diff --git a/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/HTMLElements/htmlDivElement.js b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/HTMLElements/htmlDivElement.js new file mode 100644 index 0000000..669e370 --- /dev/null +++ b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/HTMLElements/htmlDivElement.js @@ -0,0 +1,23 @@ +const HtmlDivElement =function HtmlDivElement() +{ + throw new TypeError('Illegal constructor') +} +catvm.safefunction(HtmlDivElement); + +Object.defineProperties(HtmlDivElement.prototype,{ + [Symbol.toStringTag]:{ + value:'HtmlDivElement', + configurable:true, + } +}) + +//htmlDivElement = catvm.proxy(htmlDivElement) + +catvm.memory.htmlElements['div'] = function(){ + const div = new (function(){}) + + div.align = '' + + div.__proto__ = HtmlDivElement.prototype + return div +} \ No newline at end of file diff --git a/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/HTMLElements/htmlElements.node.js b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/HTMLElements/htmlElements.node.js new file mode 100644 index 0000000..f5fc5fa --- /dev/null +++ b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/HTMLElements/htmlElements.node.js @@ -0,0 +1,14 @@ +import fs from 'fs'; +import path from 'path'; +import { fileURLToPath } from 'url'; +const __filename = fileURLToPath(import.meta.url); +const __dirname = path.dirname(__filename); + +export default function GetCode(){ + let code = '' + code += fs.readFileSync(`${__dirname}/htmlDivElement.js`) + '\r\n' + + + + return code +} \ No newline at end of file diff --git a/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/document.js b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/document.js new file mode 100644 index 0000000..3e8589a --- /dev/null +++ b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/document.js @@ -0,0 +1,38 @@ +const Document =function Document() +{ + +} + +catvm.safefunction(Document); + +Object.defineProperties(Document.prototype,{ + [Symbol.toStringTag]:{ + value:'Document', + configurable:true, + } +}) + +document = {} +document.__proto__ = Document.prototype +document.cookie = '' +document.referrer = location.href || '' +document.getElementById = function getElementById(id){ + return null +} +catvm.safefunction(document.getElementById) +document.addEventListener = function addEventListener(type,listener,useCapture){ + +} +catvm.safefunction(document.addEventListener) + +document.createElement = function createElement(tagName){ + let tagname = tagName.toLowerCase() + '' + if(catvm.memory.htmlElements[tagname] == undefined){ + debugger + } + return catvm.proxy(catvm.memory.htmlElements[tagname]()) + +} +catvm.safefunction(document.createElement) + +document = catvm.proxy(document) \ No newline at end of file diff --git a/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/eventTarget.js b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/eventTarget.js new file mode 100644 index 0000000..ad26e69 --- /dev/null +++ b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/eventTarget.js @@ -0,0 +1,27 @@ +const EventTarget =function EventTarget() +{ + +} +catvm.safefunction(EventTarget); + +Object.defineProperties(EventTarget.prototype,{ + [Symbol.toStringTag]:{ + value:'EventTarget', + configurable:true, + } +}) +EventTarget.prototype.addEventListener = function addEventListener(type,callback){ + if(!