JS反混淆-虚假控制流

0x00 问题描述

在混淆代码中，发现多段如下形式的代码：

11 == cn ? (Ne = pe, ue = Ne, nn = 23907) : 11 > cn ? 5 == cn ? (m = void 0, _ = 0, nn = 8549) : 5 > cn ? 2 == cn ? (N = l, K = N, N = K, Oe = Oe.concat(N), nn = 23105) : 2 > cn ? 0 == cn ? (ae = ue[se], me = ae[ro], nn = 14785) : cn > 0 && (I = Y % 128, Oe = Y - I, Y = Oe / 128, Oe = [], N = I + 128, I = 63 & Y, Y = 64 * m, m = I + Y, Oe.push(N, m), J = Oe, nn = 1472) : 3 == cn ? (F = I, nn = 18441) : cn > 3 && (Ee = "e", Ee += "l", Ee += "barugi", Ee += "fnoc", Ee = Ee.split("").reverse().join(""), B = U[Ee], nn = 19139) : 8 == cn ? (K = F % 128, l = F - K, F = l / 128, l = [], f = K + 128,