逆向案例二十一——遇到混淆怎么办

最新推荐文章于 2024-07-18 11:48:33 发布

努力学习各种软件

最新推荐文章于 2024-07-18 11:48:33 发布

阅读量856

点赞数 7

文章标签： javascript 爬虫

本文链接：https://blog.csdn.net/m0_57265868/article/details/137651211

版权

开始新的板块尝试，混淆了怎么办

网址：极简壁纸_海量电脑桌面壁纸美图_4K超高清_最潮壁纸网站

抓包抓到，好久没做解密了，奥里给干他！：

搜索关键字，打上断点，点击第二页。

_0x10a345就是明文已经出现，现在就是确定是什么函数解密的。

很明显啊，前一行代码就是疑似解密的位置，打上断点，点击下一页。在控制台打印。

OK，已经确定好了解密函数了。分析这段代码！

JSON['parse'](_0x5401c5['a']['decipher'](_0x38f555['data']['result']))

使用了某种加密算法来解密 data 对象中的 result 字段，然后通过 JSON.parse() 解析得到的解密结果。

具体来说，它首先调用 _0x5401c5['a']['decipher']() 函数对 data['result'] 进行解密，然后将解密后的结果传递给 JSON.parse() 函数进行解析。

那么就找到这个函数的位置，控制台打印

确定位置打上断点

_0xzz53b5就是传入的密文，返回的是明文。很明显，这里又嵌套了别的函数。_0x1b12e2(_0x388932(_0xbcd174(_0x2253b5)))

要找到的未定义包括_0x1b12e2，_0x388932，_0xbcd174

先复制代码：

_0x2253b5 = 'ak+9VCsq4dEdB+UdVfGo8kh5JDEbMHGTCmF/ACXJQ0IgGEauVgivRFLreNzrhFPP2wTUOBzYbqpOsl2NAezyg9rgZStPA6xJ+j9L3h9lfJ/+zIfKG1j6Eh/bWp9BcjXF3RMhCk3P2kFG5fHTK8myMdL+FT/K7sLwE1urbVYF17VKP3V0k27y/uF2ZRX3UnhBQbsvhwB6hZgJ0vuBLeHPQ4WPcc+pZmk5dO4FmTSXrxie+iq1IXGiQRSVvz9YwfwDqj78BwHRgZR+ibYi3qQH4yLIKCFj7UDw9WxFzatw98cEpoLETlB855xgiCrYeRsKPSU+TghsmJg9LuHzcvbIZ7WURHr5PGt4ARP3bOe4HYD9Sf5IfQCCUOh2OH1qt+64POe7OpsIhcZlb9fMyhajmgO1u3RHfC44UMVZDBHHt6Fbx5ETTx0Z9m94gQDPTLaJ45BePjdKEySVWXmrYwalKsFPvIL3QJ9KZ7INGYZIE1G6mGLBHFGbB8NCDOSqRMI6p0XahnEiM0/KFDIL3jFICVT8Lk7Sj06QCrXb8eEBJWVwp6AYL7z/74rAgaIeCXWBt5Zq1aA1pEMT6rpz8vl1B3e98bhvYPL3+dKoNu0VTF5L8zXUvhQaeDNK9dtuqy4sTzzrsUWLoId4S0tclXPIfb9unysoI0RTTQxdvIEoYmQgI9998AW9tmsdW+lP+aF4oP1Nr5HNKPiJyi0tW5h2NKRn7LTd2gwPzqKCEHBq1UbGFjlvoqfjEtbiqc9VQh2h172xi3D93JEfnbh1YxLM2MMm+CZidBnYinB7PXK7n7bUL6WRFs4mqN9Vud4neDQkXJa95WCF+7xGhBlFNjLmpbackdyA62cYOGnpJ6JaBUB4nrYDijugnphX2cujfNoR6CVBgxgSobos/9+iNb8FRDEeoNB9P6OEmIx+QhVQK6GCX6M15Mj6NZxmDxdzONE0B96YSp+wjVNd7HvJc1ne/W2oHtglEZWvKTnZ9lkveK9cMgJ5GfAjkWRhjgD++8cDdyc12RTfKYvCUouXmPixim7hX3T4HlIFehyIw5I6gGrjT66xnZBWmbZiOeC3UpB8Tg+8RpohA7TU74m6kgJCDrQhNIB8SC6EeWbHvpRrMBnCyu+yTHBWqvBFiTEE5Ez/2/ASkqTzJ8HDHuvYW6ZThRi7NYQCWUN7rCytnPOpPE2m4u4BHPng4A0DcmedgvWPeQxLmAZGgoOesAofMYoR1weyiKx5WnFFomEbi2UG42mRQfn8Z5kL6QkLhnxdRrVMYfOTOjmbQ5iZs/Seznc5bhCxVascJ4BOinrw0jWizWRLZYb+VnpVejD5SVM9+gP9sQHl7xy4GJepIBWpwetMhxVybLV4EDwaeFseeB7XfR3QpqszMOspG81ov2/43ClLGtS9TV6if/cgUIHxBmCjH4gQCnktpxxGlpZ0R2oKV0QJSHrvHauOemO6Y4CWKA4Mgx1mB1fCHfB8BJGu9bwE0Ehtca5tFzRKNZ6qWcVnZqxOBVvVYsEFUwVDMtd1BsxCQljGJyezECYSNdXBS4QS0ySoLC0YUt8fg9Zs6lQeEuNDc2/Zu5wPutvpLXV8iP2D0mhT/ronXglLbePFPYoKhxH09v5TPb2MK1eh64LqMVq94KmSp4NyShLGmACpfxrWbUUKTXPf08MXyj6XbSLA7rlIPcgvlH2xF9oJPnk15EOWSnHkxW47t3zh3hCw/8xW/PeZY/C+q/Bzlke9VeTDBpvo5HFwOV8XmL1pEQ8SUqjc1QdgRvphtmAKy73cJYc31AoptmiauEmBtY8IMoqb02jmr4w4dYmg670jt9c/qTUiclhqh+X48kohciYUmz1X+KMQen/Qkv1SUM1Fi3f0hcHMOek2KR/ZXeMOFj9PGea9KEYN+Ofn1xM9uJdCGSizXo1FEomyvuBhqzfgzj8KE8mGrdfqm7KZpASea1P8s7tmHHq8RUYVYRSvnpoDZd6GNRPYpVGO6iDuh2kQl03Syaq/N4Dbc+p0PP3+OY9GGue8WexeWI5WQhLvBflzfSJFjVJTUfSlLmNs5meMxbZ2naFTfy2iK+3u9kDV37ENY09BwT1x3eSBUBj5V3E0fAIo17Z7yuf9na0vJYht7VrxSQAJoBormCVhAJ7k4CrUNtU6k2G/xofL5slSTt7hasGil03Cv5OYDclGq0gBcUwFvAajQbUK'

