spider/js_reverse
1
0
Fork 0
mirror of https://github.com/luzhisheng/js_reverse.git synced 2025-04-20 10:25:01 +08:00
Code Issues Packages Projects Releases Wiki Activity

猿人学第5题-js 混淆-乱码增强-补环境-atob

Browse Source
This commit is contained in:
luzhisheng 2023-03-09 11:38:41 +08:00
parent ac0d00d79b
commit 883e2168da
1 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
猿人学第5题-js 混淆-乱码增强-补环境-atob/readme.md
View File

@ -6,23 +6,23 @@
直接说明了主要破解cookie中的`m=`和`RM4hZBv0dDon443M=`
![图片](../img/1.png)
![图片](./img/1.png)
油猴插件`hook cookie`
![图片](../img/2.png)
![图片](./img/2.png)
很容易就找到`RM4hZBv0dDon443M=`加密点
![图片](../img/3.png)
![图片](./img/3.png)
调试内存栈，就会发现`_0x4e96b4['_$ss']`是加密位置
![图片](../img/4.png)
![图片](./img/4.png)
全局搜索`_0x4e96b4['_$`找到赋值位置
![图片](../img/5.png)
![图片](./img/5.png)
仔细观察这断代码是不是`crypto-js`加密，mode是`ECB`，padding是`Pkcs7`
@ -33,31 +33,31 @@
}),
_0x4e96b4['_$' + _$UH[0x348][0x1] + _$UH[0x353][0x1]] = _0x29dd83[_$UH[0x1f]]();
![图片](../img/6.png)
![图片](./img/6.png)
通过上面的代码就需要找到`_0x4e96b4['_$pr']`和`_0x4e96b4[_0xc77418('0x6', 'OCbs')]`
这里的`_0x4e96b4[_0xc77418('0x6', 'OCbs')]`改写成`_0x4e96b4["_$qF"]`
![图片](../img/9.png)
![图片](./img/9.png)
全局搜索找到`_0x4e96b4['_$qF']`，这样能确定的是CryptoJS加密密钥是时间戳
![图片](../img/10.png)
![图片](./img/10.png)
在看看`_0x4e96b4['_$pr']`加密值，是数组
![图片](../img/11.png)
![图片](./img/11.png)
尝试写死2个参数，一点点扣代码改写
![图片](../img/7.png)
![图片](./img/7.png)
其中`btoa`和`atob`是需要自己补的，node中没有`btoa`和`atob`函数
结果输出
![图片](../img/8.png)
![图片](./img/8.png)
pr = [
"b2148c31fb09c98f90ce78424d6cdd58",