0.0",# "_clck": "1pc5s32^|2^|fgo^|0^|1412",# "Hm_lvt_536e39e029b26af67aecbc444cdbd996": "1699437109,1699495014,1699839243,1699866827",# "Hm_lpvt_536e39e029b26af67aecbc444cdbd996": "1699866827",# "_clsk": "2a6tyl^|1699866827452^|1^|0^|z.clarity.ms/collect",# "ssxmod_itna": "eqIx0QG=uDBQDXDneaGCj6WfxmxWq0=Ciqh=pDl=lxxA5D8D6DQeGTiRb=Ki1KGQnYWfNKYWRRXa4=j3mPoQ=mYpuTii4B3DEx0=413oKii9DCeDIDWeDiDG+=DFxYoDervQDF8NVz/9tqGRD0YDzqDgD7QxqeDfDDL9K0GiQDtqDDNqBexDe86xDYp9jwdePWrDAwDM7A=DjqGgDBLNAZbDGL9k=GNM8pxrTgQq=eGuDG6KEudPx0PBlqNRec5ESi4YSEqW/7P4CYfwbiMefQkASYmb724tVGPW+ijYQDDAAm/beD==",# "ssxmod_itna2": "eqIx0QG=uDBQDXDneaGCj6WfxmxWq0=Ciqh=D6h8oOx0vaHq031qscReeX11u5Ig0a5dD5YQx2e4=88Eim3YbDA0ier8YEd5uDn+WjQDVMou0H1hMLOpbDdZ1Oh=SUZdlEhAVmlHIlqNClqEXYlqHBL=cGw2Enb6YsSqCmYxvQGqH0MviQGT07SptySEXff=ZW40RC4LFr6fTExa/I3N0m0Wj0w4c7LPUKB5kpe61mn2tnqdw8qrHbdQzp/ORt6D0AoknC+cxzIk7OKjHpI71g4cOfUayLatErTQLks1Bf9WctWmO/GKhYe1D1K0Y/DYAqoaxFKE3/i8l2Qbqtub8IOK9o=k2tMTwYoe8u4eM+cYwbq5QrwBGK8CWvQQBAqblPEhNeYWaEwIntY2QG8s3g5kgPa2Wo3aY2tdbvyxQjjdE+N92K2g59hDPLqCnPO6QC=OfSmh6q=6=y+DnAP4QWIb8E6KQhaeiIHZ+y3THnQ0xCXlwkOfrls4xW580j4tiprIZ5aEI/CK3OdVB24xIizvRd=UxPD7QsnGiGhU835YuiD5idS+3PTHqWT7qDGcDG7KiDD="
}
url = "https://d3d3LnRhcHRhcC5jbg==/webapiv2/app-top/v2/hits"
params = {"dataSource": "Android","from": "20","limit": "10","type_name": "pop","X-UA": "V=1&PN=WebApp&LANG=zh_CN&VN_CODE=102&VN=0.1.0&LOC=CN&PLT=PC&DS=Android&UID=58b40609-d88b-4b49-aa58-93c6a0e1d85a&DT=PC&OS=Windows&OSV=10.0.0"}
response = requests.get(url, headers=headers, cookies=cookies, params=params)print(response.text)
print(response)
经过检查只要cookies有关键参数**acw_sc__v2**就能请求成功
现在开始逆向，先清空cookies
直接hook上我们的油猴脚本
// ==UserScript==
// @name New Userscript
// @namespace /
// @version 0.1
// @description try to take over the world!
// @author You
// @match https://d3d3LnRhcHRhcC5jbg==/top/played
// @icon =64&domain=T*pT*p
// @grant none
// ==/UserScript==(function() {
var cookie_cache = document.cookie;
Object.defineProperty(document, "cookie", {get: function () {console.log(cookie_cache);// 在获取document.cookie时，执行你想要的操作return cookie_cache; // 返回原始的cookie值},set: function(value) {// 在设置document.cookie时，执行你想要的操作if(value.includes('acw_sc__v2')){debugger;}}
});// Your code here...