function _0x461344(_0x2253b5) {
            return _0x1b12e2(_0x388932(_0xbcd174(_0x2253b5)));
}
console.log(_0x461344(_0x2253b5))

不出意外的，要出意外了。

那么开始扣代码吧！

看看代码在哪，就在上面

复制之后的代码：

_0x2253b5 = 'ak+9VCsq4dEdB+UdVfGo8kh5JDEbMHGTCmF/ACXJQ0IgGEauVgivRFLreNzrhFPP2wTUOBzYbqpOsl2NAezyg9rgZStPA6xJ+j9L3h9lfJ/+zIfKG1j6Eh/bWp9BcjXF3RMhCk3P2kFG5fHTK8myMdL+FT/K7sLwE1urbVYF17VKP3V0k27y/uF2ZRX3UnhBQbsvhwB6hZgJ0vuBLeHPQ4WPcc+pZmk5dO4FmTSXrxie+iq1IXGiQRSVvz9YwfwDqj78BwHRgZR+ibYi3qQH4yLIKCFj7UDw9WxFzatw98cEpoLETlB855xgiCrYeRsKPSU+TghsmJg9LuHzcvbIZ7WURHr5PGt4ARP3bOe4HYD9Sf5IfQCCUOh2OH1qt+64POe7OpsIhcZlb9fMyhajmgO1u3RHfC44UMVZDBHHt6Fbx5ETTx0Z9m94gQDPTLaJ45BePjdKEySVWXmrYwalKsFPvIL3QJ9KZ7INGYZIE1G6mGLBHFGbB8NCDOSqRMI6p0XahnEiM0/KFDIL3jFICVT8Lk7Sj06QCrXb8eEBJWVwp6AYL7z/74rAgaIeCXWBt5Zq1aA1pEMT6rpz8vl1B3e98bhvYPL3+dKoNu0VTF5L8zXUvhQaeDNK9dtuqy4sTzzrsUWLoId4S0tclXPIfb9unysoI0RTTQxdvIEoYmQgI9998AW9tmsdW+lP+aF4oP1Nr5HNKPiJyi0tW5h2NKRn7LTd2gwPzqKCEHBq1UbGFjlvoqfjEtbiqc9VQh2h172xi3D93JEfnbh1YxLM2MMm+CZidBnYinB7PXK7n7bUL6WRFs4mqN9Vud4neDQkXJa95WCF+7xGhBlFNjLmpbackdyA62cYOGnpJ6JaBUB4nrYDijugnphX2cujfNoR6CVBgxgSobos/9+iNb8FRDEeoNB9P6OEmIx+QhVQK6GCX6M15Mj6NZxmDxdzONE0B96YSp+wjVNd7HvJc1ne/W2oHtglEZWvKTnZ9lkveK9cMgJ5GfAjkWRhjgD++8cDdyc12RTfKYvCUouXmPixim7hX3T4HlIFehyIw5I6gGrjT66xnZBWmbZiOeC3UpB8Tg+8RpohA7TU74m6kgJCDrQhNIB8SC6EeWbHvpRrMBnCyu+yTHBWqvBFiTEE5Ez/2/ASkqTzJ8HDHuvYW6ZThRi7NYQCWUN7rCytnPOpPE2m4u4BHPng4A0DcmedgvWPeQxLmAZGgoOesAofMYoR1weyiKx5WnFFomEbi2UG42mRQfn8Z5kL6QkLhnxdRrVMYfOTOjmbQ5iZs/Seznc5bhCxVascJ4BOinrw0jWizWRLZYb+VnpVejD5SVM9+gP9sQHl7xy4GJepIBWpwetMhxVybLV4EDwaeFseeB7XfR3QpqszMOspG81ov2/43ClLGtS9TV6if/cgUIHxBmCjH4gQCnktpxxGlpZ0R2oKV0QJSHrvHauOemO6Y4CWKA4Mgx1mB1fCHfB8BJGu9bwE0Ehtca5tFzRKNZ6qWcVnZqxOBVvVYsEFUwVDMtd1BsxCQljGJyezECYSNdXBS4QS0ySoLC0YUt8fg9Zs6lQeEuNDc2/Zu5wPutvpLXV8iP2D0mhT/ronXglLbePFPYoKhxH09v5TPb2MK1eh64LqMVq94KmSp4NyShLGmACpfxrWbUUKTXPf08MXyj6XbSLA7rlIPcgvlH2xF9oJPnk15EOWSnHkxW47t3zh3hCw/8xW/PeZY/C+q/Bzlke9VeTDBpvo5HFwOV8XmL1pEQ8SUqjc1QdgRvphtmAKy73cJYc31AoptmiauEmBtY8IMoqb02jmr4w4dYmg670jt9c/qTUiclhqh+X48kohciYUmz1X+KMQen/Qkv1SUM1Fi3f0hcHMOek2KR/ZXeMOFj9PGea9KEYN+Ofn1xM9uJdCGSizXo1FEomyvuBhqzfgzj8KE8mGrdfqm7KZpASea1P8s7tmHHq8RUYVYRSvnpoDZd6GNRPYpVGO6iDuh2kQl03Syaq/N4Dbc+p0PP3+OY9GGue8WexeWI5WQhLvBflzfSJFjVJTUfSlLmNs5meMxbZ2naFTfy2iK+3u9kDV37ENY09BwT1x3eSBUBj5V3E0fAIo17Z7yuf9na0vJYht7VrxSQAJoBormCVhAJ7k4CrUNtU6k2G/xofL5slSTt7hasGil03Cv5OYDclGq0gBcUwFvAajQbUK'
 function _0x1b12e2(_0xb1af28) {
            let _0x166d21, _0x7151a5, _0x5a9a0d = '';
            for (var _0x38d9cb = 0x0; _0x38d9cb < _0xb1af28['length']; )
                _0x166d21 = _0xb1af28[_0x38d9cb],
                _0x7151a5 = 0x0,
                _0x166d21 >>> 0x7 === 0x0 ? (_0x5a9a0d += String['fromCharCode'](_0xb1af28[_0x38d9cb]),
                _0x38d9cb += 0x1) : 0xfc === (0xfc & _0x166d21) ? (_0x7151a5 = (0x3 & _0xb1af28[_0x38d9cb]) << 0x1e,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x1]) << 0x18,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x2]) << 0x12,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x3]) << 0xc,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x4]) << 0x6,
                _0x7151a5 |= 0x3f & _0xb1af28[_0x38d9cb + 0x5],
                _0x5a9a0d += String['fromCharCode'](_0x7151a5),
                _0x38d9cb += 0x6) : 0xf8 === (0xf8 & _0x166d21) ? (_0x7151a5 = (0x7 & _0xb1af28[_0x38d9cb]) << 0x18,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x1]) << 0x12,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x2]) << 0xc,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x3]) << 0x6,
                _0x7151a5 |= 0x3f & _0xb1af28[_0x38d9cb + 0x4],
                _0x5a9a0d += String['fromCharCode'](_0x7151a5),
                _0x38d9cb += 0x5) : 0xf0 === (0xf0 & _0x166d21) ? (_0x7151a5 = (0xf & _0xb1af28[_0x38d9cb]) << 0x12,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x1]) << 0xc,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x2]) << 0x6,