(type in catvm.memory.listeners)){ + catvm.memory.listeners[type] = [] + } + catvm.memory.listeners[type].push(callback) +} +catvm.safefunction(EventTarget.prototype.addEventListener); +EventTarget.prototype.dispatchEvent = function dispatchEvent(){ + +} +catvm.safefunction(EventTarget.prototype.dispatchEvent); +EventTarget.prototype.removeEventListener = function removeEventListener(){ + +} +catvm.safefunction(EventTarget.prototype.removeEventListener); \ No newline at end of file diff --git a/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/history.js b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/history.js new file mode 100644 index 0000000..8c76ea8 --- /dev/null +++ b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/history.js @@ -0,0 +1,19 @@ +const History =function History() +{ + throw new TypeError('Illegal constructor') +} +catvm.safefunction(History); + +Object.defineProperties(History.prototype,{ + [Symbol.toStringTag]:{ + value:'History', + configurable:true, + } +}) +History.prototype.back = function back(){} +catvm.safefunction(History.prototype.back); + +history = {} +history.__proto__ = History.prototype + +history = catvm.proxy(history) \ No newline at end of file diff --git a/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/htmlDocument.js b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/htmlDocument.js new file mode 100644 index 0000000..e69de29 diff --git a/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/location.js b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/location.js new file mode 100644 index 0000000..7c16c5b --- /dev/null +++ b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/location.js @@ -0,0 +1,18 @@ +const Location =function Location() +{ + throw new TypeError('Illegal constructor') +} +catvm.safefunction(Location); + +Object.defineProperties(Location.prototype,{ + [Symbol.toStringTag]:{ + value:'Location', + configurable:true, + } +}) + +location = {} +location.__proto__ = Location.prototype +location.href = '' + +location = catvm.proxy(location) \ No newline at end of file diff --git a/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/mimeType.js b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/mimeType.js new file mode 100644 index 0000000..3a07c01 --- /dev/null +++ b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/mimeType.js @@ -0,0 +1,42 @@ +catvm.memory.MimeType = {} + +const MimeType =function MimeType() +{ + throw new TypeError('Illegal constructor') +} +catvm.safefunction(MimeType); + +Object.defineProperties(MimeType.prototype,{ + [Symbol.toStringTag]:{ + value:'MimeType', + configurable:true, + } +}) + +MimeType.prototype.description = '' +MimeType.prototype.enabledPlugin = null +MimeType.prototype.suffixes = '' +MimeType.prototype.type = 0 + +for (let pr in MimeType.prototype) { + if(typeof (MimeType.prototype[pr]) != 'function'){ + MimeType.prototype.__defineGetter__(pr,function(){ + return this[pr] + } + ) + } + +} + +catvm.memory.MimeType.new = function(data,initPlugin){ + let mimeType = {} + + if(data != undefined){ + mimeType.description = data.description + mimeType.enabledPlugin = initPlugin + mimeType.suffixes = data.suffixes + mimeType.type = data.type + } + mimeType.__proto__ = MimeType.prototype + return mimeType +} \ No newline at end of file diff --git a/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/mimeTypeArray.js b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/mimeTypeArray.js new file mode 100644 index 0000000..1062ab8 --- /dev/null +++ b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/mimeTypeArray.js @@ -0,0 +1,72 @@ +catvm.memory.MimeTypeArray = {} + +const MimeTypeArray =function MimeTypeArray() +{ + throw new TypeError('Illegal constructor') +} +catvm.safefunction(MimeTypeArray); + +catvm.memory.MimeTypeArray.iterator = function values(){ + debugger + +} +catvm.safefunction(catvm.memory.MimeTypeArray.iterator); + +Object.defineProperties(MimeTypeArray.prototype,{ + [Symbol.toStringTag]:{ + value:'MimeTypeArray', + configurable:true, + }, + [Symbol.iterator]:{ + value:catvm.memory.MimeTypeArray.iterator, + configurable:true, + } +}) + +MimeTypeArray.prototype.item = function item(index){ + debugger + return this[index] + +} +catvm.safefunction(MimeTypeArray.prototype.item) +MimeTypeArray.prototype.namedItem = function namedItem(key){ + debugger + return this[key] +} +catvm.safefunction(MimeTypeArray.prototype.namedItem) + +MimeTypeArray.prototype.length = 0 + +for (let pr in MimeTypeArray.prototype) { + if(typeof (MimeTypeArray.prototype[pr]) != 'function'){ + MimeTypeArray.prototype.__defineGetter__(pr,function(){ + throw new TypeError('Illegal constructor') + } + ) + } + +} + +navigator.mimeTypes = {} +/* navigator.mimeTypes.temp = 0 + +for (let pindex = 0; pindex < navigator.plugins.length; pindex++) { + let plugin_ = navigator.plugins.item(pindex) + for (let mindex = 0; mindex < plugin_.length; mindex++) { + let mimeType_ = plugin.item(mindex) + if(navigator.mimeTypes[mimeType_.type] == undefined){ + navigator.mimeTypes[navigator.mimeTypes.temp] = mimeType_ + Object.defineProperty(navigator.mimeTypes,mimeType_.type,{ + value:mimeType_, + }) + navigator.mimeTypes.temp++ + } + + } + + +} +delete navigator.mimeTypes.temp */ + +navigator.mimeTypes.__proto__ = MimeTypeArray.prototype +navigator.mimeTypes = catvm.proxy(navigator.mimeTypes) \ No newline at end of file diff --git a/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/navigator.js b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/navigator.js new file mode 100644 index 0000000..53d07b8 --- /dev/null +++ b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/navigator.js @@ -0,0 +1,35 @@ +const Navigator =function Navigator() +{ + throw new TypeError('Illegal constructor') +} +catvm.safefunction(Navigator); + +Object.defineProperties(Navigator.prototype,{ + [Symbol.toStringTag]:{ + value:'Navigator', + configurable:true, + } +}) +Object.getOwnPropertyDescriptor_ = Object.getOwnPropertyDescriptor; +Object.getOwnPropertyDescriptor = function(tag, val){ + // tag[Symbol.toStringtag] + if(tag.toLocaleString() == '[object Navigator]'){ + return undefined; + } + return Object.getOwnPropertyDescriptor_.apply(this,arguments) +} + +Navigator.prototype.plugins = [] +Navigator.prototype.language = ['zh-CN','zh'] +Navigator.prototype.userAgent = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36' +navigator = {} +navigator.__proto__ = Navigator.prototype +for (let prototype_ in Navigator.prototype) { + navigator[prototype_] = Navigator.prototype[prototype_] + Navigator.prototype.__defineGetter__(prototype_,function(){ + throw new TypeError('Illegal constructor') + }) + +} + +navigator = catvm.proxy(navigator) \ No newline at end of file diff --git a/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/plugin.js b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/plugin.js new file mode 100644 index 0000000..c0510eb --- /dev/null +++ b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/plugin.js @@ -0,0 +1,95 @@ +catvm.memory.Plugin = {} + +const Plugin =function Plugin() +{ + throw new TypeError('Illegal constructor') +} +catvm.safefunction(Plugin); + +catvm.memory.Plugin.iterator = function values(){ + debugger + return { + next:function(){ + if(this.index_ == undefined){ + this.index_ = 0 + } + let temp = this.self_[this.index_] + this.index_++ + if(temp!