})();
刷新网页
堆栈往上看 找到关键词参数 看来加密在arg3中
先做分析，打个断点发现arg3是在这个区域生成的查看switch 执行顺序发现 这个arg3是由arg2转换的
找一下arg2如何生成
这里可以看出是由arg1生成的
那就再找下arg1
传参进来的 再往堆栈上面找
可以看到这里传进来的
从js逻辑和我们上面不带acw_sc__v2的请求返回结果 可以大概分析出
如果网页中包含acw_sc__v2字符，会获取网页中的arg1的参数并且生成arg2,arg3最后设置acw_sc__v2再重新请求
明了后，
那现在开始扣js
var arg1="5AE2ADC96EADD85909C211317A47522EF253ECE4";
var posList = [15, 35, 29, 24, 33, 16, 1, 38, 10, 9, 19, 31, 40, 27, 22, 23, 25, 13, 6, 11, 39, 18, 20, 8, 14, 21, 32, 26, 2, 30, 7, 4, 17, 5, 3, 28, 34, 37, 12, 36];
var mask = _0x1e8e("0x0");
var outPutList = [];
var arg2 = "";
var arg3 = "";
for (var i = 0; i < arg1[_0x1e8e("0x1")]; i++) {var this_i = arg1[i];for (var j = 0; j < posList[_0x1e8e("0x1")]; j++) {if (posList[j] == i + 1) {outPutList[j] = this_i}}
}
arg2 = outPutList[_0x1e8e("0x2")]("");
执行报错继续补
var _0x1e8e = function(_0x558645, _0x3571ed) {
_0x558645 = _0x558645 - 0;
var _0x23d32b = _0x3e9e[_0x558645];
if (_0x1e8e["jweSQB"] === undefined) {
(function() {var _0x2a4aae;try {var _0x1ac753 = Function("return\x20(function()\x20" + "{}.constructor(\x22return\x20this\x22)(\x20)" + ");");_0x2a4aae = _0x1ac753()} catch (_0x267ba9) {_0x2a4aae = window}var _0x22c6cf = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";_0x2a4aae["atob"] || (_0x2a4aae["atob"] = function(_0xb01b66) {var _0x112e38 = String(_0xb01b66)["replace"](/=+$/, "");for (var _0x315811 = 0, _0x196945, _0x8ee65b, _0x111e6b = 0, _0x2a5e7f = ""; _0x8ee65b = _0x112e38["charAt"](_0x111e6b++); ~_0x8ee65b && (_0x196945 = _0x315811 % 4 ? _0x196945 * 64 + _0x8ee65b : _0x8ee65b,_0x315811++ % 4) ? _0x2a5e7f += String["fromCharCode"](255 & _0x196945 >> (-2 * _0x315811 & 6)) : 0) {_0x8ee65b = _0x22c6cf["indexOf"](_0x8ee65b)}return _0x2a5e7f})
}());
_0x1e8e["VidPVs"] = function(_0x539abf) {var _0x126fa5 = atob(_0x539abf);var _0x54d768 = [];for (var _0x3d3645 = 0, _0x4289fc = _0x126fa5["length"]; _0x3d3645 < _0x4289fc; _0x3d3645++) {_0x54d768 += "%" + ("00" + _0x126fa5["charCodeAt"](_0x3d3645)["toString"](16))["slice"](-2)}return decodeURIComponent(_0x54d768)
}
;
_0x1e8e["BXvRsu"] = {};
_0x1e8e["jweSQB"] = !![]
}
var _0x436197 = _0x1e8e["BXvRsu"][_0x558645];
if (_0x436197 === undefined) {
var _0x4f4121 = function(_0x5e2adc) {this["nlcXFw"] = _0x5e2adc;this["HAmvBE"] = [1, 0, 0];this["YFWLey"] = function() {return "newState"};this["YpNXEl"] = "\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*";this["JsKhOp"] = "[\x27|\x22].+[\x27|\x22];?\x20*}"