                _0x7151a5 |= 0x3f & _0xb1af28[_0x38d9cb + 0x3],
                _0x5a9a0d += String['fromCharCode'](_0x7151a5),
                _0x38d9cb += 0x4) : 0xe0 === (0xe0 & _0x166d21) ? (_0x7151a5 = (0x1f & _0xb1af28[_0x38d9cb]) << 0xc,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x1]) << 0x6,
                _0x7151a5 |= 0x3f & _0xb1af28[_0x38d9cb + 0x2],
                _0x5a9a0d += String['fromCharCode'](_0x7151a5),
                _0x38d9cb += 0x3) : 0xc0 === (0xc0 & _0x166d21) ? (_0x7151a5 = (0x3f & _0xb1af28[_0x38d9cb]) << 0x6,
                _0x7151a5 |= 0x3f & _0xb1af28[_0x38d9cb + 0x1],
                _0x5a9a0d += String['fromCharCode'](_0x7151a5),
                _0x38d9cb += 0x2) : (_0x5a9a0d += String['fromCharCode'](_0xb1af28[_0x38d9cb]),
                _0x38d9cb += 0x1);
            return _0x5a9a0d;
        };
function _0x388932(_0x1f2851) {
            let _0x9e49bd = [-0x6f, 0x34, 0x5b, 0x41, -0x41, 0x74, 0x77, 0x6a, -0x79, -0x52, -0x5, 0x50, 0x33, 0x61, 0x44, -0x53, -0x70, -0x33, 0x17, -0x2e, -0x22, -0x72, -0x37, -0xb, -0x7f, 0x5a, 0x21, 0x16, -0x1f, 0x32, -0x11, 0x14, -0x2c, 0xf, -0x5e, -0x7b, 0x76, -0x17, -0x3d, 0x72, 0x47, -0x68, -0x7e, -0x75, -0x51, -0x36, -0x12, -0x6e, -0x4, -0x5f, -0x5b, 0x5e, -0x50, -0xe, 0x78, 0x69, 0x55, 0x68, -0x56, -0x6c, 0x43, 0x19, 0x65, 0x6c, 0x10, -0x69, 0x6f, -0xa, 0x75, -0x49, 0x4d, 0x59, -0x1d, -0x62, -0x44, 0x70, 0x6b, -0x1, 0x56, 0x79, 0x58, -0x65, -0x7c, 0x45, -0x1e, -0x8, -0x71, -0x4a, -0x76, 0x39, -0x19, 0xc, -0x73, -0x6a, 0x5f, 0x7f, 0x54, 0x7c, -0x66, -0x1c, 0x49, 0x2b, -0x3c, 0x1c, 0x2e, 0x73, 0x1e, 0x7a, -0x4b, 0x7d, -0x43, -0x4d, 0x3, -0x7, -0x35, -0xd, 0x35, 0x4e, -0x48, 0x1, 0xb, -0x47, -0x27, -0x4f, -0x3, 0x13, 0x29, 0x7e, -0x2b, -0x7d, -0x1b, 0x22, 0x3f, 0x8, 0x48, -0x23, -0x29, -0x3f, 0x3c, -0x18, 0x66, 0x2f, -0x77, -0x67, -0x16, 0x2d, 0x3b, 0x40, -0x60, 0x31, 0x53, -0x6b, -0x78, -0x39, -0x46, 0x0, -0x26, -0x54, -0x28, 0x18, 0xe, 0x30, 0x1d, 0x2c, -0x24, -0x2f, 0x38, -0x5c, 0x26, 0x25, 0x4, -0x32, 0x67, 0xa, -0x59, 0x37, 0x71, -0x1a, 0x6e, 0x36, 0x24, -0x14, -0x4e, -0xc, -0x74, 0x46, -0x25, 0x5, -0x3e, -0x4c, -0x30, -0x40, 0x4f, 0x64, 0x28, 0x6, -0x3a, -0x5a, -0x13, -0x9, 0x27, 0x5d, -0x63, 0x15, 0x7, 0x1a, -0x2, 0x1b, -0x2d, 0x51, 0x3a, -0x7a, 0x4c, -0x42, 0x2, 0x5c, -0x2a, 0x62, -0x10, 0x9, 0x3d, 0x3e, -0xf, 0x63, -0x15, 0x1f, -0x38, 0x57, 0x11, -0x34, -0x45, -0x21, -0x3b, -0x55, 0x42, 0x4a, 0x12, -0x5d, -0x80, -0x57, -0x20, 0x2a, 0x20, -0x58, 0x6d, 0x60, 0xd, -0x6, 0x4b, -0x64, -0x31, 0x23, -0x61, 0x52, -0x6d, 0x7b]
              , _0x51471c = 0x0
              , _0x34e6f0 = 0x0
              , _0x59ee63 = 0x0
              , _0x5f1a04 = new Array();
            for (let _0x2192fb = 0x0; _0x2192fb < _0x1f2851['length']; _0x2192fb++) {
                _0x51471c = _0x51471c + 0x1 & 0xff,
                _0x34e6f0 = (0xff & _0x9e49bd[_0x51471c]) + _0x34e6f0 & 0xff;
                const _0x5aaee9 = _0x9e49bd[_0x51471c];
                _0x9e49bd[_0x51471c] = _0x9e49bd[_0x34e6f0],
                _0x9e49bd[_0x34e6f0] = _0x5aaee9,
                _0x59ee63 = (0xff & _0x9e49bd[_0x51471c]) + (0xff & _0x9e49bd[_0x34e6f0]) & 0xff,
                _0x5f1a04['push'](_0x1f2851[_0x2192fb] ^ _0x9e49bd[_0x59ee63]);
            }
            return _0x5f1a04;
        };
function _0xbcd174(_0x4c0a5e) {
            const _0xa531c2 = window['atob'](_0x4c0a5e)
              , _0x487e70 = new Int8Array(_0xa531c2['length']);
            for (let _0x1dad95 = 0x0; _0x1dad95 < _0xa531c2['length']; _0x1dad95++)
                _0x487e70[_0x1dad95] = _0xa531c2['charCodeAt'](_0x1dad95);
            return _0x487e70;
        };
function _0x461344(_0x2253b5) {
            return _0x1b12e2(_0x388932(_0xbcd174(_0x2253b5)));
};
console.log(_0x461344(_0x2253b5))

