阿里滑块验证码版本227破解（1）

亚洲最大电商阿里，为了防扒数据，做出了巨大的努力，越是遮遮掩掩，越要把他的衣服扒光了，与一众兄弟分享。今天是我生平第一次发文章，章法杂乱。阿里把这个fireyejs.js混淆到变态级别了，这种混淆具有两面性，o=30是初始化，o=25是滑动开始，o=40是取检验数据，生成227版本的字符串，o开始，接着是li。混淆到这种程度，矛盾的另外方面开始起作用了，就是可以根据li的变化提取运行指令。思路是：li如果确定，接下来的 switch (31 & li)就是确定的，当前的li运行后必须明确的把一个数值赋给li，根据当前的li和下一个li，就可以提取指令。提取出来的指令需要加工，里面对字符串的处理需要写成for循环。

下面是简单提取出来的指令，未经加工。

 ci = window,
                    Qo = s,
                    Yo = void 0,
                    mo = void 0,
                    li = (wo = o),
                    uo = (uo = "tcejbo").split("").reverse().join(""),
                    li = (co = typeof wo !== uo),
                    mo = void 0,
                    wo = mo,
                    mo = +o === o,
                    mo = void 0 === Yo,
                    wo = +o === o,
                    r.push(4, 3071828176897, 2, 1),
                    i(14, 2, -1),
                    uo = r.pop(),
                    co = uo,
                    uo = "",
                    So = "b",
                    Je = So += "ind",
                    So = "\u0219\u020c\u021b\u020f\u0206\u021b\u0204\u0208\u0207\u020a\u020c",
                    Ye = "",
                    we = 0,
                    we = (Y = P * fe),
                    Ce < _.length,
                    _ = ue,
                    ue = "sr",
                    Ce = ue += "c",
                    li = q,
                    q = 30 === o,
                    ue = "s",
                    ue += "ub",
                    ue += "stri",
                    Re = ue += "ng",
                    ue = "r",
                    ue += "ota",
                    ue += "giva",
                    ue += "n",
                    ue = ue.split("").reverse().join(""),
                    _e = ue,
                    r.push(83190, 56046782639, 2, 2),
                    i(14, 2, -1),
                    ue = r.pop(),
                    ne = ue,
                    ue = (ue = "yarrA").split("").reverse().join(""),
                    me = ue,
                    ue = "Ob",
                    ue += "j",
                    Qe = ue += "ect",
                    ue = "R",
                    ue += "egE",
                    jo = ue += "xp",
                    ue = (ue = "ytreporPenifed").split("").reverse().join(""),
                    so = ue,
                    ue = "ro",
                    ue = (ue += "rrE").split("").reverse().join(""),
                    He = ue,
                    ue = (ue = "teg").split("").reverse().join(""),
                    Ro = ue,
                    ue = "cd",
                    ue += "c_",
                    ue += "adoQ",
                    ue += "poas",
                    ue += "nfa76pfc",
                    ue += "Z",
                    ue += "Lmcfl_Sym",
                    ze = ue += "bol",
                    ue = (ue = "tnemucod").split("").reverse().join(""),
                    ei = ue,
                    r.push(14645503911, 4408175443116, 2, 1),
                    i(14, 2, -1),
                    ue = r.pop(),
                    Wo = ue,
                    ue = "SC",
                    ue += "RIP",
                    zo = ue += "T",
                    ue = "s",
                    ue += "etT",
                    ue += "im",
                    ue += "e",
                    _o = ue += "out",
                    ue = "g",
                    ue += "et",
                    ue += "El",
                    ue += "em",
                    ue += "entsBy",
                    Ho = ue += "TagName",
                    ue = "HE",
                    Fo = ue += "AD",
                    ue = "a",
                    ue += "ppen",
                    ue += "d",
                    ue += "Ch",
                    Vo = ue += "ild",
                    ue = "yx",
                    ue += "o",
                    ue += "rPo",
                    ue = (ue += "n").split("").reverse().join(""),
                    ho = ue,
                    ue = "\u0330\u032c\u032c\u0328\u032b\u0362\u0377\u0377",
                    Mo = "",
                    ao = 0,
                    ao - 216,
                    No = Ke.charCodeAt(Eo),
                    vo = No ^ Lo,
                    Lo = No,
                    To += String.fromCharCode(vo),
                    li = Oo,
                    Eo++,
                    Eo - 216,
                    No = Ke.charCodeAt(Eo),
                    vo = No ^ Lo,
                    Lo = No,