};
_0x4f4121["prototype"]["pzRiIQ"] = function() {var _0x3e581e = new RegExp(this["YpNXEl"] + this["JsKhOp"]);var _0x13a005 = _0x3e581e["test"](this["YFWLey"]["toString"]()) ? --this["HAmvBE"][1] : --this["HAmvBE"][0];return this["gaiPha"](_0x13a005)
}
;
_0x4f4121["prototype"]["gaiPha"] = function(_0x1e6387) {if (!Boolean(~_0x1e6387)) {return _0x1e6387}return this["hpKQFb"](this["nlcXFw"])
}
;
_0x4f4121["prototype"]["hpKQFb"] = function(_0x20dc19) {for (var _0x19d402 = 0, _0x5a3818 = this["HAmvBE"]["length"]; _0x19d402 < _0x5a3818; _0x19d402++) {this["HAmvBE"]["push"](Math["round"](Math["random"]()));_0x5a3818 = this["HAmvBE"]["length"]}return _0x20dc19(this["HAmvBE"][0])
}
;
new _0x4f4121(_0x1e8e)["pzRiIQ"]();
_0x23d32b = _0x1e8e["VidPVs"](_0x23d32b);
_0x1e8e["BXvRsu"][_0x558645] = _0x23d32b
} else {
_0x23d32b = _0x436197
}
return _0x23d32b
};
var arg1="5AE2ADC96EADD85909C211317A47522EF253ECE4";
var posList = [15, 35, 29, 24, 33, 16, 1, 38, 10, 9, 19, 31, 40, 27, 22, 23, 25, 13, 6, 11, 39, 18, 20, 8, 14, 21, 32, 26, 2, 30, 7, 4, 17, 5, 3, 28, 34, 37, 12, 36];
var mask = _0x1e8e("0x0");
var outPutList = [];
var arg2 = "";
var arg3 = "";
for (var i = 0; i < arg1[_0x1e8e("0x1")]; i++) {var this_i = arg1[i];for (var j = 0; j < posList[_0x1e8e("0x1")]; j++) {if (posList[j] == i + 1) {outPutList[j] = this_i}}
}
arg2 = outPutList[_0x1e8e("0x2")]("");
继续补
这两段都要补下面那些方法为这里列表做了个偏移
这次应该可以了吧
但是依旧报错 这时候就要靠经验了 记得看过一个帖子
JavaScript 常见混淆技术类型变量混淆：将带有含义的变量名、方法名、常量名随机变为无意义的类乱码字符串，降低代码可读性，如转成单个字符或十六进制字符串字符串混淆：将字符串阵列化集中放置、并可进行 MD5 或 Base64 加密存储，使代码中不出现明文字符串，这样可以避免使用全局搜索字符串的方式定位到入口点属性加密：针对 JavaScript 对象的属性进行加密转化，隐藏代码之间的调用关系控制流平坦化：打乱函数原有代码执行流程及函数调用关系，使代码逻变得混乱无序无用代码注入：随机在代码中插入不会被执行到的无用代码，进一步使代码看起来更加混乱调试保护：基于调试器特性，对当前运行环境进行检验，加入一些强制调试 debugger 语句，使其在调试模式下难以顺利执行 JavaScript 代码多态变异：使 JavaScript 代码每次被调用时，将代码自身即立刻自动发生变异，变化为与之前完全不同的代码，即功能完全不变，只是代码形式变异，以此杜绝代码被动态分析调试锁定域名：使 JavaScript 代码只能在指定域名下执行反格式化：如果对 JavaScript 代码进行格式化，则无法执行，导致浏览器假死特殊编码：将 JavaScript 完全编码为人不可读的代码，如表情符号、特殊表示内容等等以上内容转自：.html
里面提到的反格式化 试一下
var _0x3e9e=["c3BsaXQ=","c2xpY2U=","dG9TdHJpbmc=","c2V0VGltZQ==","Z2V0VGltZQ==","Y29va2ll","YWN3X3NjX192Mj0=","O2V4cGlyZXM9","dG9HTVRTdHJpbmc=","O21heC1hZ2U9MzYwMDtwYXRoPS8=","MzAwMDE3NjAwMDg1NjAwNjA2MTUwMTUzMzAwMzY5MDAyNzgwMDM3NQ==","bGVuZ3Ro","am9pbg==","MXw0fDN8MHwy"];(function(_0x2d8f05,_0x4b81bb){var _0x4d74cb=function(_0x32719f){while(--_0x32719f){_0x2d8f05["push"](_0x2d8f05["shift"]())}};var _0x33748d=function(){var _0x3e4c21={"data":{"key":"cookie","value":"timeout"},"setCookie":function(_0x5c685e,_0x3e3156,_0x1e9e81,_0x292610){_0x292610=_0x292610||{};var _0x151bd2=_0x3e3156+"="+_0x1e9e81;var _0x558098=0;for(var _0x558098=0,_0x230f38=_0x5c685e["length"];_0x558098<_0x230f38;_0x558098++){var _0x948b6c=_0x5c685e[_0x558098];_0x151bd2+=";\x20"+_0x948b6c;var _0x29929c=_0x5c685e[_0x948b6c];_0x5c685e["push"](_0x29929c);_0x230f38=_0x5c685e["length"];if(_0x29929c!==!![]){_0x151bd2+="="+_0x29929c}}
_0x292610["cookie"]=_0x151bd2},"removeCookie":function(){return"dev"},"getCookie":function(_0x5dd881,_0x550fbc){_0x5dd881=_0x5dd881||function(_0x18d5c9){return _0x18d5c9};var _0x4ce2f1=_0x5dd881(new RegExp("(?:^|;\x20)"+_0x550fbc["replace"](/([.$?*|{}()[]\/+^])/g,"$1")+"=([^;]*)"));var _0x333808=function(_0x432180,_0x2ab90b){_0x432180(++_0x2ab90b)};_0x333808(_0x4d74cb,_0x4b81bb);return _0x4ce2f1?decodeURIComponent(_0x4ce2f1[1]):undefined}};var _0x991246=function(){var _0x981158=new RegExp("\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*[\x27|\x22].+[\x27|\x22];?\x20*}");return _0x981158["test"](_0x3e4c21["removeCookie"]["toString"]())};_0x3e4c21["updateCookie"]=_0x991246;var _0x57b080="";var _0x219af0=_0x3e4c21["updateCookie"]();if(!_0x219af0){_0x3e4c21["setCookie"](["*"],"counter",1)}else{if(_0x219af0){_0x57b080=_0x3e4c21["getCookie"](null,"counter")}else{_0x3e4c21["removeCookie"]()}}};_0x33748d()}(_0x3e9e,374));var _0x1e8e=function(_0x558645,_0x3571ed){_0x558645=_0x558645-0;var _0x23d32b=_0x3e9e[_0x558645];if(_0x1e8e["jweSQB"]===undefined){(function(){var _0x2a4aae;try{var _0x1ac753=Function("return\x20(function()\x20"+"{}.constructor(\x22return\x20this\x22)(\x20)"+");");_0x2a4aae=_0x1ac753()}catch(_0x267ba9){_0x2a4aae=window}
var _0x22c6cf="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";_0x2a4aae["atob"]||(_0x2a4aae["atob"]=function(_0xb01b66){var _0x112e38=String(_0xb01b66)["replace"](/=+$/,"");for(var _0x315811=0,_0x196945,_0x8ee65b,_0x111e6b=0,_0x2a5e7f="";_0x8ee65b=_0x112e38["charAt"](_0x111e6b++);~_0x8ee65b&&(_0x196945=_0x315811%4?_0x196945*64+_0x8ee65b:_0x8ee65b,_0x315811++%4)?_0x2a5e7f+=String["fromCharCode"](255&_0x196945>>(-2*_0x315811&6)):0){_0x8ee65b=_0x22c6cf["indexOf"](_0x8ee65b)}