结果展现：

window['atob'](_0x4c0a5e)

这段代码使用了 JavaScript 中的 atob 函数来解码 _0x4c0a5e 变量所代表的 Base64 字符串。atob 函数用于将 Base64 编码的字符串解码为原始的 ASCII 字符串。

怎么改？

atob(_0x4c0a5e)

改进代码：

_0x2253b5 = 'ak+9VCsq4dEdB+UdVfGo8kh5JDEbMHGTCmF/ACXJQ0IgGEauVgivRFLreNzrhFPP2wTUOBzYbqpOsl2NAezyg9rgZStPA6xJ+j9L3h9lfJ/+zIfKG1j6Eh/bWp9BcjXF3RMhCk3P2kFG5fHTK8myMdL+FT/K7sLwE1urbVYF17VKP3V0k27y/uF2ZRX3UnhBQbsvhwB6hZgJ0vuBLeHPQ4WPcc+pZmk5dO4FmTSXrxie+iq1IXGiQRSVvz9YwfwDqj78BwHRgZR+ibYi3qQH4yLIKCFj7UDw9WxFzatw98cEpoLETlB855xgiCrYeRsKPSU+TghsmJg9LuHzcvbIZ7WURHr5PGt4ARP3bOe4HYD9Sf5IfQCCUOh2OH1qt+64POe7OpsIhcZlb9fMyhajmgO1u3RHfC44UMVZDBHHt6Fbx5ETTx0Z9m94gQDPTLaJ45BePjdKEySVWXmrYwalKsFPvIL3QJ9KZ7INGYZIE1G6mGLBHFGbB8NCDOSqRMI6p0XahnEiM0/KFDIL3jFICVT8Lk7Sj06QCrXb8eEBJWVwp6AYL7z/74rAgaIeCXWBt5Zq1aA1pEMT6rpz8vl1B3e98bhvYPL3+dKoNu0VTF5L8zXUvhQaeDNK9dtuqy4sTzzrsUWLoId4S0tclXPIfb9unysoI0RTTQxdvIEoYmQgI9998AW9tmsdW+lP+aF4oP1Nr5HNKPiJyi0tW5h2NKRn7LTd2gwPzqKCEHBq1UbGFjlvoqfjEtbiqc9VQh2h172xi3D93JEfnbh1YxLM2MMm+CZidBnYinB7PXK7n7bUL6WRFs4mqN9Vud4neDQkXJa95WCF+7xGhBlFNjLmpbackdyA62cYOGnpJ6JaBUB4nrYDijugnphX2cujfNoR6CVBgxgSobos/9+iNb8FRDEeoNB9P6OEmIx+QhVQK6GCX6M15Mj6NZxmDxdzONE0B96YSp+wjVNd7HvJc1ne/W2oHtglEZWvKTnZ9lkveK9cMgJ5GfAjkWRhjgD++8cDdyc12RTfKYvCUouXmPixim7hX3T4HlIFehyIw5I6gGrjT66xnZBWmbZiOeC3UpB8Tg+8RpohA7TU74m6kgJCDrQhNIB8SC6EeWbHvpRrMBnCyu+yTHBWqvBFiTEE5Ez/2/ASkqTzJ8HDHuvYW6ZThRi7NYQCWUN7rCytnPOpPE2m4u4BHPng4A0DcmedgvWPeQxLmAZGgoOesAofMYoR1weyiKx5WnFFomEbi2UG42mRQfn8Z5kL6QkLhnxdRrVMYfOTOjmbQ5iZs/Seznc5bhCxVascJ4BOinrw0jWizWRLZYb+VnpVejD5SVM9+gP9sQHl7xy4GJepIBWpwetMhxVybLV4EDwaeFseeB7XfR3QpqszMOspG81ov2/43ClLGtS9TV6if/cgUIHxBmCjH4gQCnktpxxGlpZ0R2oKV0QJSHrvHauOemO6Y4CWKA4Mgx1mB1fCHfB8BJGu9bwE0Ehtca5tFzRKNZ6qWcVnZqxOBVvVYsEFUwVDMtd1BsxCQljGJyezECYSNdXBS4QS0ySoLC0YUt8fg9Zs6lQeEuNDc2/Zu5wPutvpLXV8iP2D0mhT/ronXglLbePFPYoKhxH09v5TPb2MK1eh64LqMVq94KmSp4NyShLGmACpfxrWbUUKTXPf08MXyj6XbSLA7rlIPcgvlH2xF9oJPnk15EOWSnHkxW47t3zh3hCw/8xW/PeZY/C+q/Bzlke9VeTDBpvo5HFwOV8XmL1pEQ8SUqjc1QdgRvphtmAKy73cJYc31AoptmiauEmBtY8IMoqb02jmr4w4dYmg670jt9c/qTUiclhqh+X48kohciYUmz1X+KMQen/Qkv1SUM1Fi3f0hcHMOek2KR/ZXeMOFj9PGea9KEYN+Ofn1xM9uJdCGSizXo1FEomyvuBhqzfgzj8KE8mGrdfqm7KZpASea1P8s7tmHHq8RUYVYRSvnpoDZd6GNRPYpVGO6iDuh2kQl03Syaq/N4Dbc+p0PP3+OY9GGue8WexeWI5WQhLvBflzfSJFjVJTUfSlLmNs5meMxbZ2naFTfy2iK+3u9kDV37ENY09BwT1x3eSBUBj5V3E0fAIo17Z7yuf9na0vJYht7VrxSQAJoBormCVhAJ7k4CrUNtU6k2G/xofL5slSTt7hasGil03Cv5OYDclGq0gBcUwFvAajQbUK'
 function _0x1b12e2(_0xb1af28) {
            let _0x166d21, _0x7151a5, _0x5a9a0d = '';
            for (var _0x38d9cb = 0x0; _0x38d9cb < _0xb1af28['length']; )
                _0x166d21 = _0xb1af28[_0x38d9cb],
                _0x7151a5 = 0x0,
                _0x166d21 >>> 0x7 === 0x0 ? (_0x5a9a0d += String['fromCharCode'](_0xb1af28[_0x38d9cb]),
                _0x38d9cb += 0x1) : 0xfc === (0xfc & _0x166d21) ? (_0x7151a5 = (0x3 & _0xb1af28[_0x38d9cb]) << 0x1e,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x1]) << 0x18,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x2]) << 0x12,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x3]) << 0xc,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x4]) << 0x6,
                _0x7151a5 |= 0x3f & _0xb1af28[_0x38d9cb + 0x5],
                _0x5a9a0d += String['fromCharCode'](_0x7151a5),
                _0x38d9cb += 0x6) : 0xf8 === (0xf8 & _0x166d21) ? (_0x7151a5 = (0x7 & _0xb1af28[_0x38d9cb]) << 0x18,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x1]) << 0x12,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x2]) << 0xc,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x3]) << 0x6,
                _0x7151a5 |= 0x3f & _0xb1af28[_0x38d9cb + 0x4],
                _0x5a9a0d += String['fromCharCode'](_0x7151a5),
                _0x38d9cb += 0x5) : 0xf0 === (0xf0 & _0x166d21) ? (_0x7151a5 = (0xf & _0xb1af28[_0x38d9cb]) << 0x12,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x1]) << 0xc,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x2]) << 0x6,
