spider/js_reverse
1
0
Fork 0
mirror of https://github.com/luzhisheng/js_reverse.git synced 2025-04-19 12:04:47 +08:00
Code Issues Packages Projects Releases Wiki Activity

调试websocket

Browse Source
This commit is contained in:
luzhisheng 2022-02-08 18:09:28 +08:00
parent 4a96831b17
commit 5bb96e053c
5 changed files with 77675 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
img/44.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 58 KiB

BIN
img/45.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 36 KiB

BIN
img/46.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 199 KiB

77653
zy-websocket/案例.js Normal file
View File

File diff suppressed because one or more lines are too long

21
zy-websocket/案例站.md
View File

@ -37,8 +37,29 @@ hook
发送弹暮测试，定位到加密函数 发送弹暮测试，定位到加密函数
w && m.connected && w.send(t)
这里的 && 如果 w为true， m.connected为true，w.send(t)为true。执行w.send(t)
![debugger](../img/44.png)
这里可以看到t是发送的二进制的数据
![debugger](../img/43.png) ![debugger](../img/43.png)
r 值序列化数据
a = JSON.stringify(r)
b = JSON.parse(a)
![debugger](../img/46.png)
r中间存在我发送的代码内容，打上断点 r中间存在我发送的代码内容，打上断点
d.writeStruct("tReq", r) d.writeStruct("tReq", r)
这里能发现 d 存在方法做加密，d是由 var d = new l.Wup; 得到的，那么现在需要搞定 l 值。
![debugger](../img/45.png)
l 值是 h.Taf 得到的， h 值是 t.taf 得到的，那买t值？t值是传入的