return _0x2a5e7f})}());_0x1e8e["VidPVs"]=function(_0x539abf){var _0x126fa5=atob(_0x539abf);var _0x54d768=[];for(var _0x3d3645=0,_0x4289fc=_0x126fa5["length"];_0x3d3645<_0x4289fc;_0x3d3645++){_0x54d768+="%"+("00"+_0x126fa5["charCodeAt"](_0x3d3645)["toString"](16))["slice"](-2)}
return decodeURIComponent(_0x54d768)};_0x1e8e["BXvRsu"]={};_0x1e8e["jweSQB"]=!![]}
var _0x436197=_0x1e8e["BXvRsu"][_0x558645];if(_0x436197===undefined){var _0x4f4121=function(_0x5e2adc){this["nlcXFw"]=_0x5e2adc;this["HAmvBE"]=[1,0,0];this["YFWLey"]=function(){return"newState"};this["YpNXEl"]="\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*";this["JsKhOp"]="[\x27|\x22].+[\x27|\x22];?\x20*}"};_0x4f4121["prototype"]["pzRiIQ"]=function(){var _0x3e581e=new RegExp(this["YpNXEl"]+this["JsKhOp"]);var _0x13a005=_0x3e581e["test"](this["YFWLey"]["toString"]())?--this["HAmvBE"][1]:--this["HAmvBE"][0];return this["gaiPha"](_0x13a005)};_0x4f4121["prototype"]["gaiPha"]=function(_0x1e6387){if(!Boolean(~_0x1e6387)){return _0x1e6387}
return this["hpKQFb"](this["nlcXFw"])};_0x4f4121["prototype"]["hpKQFb"]=function(_0x20dc19){for(var _0x19d402=0,_0x5a3818=this["HAmvBE"]["length"];_0x19d402<_0x5a3818;_0x19d402++){this["HAmvBE"]["push"](Math["round"](Math["random"]()));_0x5a3818=this["HAmvBE"]["length"]}
return _0x20dc19(this["HAmvBE"][0])};new _0x4f4121(_0x1e8e)["pzRiIQ"]();_0x23d32b=_0x1e8e["VidPVs"](_0x23d32b);_0x1e8e["BXvRsu"][_0x558645]=_0x23d32b}else{_0x23d32b=_0x436197}
return _0x23d32b};var arg1="5AE2ADC96EADD85909C211317A47522EF253ECE4";var posList=[15,35,29,24,33,16,1,38,10,9,19,31,40,27,22,23,25,13,6,11,39,18,20,8,14,21,32,26,2,30,7,4,17,5,3,28,34,37,12,36];var mask=_0x1e8e("0x0");var outPutList=[];var arg2="";var arg3="";for(var i=0;i<arg1[_0x1e8e("0x1")];i++){var this_i=arg1[i];for(var j=0;j<posList[_0x1e8e("0x1")];j++){if(posList[j]==i+1){outPutList[j]=this_i}}}
arg2=outPutList[_0x1e8e("0x2")]("");
console.log('arg2='+arg2)
//结果：arg2=5551F95CE6C244137DDAE92981EAA2C20AE72ED3
成功了 继续生成arg3
var _0x3e9e=["c3BsaXQ=","c2xpY2U=","dG9TdHJpbmc=","c2V0VGltZQ==","Z2V0VGltZQ==","Y29va2ll","YWN3X3NjX192Mj0=","O2V4cGlyZXM9","dG9HTVRTdHJpbmc=","O21heC1hZ2U9MzYwMDtwYXRoPS8=","MzAwMDE3NjAwMDg1NjAwNjA2MTUwMTUzMzAwMzY5MDAyNzgwMDM3NQ==","bGVuZ3Ro","am9pbg==","MXw0fDN8MHwy"];(function(_0x2d8f05,_0x4b81bb){var _0x4d74cb=function(_0x32719f){while(--_0x32719f){_0x2d8f05["push"](_0x2d8f05["shift"]())}};var _0x33748d=function(){var _0x3e4c21={"data":{"key":"cookie","value":"timeout"},"setCookie":function(_0x5c685e,_0x3e3156,_0x1e9e81,_0x292610){_0x292610=_0x292610||{};var _0x151bd2=_0x3e3156+"="+_0x1e9e81;var _0x558098=0;for(var _0x558098=0,_0x230f38=_0x5c685e["length"];_0x558098<_0x230f38;_0x558098++){var _0x948b6c=_0x5c685e[_0x558098];_0x151bd2+=";\x20"+_0x948b6c;var _0x29929c=_0x5c685e[_0x948b6c];_0x5c685e["push"](_0x29929c);_0x230f38=_0x5c685e["length"];if(_0x29929c!