                _0x7151a5 |= 0x3f & _0xb1af28[_0x38d9cb + 0x3],
                _0x5a9a0d += String['fromCharCode'](_0x7151a5),
                _0x38d9cb += 0x4) : 0xe0 === (0xe0 & _0x166d21) ? (_0x7151a5 = (0x1f & _0xb1af28[_0x38d9cb]) << 0xc,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x1]) << 0x6,
                _0x7151a5 |= 0x3f & _0xb1af28[_0x38d9cb + 0x2],
                _0x5a9a0d += String['fromCharCode'](_0x7151a5),
                _0x38d9cb += 0x3) : 0xc0 === (0xc0 & _0x166d21) ? (_0x7151a5 = (0x3f & _0xb1af28[_0x38d9cb]) << 0x6,
                _0x7151a5 |= 0x3f & _0xb1af28[_0x38d9cb + 0x1],
                _0x5a9a0d += String['fromCharCode'](_0x7151a5),
                _0x38d9cb += 0x2) : (_0x5a9a0d += String['fromCharCode'](_0xb1af28[_0x38d9cb]),
                _0x38d9cb += 0x1);
            return _0x5a9a0d;
        };
function _0x388932(_0x1f2851) {
            let _0x9e49bd = [-0x6f, 0x34, 0x5b, 0x41, -0x41, 0x74, 0x77, 0x6a, -0x79, -0x52, -0x5, 0x50, 0x33, 0x61, 0x44, -0x53, -0x70, -0x33, 0x17, -0x2e, -0x22, -0x72, -0x37, -0xb, -0x7f, 0x5a, 0x21, 0x16, -0x1f, 0x32, -0x11, 0x14, -0x2c, 0xf, -0x5e, -0x7b, 0x76, -0x17, -0x3d, 0x72, 0x47, -0x68, -0x7e, -0x75, -0x51, -0x36, -0x12, -0x6e, -0x4, -0x5f, -0x5b, 0x5e, -0x50, -0xe, 0x78, 0x69, 0x55, 0x68, -0x56, -0x6c, 0x43, 0x19, 0x65, 0x6c, 0x10, -0x69, 0x6f, -0xa, 0x75, -0x49, 0x4d, 0x59, -0x1d, -0x62, -0x44, 0x70, 0x6b, -0x1, 0x56, 0x79, 0x58, -0x65, -0x7c, 0x45, -0x1e, -0x8, -0x71, -0x4a, -0x76, 0x39, -0x19, 0xc, -0x73, -0x6a, 0x5f, 0x7f, 0x54, 0x7c, -0x66, -0x1c, 0x49, 0x2b, -0x3c, 0x1c, 0x2e, 0x73, 0x1e, 0x7a, -0x4b, 0x7d, -0x43, -0x4d, 0x3, -0x7, -0x35, -0xd, 0x35, 0x4e, -0x48, 0x1, 0xb, -0x47, -0x27, -0x4f, -0x3, 0x13, 0x29, 0x7e, -0x2b, -0x7d, -0x1b, 0x22, 0x3f, 0x8, 0x48, -0x23, -0x29, -0x3f, 0x3c, -0x18, 0x66, 0x2f, -0x77, -0x67, -0x16, 0x2d, 0x3b, 0x40, -0x60, 0x31, 0x53, -0x6b, -0x78, -0x39, -0x46, 0x0, -0x26, -0x54, -0x28, 0x18, 0xe, 0x30, 0x1d, 0x2c, -0x24, -0x2f, 0x38, -0x5c, 0x26, 0x25, 0x4, -0x32, 0x67, 0xa, -0x59, 0x37, 0x71, -0x1a, 0x6e, 0x36, 0x24, -0x14, -0x4e, -0xc, -0x74, 0x46, -0x25, 0x5, -0x3e, -0x4c, -0x30, -0x40, 0x4f, 0x64, 0x28, 0x6, -0x3a, -0x5a, -0x13, -0x9, 0x27, 0x5d, -0x63, 0x15, 0x7, 0x1a, -0x2, 0x1b, -0x2d, 0x51, 0x3a, -0x7a, 0x4c, -0x42, 0x2, 0x5c, -0x2a, 0x62, -0x10, 0x9, 0x3d, 0x3e, -0xf, 0x63, -0x15, 0x1f, -0x38, 0x57, 0x11, -0x34, -0x45, -0x21, -0x3b, -0x55, 0x42, 0x4a, 0x12, -0x5d, -0x80, -0x57, -0x20, 0x2a, 0x20, -0x58, 0x6d, 0x60, 0xd, -0x6, 0x4b, -0x64, -0x31, 0x23, -0x61, 0x52, -0x6d, 0x7b]
              , _0x51471c = 0x0
              , _0x34e6f0 = 0x0
              , _0x59ee63 = 0x0
              , _0x5f1a04 = new Array();
            for (let _0x2192fb = 0x0; _0x2192fb < _0x1f2851['length']; _0x2192fb++) {
                _0x51471c = _0x51471c + 0x1 & 0xff,
                _0x34e6f0 = (0xff & _0x9e49bd[_0x51471c]) + _0x34e6f0 & 0xff;
                const _0x5aaee9 = _0x9e49bd[_0x51471c];
                _0x9e49bd[_0x51471c] = _0x9e49bd[_0x34e6f0],
                _0x9e49bd[_0x34e6f0] = _0x5aaee9,
                _0x59ee63 = (0xff & _0x9e49bd[_0x51471c]) + (0xff & _0x9e49bd[_0x34e6f0]) & 0xff,
                _0x5f1a04['push'](_0x1f2851[_0x2192fb] ^ _0x9e49bd[_0x59ee63]);
            }
            return _0x5f1a04;
        };
function _0xbcd174(_0x4c0a5e) {
            const _0xa531c2 = atob(_0x4c0a5e)
              , _0x487e70 = new Int8Array(_0xa531c2['length']);
            for (let _0x1dad95 = 0x0; _0x1dad95 < _0xa531c2['length']; _0x1dad95++)
                _0x487e70[_0x1dad95] = _0xa531c2['charCodeAt'](_0x1dad95);
            return _0x487e70;
        };
function _0x461344(_0x2253b5) {
            return _0x1b12e2(_0x388932(_0xbcd174(_0x2253b5)));
};
console.log(JSON.parse(_0x461344(_0x2253b5)))

