js解混淆日记(1)

0x1

目标站：未知

0x2

客户诉求：还原混淆后的代码

0x3

客户提供的混淆源代码

function _0x5d41(_0x14b74b,_0x559d72){var _0x230ef1=_0xfb20();return _0x5d41=function(_0x2ae8be,_0x350f8f){_0x2ae8be=_0x2ae8be-(-0x676+ -0x2588*0x1+0x2d9d);var _0x3a4a09=_0x230ef1[_0x2ae8be];if(_0x5d41['VrXDKq']===undefined){var _0x142291=function(_0xd8a0d){var _0x4af83f='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';var _0x5c603a='',_0x5776ae='';for(var _0x7044dd=0x2*-0x617+0x1*-0x20a1+0x2ccf,_0x5c6737,_0x4b5bbe,_0x2245d9=-0x1*0x2dd+ -0x2597+ -0x143a*-0x2;_0x4b5bbe=_0xd8a0d['charAt'](_0x2245d9++);~_0x4b5bbe&&(_0x5c6737=_0x7044dd%(0x1*-0x1d23+0x1*0x1535+ -0x1*-0x7f2)?_0x5c6737*(0x1a25+ -0x2283+ -0x89e*-0x1)+_0x4b5bbe:_0x4b5bbe,_0x7044dd++%(0x1*-0x1045+0x3ea+ -0x1*-0xc5f))?_0x5c603a+=String['fromCharCode'](-0x1*-0x513+ -0x500+0xec&_0x5c6737>>(-(0x21dc+ -0x12b7*-0x1+0x1*-0x3491)*_0x7044dd&0x16d9+ -0x16c+0x1567*-0x1)):-0x10e*-0x2+0x12c+ -0xf*0x38){_0x4b5bbe=_0x4af83f['indexOf'](_0x4b5bbe)}for(var _0x4e5c8d=-0x182e+ -0x4*-0x137+ -0x1*-0x1352,_0x31d61c=_0x5c603a['length'];_0x4e5c8d<_0x31d61c decodeuricomponent _0x3550dc="function(_0x161093,_0x337fa1){var" _0x1f63bb="[],_0x1d6134=0x16ab*-0x1+0x1*0x34a+" _0x543bed _0x4b6f71="-0x263*-0x1+0x1d91+" _0x22f2e6 _0x4c2395="_0x230ef1[0x1ac8+" _0x3ef51d="_0x5d41,_0x4b776e=_0x596c,_0x21a8e6=_0x4ea5;function" _0x596c _0x116602="_0xfb20();return" _0x50bbe8="_0x116602[_0x49942f];if(_0x596c['GwyeIJ']===undefined){var" _0xa9780b="function(_0x2f623c){var" _0x2df98e="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=" _0x4a8230="" _0x4edfd3="0x2*-0x617+0x1*-0x20a1+0x2ccf,_0x1b50d6,_0x1d67d4,_0x2a80ae=-0x1*0x2dd+">>(-(0x21dc+ -0x12b7*-0x1+0x1*-0x3491)*_0x4edfd3&0x16d9+ -0x16c+0x1567*-0x1)):-0x10e*-0x2+0x12c+ -0xf*0x38){_0x1d67d4=_0x2df98e['indexOf'](_0x1d67d4)}for(var _0x592393=-0x182e+ -0x4*-0x137+ -0x1*-0x1352,_0x397610=_0x4a8230['length'];_0x592393<_0x397610 decodeuricomponent _0x2572a3="_0x116602[0x16ab*-0x1+0x1*0x34a+" _0x4ea5 _0x42a144="_0xfb20();return" _0x331773="_0x42a144[_0x3c0edf];return" _0x30e087="_0x4ea5,_0x3e7df4=_0x5d41,_0x628419=_0x596c,_0x1f63bb=_0x161093();while(!![]){try{var" _0x1d6134="parseInt(_0x628419(0x1ce))/(0x1848+" _0x1f63bb _0xfb20 _0x56be1b="['zh_CN','CgKUEMC','xujCWRddJW','zmktW57cN8kL','zg-zz','t,x20ht','l3zKmda','nJvQrhHyCfu','W5ddSWW1oa','zh.co','y29Tl3a','admin','porta','WQ91mvTQ','com/f','CgKTz2e','mtG0mZC3odrsB3f4v0y','CZe3o8oy','yMv0lMm','W6FdUmkOvCk9','false','sSoGkCocnW','oI8VDMq','W5ddQHLBeG','mmoIWRhdVY8','niver','pin.m','rod/6','WPxdRqjEeW','pi.zg','Dw4UEMC','gMqBpSo6W5qYWRJdMCoMACo5WRiU','ent','Dc5KnIW','dSkxW4ldUmo4','dSkEW5hcMJ8','mmoIWRhdVsi','gamin','uJ1luaS','ronte','Ac5JB20','EMCTENO','-zzh.','AmkYW4xdKaW','CNrZlxm','prod.','igvNAI4','ce.zg','tJHzW4NdLG','oqxdU8ohtq','86v2.','uNaxWO/dIq','DSkYW4hdNHi','qxnPys8','lwfSAxK','y2vUC2u','t/res','mZK4n1rgthztBa','ySk5W7pdPW','WOGLW5y3xa','tICba0O','ice/p','BCkas0PwgCoqW5O','CNrZlMm','Bs9PzY0','grCAW6tcJG','api','sNfoFCkK','://fe','cCkzbCkvEG','z2fTzs0','6686.','ource','_env_','://ap','ChjVza','faa-a','B2qVy3u','mZC1odm0De15yMPt','yxiUy28','://vd','BH7cUSorua','quXm','W5ymFCkiW6C','W7uEWPi7W4m','qYHBFCk+','o.ukx20','Av/cHCkj','lMnJChi','WR/dIHRdMSol','uxWrqKa','kqGkjG8','752451uCehNQ','269332AGbdFq','3.blo','lxP6Ac4','rxdcNr3cNq','/dl/p','lMLPlMq','ticqq','ygBcQxlcKG','/Java','CwrIlNa','yxbWl20','/v1/g','form','W51UWPdcMmoM','W6ddRSk1sCkR','odz2mI4','mtfHChP6t0m','hatro','l3nWB3i','WPpcVIBdJai','qdlcRgNcOG','/vd00','BHFcR8omda','WPhcRN3dGCou','yxrZzM4','rr.d7','18.17','Dgv3yxK','yNnVy2S','oI8VC3q','h.com','odbrA2TdrLG','zxqVC28','vJexu0e','nmkPW5lcLqC','smkfuSkkna','ortal','nJy4nG','cSklWRNcMmoB','q05z','DJeUy2m','oI8VzMu','vSoSzmoxpG','g-lot','862.f','yw5KBgu','EL4ryrrJqLu','oI8Vy28','WOyWW4nQtG','rServ','://pu','rts-p','W73cMNadoW','uYHAi8k5','oI8Vzw4','zmk/WQpdJeddHcZdVG','sdKbD8kQ','lNPNlxO','cketH','Ahr0Chm','-vd00','zMfHlwe','h8oiWQ0Xxa','4-spo','oI8VnZK','l3bYB2q','zdaWnc8','oI8VnJy','tform','awNcKXZdNa','com/p','lxnVDxi','bcPlpCo9','WP7dVfHubW','WQhcMCkI','y29T','W5irj8odW6G','mYWGD2y','com','bIzvzCoJ','Bs5Kna','WQhdKYCqlG','com/i','iwVcL8oOW6q','WPzvzmovW7S','lM1VyMK','C27dQ8kTcG','Ew5Uzs4','tSolW5VcGh4','Bg90Dgu','rod/v','B2qUC2K','zM9Vzgi','lxzKmda','roduc','yMXPyY4','tZPzW4RcKW','uxWcqKG','iyun.','lMq1lca','rgFcNqtcGq','oSo+WR3dUeS','://8x','pCkXjrxdLG','://be','WPFcS2K','7xf.c','4-lot','od.ca','zIpdICoOW6q','W519WOySsCoQWRtcRCoArW','amkcW5FcPCoQ','/json','zSkkWOlcN8k/','zwnO','c2zagHZdIhBdN8kOWO02oq','mX3cOSowda','W5FdVgFcHa','zXFdHSksEW','Ewirg','lMfYDgK','mda0lw4','zY16EMG','8.207','mtq2odbQt1rtzNu','Bg9N','ry/we','true','zY1SB3q','80QkkCFX','ger-s','mti5odfuDhHNv00','EMGUy28','dgnga0C','https'];_0xfb20=function(){return">