==!![]){_0x151bd2+="="+_0x29929c}}
_0x292610["cookie"]=_0x151bd2},"removeCookie":function(){return"dev"},"getCookie":function(_0x5dd881,_0x550fbc){_0x5dd881=_0x5dd881||function(_0x18d5c9){return _0x18d5c9};var _0x4ce2f1=_0x5dd881(new RegExp("(?:^|;\x20)"+_0x550fbc["replace"](/([.$?*|{}()[]\/+^])/g,"$1")+"=([^;]*)"));var _0x333808=function(_0x432180,_0x2ab90b){_0x432180(++_0x2ab90b)};_0x333808(_0x4d74cb,_0x4b81bb);return _0x4ce2f1?decodeURIComponent(_0x4ce2f1[1]):undefined}};var _0x991246=function(){var _0x981158=new RegExp("\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*[\x27|\x22].+[\x27|\x22];?\x20*}");return _0x981158["test"](_0x3e4c21["removeCookie"]["toString"]())};_0x3e4c21["updateCookie"]=_0x991246;var _0x57b080="";var _0x219af0=_0x3e4c21["updateCookie"]();if(!_0x219af0){_0x3e4c21["setCookie"](["*"],"counter",1)}else{if(_0x219af0){_0x57b080=_0x3e4c21["getCookie"](null,"counter")}else{_0x3e4c21["removeCookie"]()}}};_0x33748d()}(_0x3e9e,374));var _0x1e8e=function(_0x558645,_0x3571ed){_0x558645=_0x558645-0;var _0x23d32b=_0x3e9e[_0x558645];if(_0x1e8e["jweSQB"]===undefined){(function(){var _0x2a4aae;try{var _0x1ac753=Function("return\x20(function()\x20"+"{}.constructor(\x22return\x20this\x22)(\x20)"+");");_0x2a4aae=_0x1ac753()}catch(_0x267ba9){_0x2a4aae=window}
var _0x22c6cf="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";_0x2a4aae["atob"]||(_0x2a4aae["atob"]=function(_0xb01b66){var _0x112e38=String(_0xb01b66)["replace"](/=+$/,"");for(var _0x315811=0,_0x196945,_0x8ee65b,_0x111e6b=0,_0x2a5e7f="";_0x8ee65b=_0x112e38["charAt"](_0x111e6b++);~_0x8ee65b&&(_0x196945=_0x315811%4?_0x196945*64+_0x8ee65b:_0x8ee65b,_0x315811++%4)?_0x2a5e7f+=String["fromCharCode"](255&_0x196945>>(-2*_0x315811&6)):0){_0x8ee65b=_0x22c6cf["indexOf"](_0x8ee65b)}
return _0x2a5e7f})}());_0x1e8e["VidPVs"]=function(_0x539abf){var _0x126fa5=atob(_0x539abf);var _0x54d768=[];for(var _0x3d3645=0,_0x4289fc=_0x126fa5["length"];_0x3d3645<_0x4289fc;_0x3d3645++){_0x54d768+="%"+("00"+_0x126fa5["charCodeAt"](_0x3d3645)["toString"](16))["slice"](-2)}