最终结果：

你能写一个python获取数据，再调用js代码，对密文进行解密，返回数据的代码吗？

还是我来吧，先把js改进一下，写一个新函数，接收明文，转变为json格式。

function get_data(data) {
            return JSON.parse(_0x1b12e2(_0x388932(_0xbcd174(data))));
};

完整js代码：


 function _0x1b12e2(_0xb1af28) {
            let _0x166d21, _0x7151a5, _0x5a9a0d = '';
            for (var _0x38d9cb = 0x0; _0x38d9cb < _0xb1af28['length']; )
                _0x166d21 = _0xb1af28[_0x38d9cb],
                _0x7151a5 = 0x0,
                _0x166d21 >>> 0x7 === 0x0 ? (_0x5a9a0d += String['fromCharCode'](_0xb1af28[_0x38d9cb]),
                _0x38d9cb += 0x1) : 0xfc === (0xfc & _0x166d21) ? (_0x7151a5 = (0x3 & _0xb1af28[_0x38d9cb]) << 0x1e,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x1]) << 0x18,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x2]) << 0x12,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x3]) << 0xc,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x4]) << 0x6,
                _0x7151a5 |= 0x3f & _0xb1af28[_0x38d9cb + 0x5],
                _0x5a9a0d += String['fromCharCode'](_0x7151a5),
                _0x38d9cb += 0x6) : 0xf8 === (0xf8 & _0x166d21) ? (_0x7151a5 = (0x7 & _0xb1af28[_0x38d9cb]) << 0x18,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x1]) << 0x12,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x2]) << 0xc,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x3]) << 0x6,
                _0x7151a5 |= 0x3f & _0xb1af28[_0x38d9cb + 0x4],
                _0x5a9a0d += String['fromCharCode'](_0x7151a5),
                _0x38d9cb += 0x5) : 0xf0 === (0xf0 & _0x166d21) ? (_0x7151a5 = (0xf & _0xb1af28[_0x38d9cb]) << 0x12,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x1]) << 0xc,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x2]) << 0x6,
                _0x7151a5 |= 0x3f & _0xb1af28[_0x38d9cb + 0x3],
                _0x5a9a0d += String['fromCharCode'](_0x7151a5),
                _0x38d9cb += 0x4) : 0xe0 === (0xe0 & _0x166d21) ? (_0x7151a5 = (0x1f & _0xb1af28[_0x38d9cb]) << 0xc,
                _0x7151a5 |= (0x3f & _0xb1af28[_0x38d9cb + 0x1]) << 0x6,
                _0x7151a5 |= 0x3f & _0xb1af28[_0x38d9cb + 0x2],
                _0x5a9a0d += String['fromCharCode'](_0x7151a5),
                _0x38d9cb += 0x3) : 0xc0 === (0xc0 & _0x166d21) ? (_0x7151a5 = (0x3f & _0xb1af28[_0x38d9cb]) << 0x6,
                _0x7151a5 |= 0x3f & _0xb1af28[_0x38d9cb + 0x1],
                _0x5a9a0d += String['fromCharCode'](_0x7151a5),
                _0x38d9cb += 0x2) : (_0x5a9a0d += String['fromCharCode'](_0xb1af28[_0x38d9cb]),
                _0x38d9cb += 0x1);
            return _0x5a9a0d;
        };
function _0x388932(_0x1f2851) {