=undefined) + { + return {done:false,value:temp} + } + else + { + return {done:true,value:undefined} + } + }, + self_:this, + } +} +catvm.safefunction(catvm.memory.Plugin.iterator); + +Object.defineProperties(Plugin.prototype,{ + [Symbol.toStringTag]:{ + value:'Plugin', + configurable:true, + }, + [Symbol.iterator]:{ + value:catvm.memory.Plugin.iterator, + configurable:true, + } +}) + +Plugin.prototype.description = '' +Plugin.prototype.filename = '' +Plugin.prototype.name = '' +Plugin.prototype.length = 0 + +Plugin.prototype.item = function item(index){ + debugger + return this[index] +} +catvm.safefunction(Plugin.prototype.item); +Plugin.prototype.namedItem = function namedItem(key){ + debugger + return this[key] +} +catvm.safefunction(Plugin.prototype.namedItem); + +for (let pr in Plugin.prototype) { + if(typeof (Plugin.prototype[pr]) != 'function'){ + Plugin.prototype.__defineGetter__(pr,function(){ + throw new TypeError('Illegal constructor') + } + ) + } + +} + + +catvm.memory.Plugin.new = function(data){ + let plugin = {} + + if(data != undefined){ + plugin.description = data.description + plugin.filename = data.filename + plugin.name = data.name + + if(data.MimeTypes != undefined){ + for (let mtindex = 0; mtindex < data.MimeTypes.length; mtindex++) { + let mtindex = data.MimeTypes[mtindex] + let mimeType = catvm.memory.MimeType.new(mtindex,plugin) + + plugin[mtindex] = mimeType + /* plugin[mimeType.type] = mimeType */ + Object.defineProperty(plugin,mimeType.type,{ + value:mimeType, + }) + + + }} + plugin.length = data.MimeTypes.length + } + plugin.__proto__ = Plugin.prototype + return plugin +} \ No newline at end of file diff --git a/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/pluginArray.js b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/pluginArray.js new file mode 100644 index 0000000..2a95e2f --- /dev/null +++ b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/pluginArray.js @@ -0,0 +1,57 @@ + + +const PluginArray =function PluginArray() +{ + throw new TypeError('Illegal constructor') +} +catvm.safefunction(PluginArray); + +catvm.memory.PluginArray.iterator = function values(){ + debugger + +} +catvm.safefunction(catvm.memory.PluginArray.iterator); + +Object.defineProperties(PluginArray.prototype,{ + [Symbol.toStringTag]:{ + value:'PluginArray', + configurable:true, + }, + [Symbol.iterator]:{ + value:catvm.memory.PluginArray.iterator, + configurable:true, + } +}) + +PluginArray.prototype.item = function item(index){ + debugger + return this[index] + +} +catvm.safefunction(PluginArray.prototype.item) +PluginArray.prototype.namedItem = function namedItem(key){ + debugger + return this[key] +} +catvm.safefunction(PluginArray.prototype.namedItem) +PluginArray.prototype.refresh = function refresh(){ + debugger +} +catvm.safefunction(PluginArray.prototype.refresh) +PluginArray.prototype.length = 0 + +for (let pr in PluginArray.prototype) { + if(typeof (PluginArray.prototype[pr]) != 'function'){ + PluginArray.prototype.__defineGetter__(pr,function(){ + throw new TypeError('Illegal constructor') + } + ) + } + +} + +catvm.memory.PluginArray._ = {} +catvm.memory.PluginArray._.__proto__ = PluginArray.prototype +catvm.memory.PluginArray._= catvm.proxy(catvm.memory.PluginArray._) + +navigator.plugins = catvm.memory.PluginArray._ diff --git a/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/screen.js b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/screen.js new file mode 100644 index 0000000..14806b0 --- /dev/null +++ b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/screen.js @@ -0,0 +1,17 @@ +const Screen =function Screen() +{ + throw new TypeError('Illegal constructor') +} +catvm.safefunction(Screen); + +Object.defineProperties(Screen.prototype,{ + [Symbol.toStringTag]:{ + value:'Screen', + configurable:true, + } +}) + +screen = {} +screen.