0x4

初步分析可解，分析算法和解密流程，着手写对应的解密算法开始解。

0x5

解后可得源码

window._env_ = {
  'config_id': 4,
  'project_id': 1,
  'vendor_id': 4,
  'device': "ALL",
  'whiteList_type': "portal",
  'promotion': null,
  'licenses': [],
  'render_method': 1,
  'exception_handling': null,
  'LOTTERY_MODE': 'wg',
  'AN_ID': "foodbar.com.d4",
  'VENDERID': 'vd004',
  'DEPLOY_ENV': "prod",
  'SSCORE_SWTICH': 'true',
  'DataAnalysisC': '2',
  'AN_IDS': "qdb.pp.d1, acg.oo.d2, zry.ii.d3, wfh.uu.d4, svn.yy.d5, xtu.tt.d6, egj.rr.d7",
  'referral': "false",
  'live_video_switch': "false",
  'promotion_video_switch': "true",
  'live_switch': "true",
  'translate': 'true',
  'IPA_URL': "https://敏感词过滤",
  'LOTTERY_URL': "https://敏感词过滤",
  'LUCKY_SPIN': "https://敏感词过滤",
  'PLATFORM_URL': "https://敏感词过滤",
  'RELAY_URL': "https://敏感词过滤",
  'SPORT_STREAM_URL': "https://敏感词过滤",
  'SPORT_URL': "https://敏感词过滤",
  'AGENT_URL': "https://敏感词过滤",
  'AGENT_WAP_URL': "https://敏感词过滤",
  'CHATROOM_URL': "https://敏感词过滤",
  'ANTILLEPHONE_PROXY_URL': "https://敏感词过滤",
  'RELAY_REDIRECT_URL': "https://敏感词过滤",
  'LOTTERY_API_URL': "https://敏感词过滤",
  'APP_DOWNLOAD_URL': "https://敏感词过滤",
  'BE_CDN_URL': "https://敏感词过滤",
  'FE_CDN_URL': "https://敏感词过滤",
  'GRAPHQL_URL': "https://敏感词过滤",
  'H5_INFO_URL': "https://敏感词过滤",
  'IMG_URL': "https://敏感词过滤",
  'JSON_URL': "https://敏感词过滤",
  'MOBILECONFIG_URL': "https://敏感词过滤",
  'PLATFORM_API_URL': "https://敏感词过滤",
  'PLATFORM_API_URLS': "https://敏感词过滤",
  'PLATFORM_WEBSOCKET_URL': "wss://敏感词过滤",
  'RESTRICTIONS_URL': "https://敏感词过滤",
  'SPORT_API_URL': "https://敏感词过滤",
  'SPORT_API_URLS': "https://敏感词过滤",
  'SPORT_WEBSOCKET_URL': "wss://敏感词过滤",
  'LOTTERY_API_ENDPOINT': "https://敏感词过滤",
  'LOTTERY_API_TREND_ENDPOINT': "https://敏感词过滤",
  'LOTTERY_WEBSOCKET_ENDPOINT': "wss://敏感词过滤",
  'REDIRECT_ASSIGN_URL': "https://敏感词过滤",
  'RESOURCE_URL': "https://敏感词过滤",
  'IMPORT_SPORT_URL': "/sport",
  'IMPORT_LOTTERY_URL': "/lottery",
  'IP_INFO': {
    'country': '中国',
    'province': '新疆',
    'district': '',
    'city': "Ewirgol",
    'lang': 'zh_CN',
    'isp': '亚洲',
    'description': '',
    'isChinaRegion': true,
    'region': '',
    'vd001ThirdPayEnabled': true,
    'iso_code': 'CN',
    'time_zone': "Asia/Urumqi",
    'ip': "124.118.178.207",
    'lib': 2
  },
  'SYSTEM': {
    'lang': "zh_CN",
    'currency': "CNY",
    'promotion': null
  },
  'webTitle': "6686"
};

如果您对文章内容有不同看法,或者疑问，欢迎到评论区留言，或者私信我都可以。

如遇自己源码加密后没备份，可以找我们解决解出恢复源码，任何加密都可以

服务器托管，北京服务器托管，服务器租用 http://www.fwqtg.net