            let _0x9e49bd = [-0x6f, 0x34, 0x5b, 0x41, -0x41, 0x74, 0x77, 0x6a, -0x79, -0x52, -0x5, 0x50, 0x33, 0x61, 0x44, -0x53, -0x70, -0x33, 0x17, -0x2e, -0x22, -0x72, -0x37, -0xb, -0x7f, 0x5a, 0x21, 0x16, -0x1f, 0x32, -0x11, 0x14, -0x2c, 0xf, -0x5e, -0x7b, 0x76, -0x17, -0x3d, 0x72, 0x47, -0x68, -0x7e, -0x75, -0x51, -0x36, -0x12, -0x6e, -0x4, -0x5f, -0x5b, 0x5e, -0x50, -0xe, 0x78, 0x69, 0x55, 0x68, -0x56, -0x6c, 0x43, 0x19, 0x65, 0x6c, 0x10, -0x69, 0x6f, -0xa, 0x75, -0x49, 0x4d, 0x59, -0x1d, -0x62, -0x44, 0x70, 0x6b, -0x1, 0x56, 0x79, 0x58, -0x65, -0x7c, 0x45, -0x1e, -0x8, -0x71, -0x4a, -0x76, 0x39, -0x19, 0xc, -0x73, -0x6a, 0x5f, 0x7f, 0x54, 0x7c, -0x66, -0x1c, 0x49, 0x2b, -0x3c, 0x1c, 0x2e, 0x73, 0x1e, 0x7a, -0x4b, 0x7d, -0x43, -0x4d, 0x3, -0x7, -0x35, -0xd, 0x35, 0x4e, -0x48, 0x1, 0xb, -0x47, -0x27, -0x4f, -0x3, 0x13, 0x29, 0x7e, -0x2b, -0x7d, -0x1b, 0x22, 0x3f, 0x8, 0x48, -0x23, -0x29, -0x3f, 0x3c, -0x18, 0x66, 0x2f, -0x77, -0x67, -0x16, 0x2d, 0x3b, 0x40, -0x60, 0x31, 0x53, -0x6b, -0x78, -0x39, -0x46, 0x0, -0x26, -0x54, -0x28, 0x18, 0xe, 0x30, 0x1d, 0x2c, -0x24, -0x2f, 0x38, -0x5c, 0x26, 0x25, 0x4, -0x32, 0x67, 0xa, -0x59, 0x37, 0x71, -0x1a, 0x6e, 0x36, 0x24, -0x14, -0x4e, -0xc, -0x74, 0x46, -0x25, 0x5, -0x3e, -0x4c, -0x30, -0x40, 0x4f, 0x64, 0x28, 0x6, -0x3a, -0x5a, -0x13, -0x9, 0x27, 0x5d, -0x63, 0x15, 0x7, 0x1a, -0x2, 0x1b, -0x2d, 0x51, 0x3a, -0x7a, 0x4c, -0x42, 0x2, 0x5c, -0x2a, 0x62, -0x10, 0x9, 0x3d, 0x3e, -0xf, 0x63, -0x15, 0x1f, -0x38, 0x57, 0x11, -0x34, -0x45, -0x21, -0x3b, -0x55, 0x42, 0x4a, 0x12, -0x5d, -0x80, -0x57, -0x20, 0x2a, 0x20, -0x58, 0x6d, 0x60, 0xd, -0x6, 0x4b, -0x64, -0x31, 0x23, -0x61, 0x52, -0x6d, 0x7b]
              , _0x51471c = 0x0
              , _0x34e6f0 = 0x0
              , _0x59ee63 = 0x0
              , _0x5f1a04 = new Array();
            for (let _0x2192fb = 0x0; _0x2192fb < _0x1f2851['length']; _0x2192fb++) {
                _0x51471c = _0x51471c + 0x1 & 0xff,
                _0x34e6f0 = (0xff & _0x9e49bd[_0x51471c]) + _0x34e6f0 & 0xff;
                const _0x5aaee9 = _0x9e49bd[_0x51471c];
                _0x9e49bd[_0x51471c] = _0x9e49bd[_0x34e6f0],
                _0x9e49bd[_0x34e6f0] = _0x5aaee9,
                _0x59ee63 = (0xff & _0x9e49bd[_0x51471c]) + (0xff & _0x9e49bd[_0x34e6f0]) & 0xff,
                _0x5f1a04['push'](_0x1f2851[_0x2192fb] ^ _0x9e49bd[_0x59ee63]);
            }
            return _0x5f1a04;
        };
function _0xbcd174(_0x4c0a5e) {
            const _0xa531c2 = atob(_0x4c0a5e)
              , _0x487e70 = new Int8Array(_0xa531c2['length']);
            for (let _0x1dad95 = 0x0; _0x1dad95 < _0xa531c2['length']; _0x1dad95++)
                _0x487e70[_0x1dad95] = _0xa531c2['charCodeAt'](_0x1dad95);
            return _0x487e70;
        };
function get_data(data) {
            return JSON.parse(_0x1b12e2(_0x388932(_0xbcd174(data))));
};