return decodeURIComponent(_0x54d768)};_0x1e8e["BXvRsu"]={};_0x1e8e["jweSQB"]=!![]}
var _0x436197=_0x1e8e["BXvRsu"][_0x558645];if(_0x436197===undefined){var _0x4f4121=function(_0x5e2adc){this["nlcXFw"]=_0x5e2adc;this["HAmvBE"]=[1,0,0];this["YFWLey"]=function(){return"newState"};this["YpNXEl"]="\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*";this["JsKhOp"]="[\x27|\x22].+[\x27|\x22];?\x20*}"};_0x4f4121["prototype"]["pzRiIQ"]=function(){var _0x3e581e=new RegExp(this["YpNXEl"]+this["JsKhOp"]);var _0x13a005=_0x3e581e["test"](this["YFWLey"]["toString"]())?--this["HAmvBE"][1]:--this["HAmvBE"][0];return this["gaiPha"](_0x13a005)};_0x4f4121["prototype"]["gaiPha"]=function(_0x1e6387){if(!Boolean(~_0x1e6387)){return _0x1e6387}
return this["hpKQFb"](this["nlcXFw"])};_0x4f4121["prototype"]["hpKQFb"]=function(_0x20dc19){for(var _0x19d402=0,_0x5a3818=this["HAmvBE"]["length"];_0x19d402<_0x5a3818;_0x19d402++){this["HAmvBE"]["push"](Math["round"](Math["random"]()));_0x5a3818=this["HAmvBE"]["length"]}
return _0x20dc19(this["HAmvBE"][0])};new _0x4f4121(_0x1e8e)["pzRiIQ"]();_0x23d32b=_0x1e8e["VidPVs"](_0x23d32b);_0x1e8e["BXvRsu"][_0x558645]=_0x23d32b}else{_0x23d32b=_0x436197}
return _0x23d32b};var arg1="5AE2ADC96EADD85909C211317A47522EF253ECE4";var posList=[15,35,29,24,33,16,1,38,10,9,19,31,40,27,22,23,25,13,6,11,39,18,20,8,14,21,32,26,2,30,7,4,17,5,3,28,34,37,12,36];var mask=_0x1e8e("0x0");var outPutList=[];var arg2="";var arg3="";for(var i=0;i<arg1[_0x1e8e("0x1")];i++){var this_i=arg1[i];for(var j=0;j<posList[_0x1e8e("0x1")];j++){if(posList[j]==i+1){outPutList[j]=this_i}}}
arg2=outPutList[_0x1e8e("0x2")]("");
console.log('arg2='+arg2)
//结果：arg2=5551F95CE6C244137DDAE92981EAA2C20AE72ED3
for (var i = 0; i < arg2[_0x1e8e("0x1")] && i < mask[_0x1e8e("0x1")]; i += 2) {var GxjQsM = _0x1e8e("0x3")[_0x1e8e("0x4")]("|"), QoWazb = 0;while (!![]) {switch (GxjQsM[QoWazb++]) {case "0":if (xorChar[_0x1e8e("0x1")] == 1) {xorChar = "0" + xorChar}continue;case "1":var strChar = parseInt(arg2[_0x1e8e("0x5")](i, i + 2), 16);continue;case "2":arg3 += xorChar;continue;case "3":var xorChar = (strChar ^ maskChar)[_0x1e8e("0x6")](16);continue;case "4":var maskChar = parseInt(mask[_0x1e8e("0x5")](i, i + 2), 16);continue}break}}
console.log('arg3='+arg3)
//arg2=5551F95CE6C244137DDAE92981EAA2C20AE72ED3
//arg3=6551ee3ce64724157bcfe87ab1e9cbc22d672da6
生成成功 我们测试下
带入上面的python代码中数据获取成功
结束~~~
更多推荐
T*pT*p acw
发布评论