__proto__ = Screen.prototype + +screen = catvm.proxy(screen) \ No newline at end of file diff --git a/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/storage.js b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/storage.js new file mode 100644 index 0000000..29d4b38 --- /dev/null +++ b/志远js逆向学习/zy-补环境框架-实现/CatVm2/browser/storage.js @@ -0,0 +1,50 @@ +const Storage =function Storage() +{ + throw new TypeError('Illegal constructor') +} +catvm.safefunction(Storage); + +Object.defineProperties(Storage.prototype,{ + [Symbol.toStringTag]:{ + value:'Storage', + configurable:true, + } +}) + +Storage.prototype.length=0; +Storage.prototype.clear=function clear(){ + debugger + let temp = Object.keys(this) + for(let key =0 ;key { + 'use strict'; + const $toString = Function.toString + const myFunction_toString_symbol = Symbol('('.concat('', ')_', (Math.random() + '').toString(36))) + const myToString = function () { + return typeof this == 'function' && this[myFunction_toString_symbol] || $toString.call(this) + } + + function set_native(func, key, value) { + Object.defineProperty(func, key, { + "enumerable": false, + 'configurable': true, + 'writable': true, + 'value': value + }) + } + + delete Function.prototype['toString'];// 删除原型链上的toString + set_native(Function.prototype, 'toString', myToString);// 自己定义一个getter方法 + // 套娃给 toString 方法设置一个 toString + set_native(Function.prototype.toString, myFunction_toString_symbol, 'function toString(){ [native code] }') + this.catvm.safefunction = (func) => { + set_native(func, myFunction_toString_symbol, `function ${myFunction_toString_symbol, func.name || ''}() { [native code] }`) + } +}).call(this); \ No newline at end of file diff --git a/志远js逆向学习/zy-补环境框架-实现/CatVm2/tools/tools.js b/志远js逆向学习/zy-补环境框架-实现/CatVm2/tools/tools.js new file mode 100644 index 0000000..40e4280 --- /dev/null +++ b/志远js逆向学习/zy-补环境框架-实现/CatVm2/tools/tools.js @@ -0,0 +1,5 @@ +//更改浏览器某些参数 + +catvm.AddPlugin = function(data){ + +} \ No newline at end of file diff --git a/志远js逆向学习/zy-补环境框架-实现/README.md b/志远js逆向学习/zy-补环境框架-实现/README.md new file mode 100644 index 0000000..c971a63 --- /dev/null +++ b/志远js逆向学习/zy-补环境框架-实现/README.md @@ -0,0 +1,38 @@ +项目参考：js逆向之模拟浏览器环境 + + https://hexo-fanchangrui.vercel.app/2022/08/05/js%E9%80%86%E5%90%91%E4%B9%8B%E6%A8%A1%E6%8B%9F%E6%B5%8F%E8%A7%88%E5%99%A8%E7%8E%AF%E5%A2%83/ + +# 补环境框架实现 +``` +. +├── CatVm2 文件目录 +│ ├── browser 浏览器环境 +│ │ ├── HTMLElements +│ │ ├── document.js +│ │ ├── eventTarget.js +│ │ ├── history.js +│ │ ├── htmlDocument.js +│ │ ├── location.js +│ │ ├── mimeType.js +│ │ ├── mimeTypeArray.js +│ │ ├── navigator.js +│ │ ├── plugin.js +│ │ ├── pluginArray.js +│ │ ├── screen.js +│ │ ├── storage.js +│ │ ├── window.js window环境 +│ │ ├── windowProperties.js +│ │── tools +│ │ ├── memory.js 框架运行内存 +│ │ ├── node.js 将工具代码组合 +│ │ ├── print.js 框架日志功能 +│ │ ├── proxy.js 框架代理功能 +│ │ ├── safefunction.js 补环境的自定义方法 +│ │ ├── tools.js 更改浏览器某些参数 +│ │─── catvm2.node.js 补环境的拼接代码 +├── code.js 原代码 +├── index.js 启动代码 +├── README.md 文档 +``` + +## 补window环境 diff --git a/志远js逆向学习/zy-补环境框架-实现/code.js b/志远js逆向学习/zy-补环境框架-实现/code.js new file mode 100644 index 0000000..e69de29 diff --git a/志远js逆向学习/zy-补环境框架-实现/index.js b/志远js逆向学习/zy-补环境框架-实现/index.js new file mode 100644 index 0000000..e4eda5d --- /dev/null +++ b/志远js逆向学习/zy-补环境框架-实现/index.js @@ -0,0 +1,21 @@ +import fs from 'fs'; +// 从 vm2 模块中导入了 VM 和 VMScript 两个类 +import {VM, VMScript} from 'vm2'; + +// 引入需要执行的js文件 +import cat_vm2 from './CatVm2/catvm2.node.js'; +import path from 'path'; + +// 获取当前文件的目录 +import {fileURLToPath} from 'url'; +const __filename = fileURLToPath(import.meta.url); +const __dirname = path.dirname(__filename); + + +const cat_vm2_code = cat_vm2({proxy: true}); +const code_file = `${__dirname}/code.js`; +const vm = new VM() +const script = new VMScript(cat_vm2_code + fs.readFileSync(code_file), `${__dirname}/调试.js`); +debugger +vm.run(script); +debugger \ No newline at end of file