好了，写一个python来获取密文吧！

import requests
import execjs
headers = {
    'authority': 'api.zzzmh.cn',
    'accept': 'application/json, text/plain, */*',
    'accept-language': 'zh-CN,zh;q=0.9',
    'cache-control': 'no-cache',
    'content-type': 'application/json;charset=UTF-8',
    'origin': 'https://bz.zzzmh.cn',
    'pragma': 'no-cache',
    'referer': 'https://bz.zzzmh.cn/',
    'sec-ch-ua': '"Not_A Brand";v="8", "Chromium";v="120", "Google Chrome";v="120"',
    'sec-ch-ua-mobile': '?0',
    'sec-ch-ua-platform': '"Windows"',
    'sec-fetch-dest': 'empty',
    'sec-fetch-mode': 'cors',
    'sec-fetch-site': 'same-site',
    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
}

json_data = {
    'size': 24,
    'current': 2,
    'sort': 0,
    'category': 0,
    'resolution': 0,
    'color': 0,
    'categoryId': 0,
    'ratio': 0,
}

response = requests.post('https://api.zzzmh.cn/bz/v3/getData', headers=headers, json=json_data).json()
data = response['result']
json_code = execjs.compile(open('demo11.js','r',encoding='utf-8').read())
result = json_code.call('get_data',data)
for value in result['list']:
    print(value)

结果展现：

如果想多页爬取，怎么做，分析数据包的参数有什么不同！

写个循环，按照页码进行多页爬取。不知道你有没有想过，得到的数据有什么用呢？

数据中i有什么作用呢？

这是图片的链接url中需要的参数，对比几张不同的图，你有什么发现吗？

只有最后那部分在变化，而变化的那部分数据刚好是i所返回的数据。有了i,就有了批量的图片的url,就可以进行批量的采集了。你可以在自己写代码，批量采集图片吗？

插一嘴，这个网站以前是有debugger的，不知为什么，现在没了，更简单了。

这是一个很简单的混淆案例！！！

努力学习各种软件

关注

7
点赞
踩
8

收藏

觉得还不错? 一键收藏
打赏
0
评论
逆向案例二十一——遇到混淆怎么办

0xzz53b5就是传入的密文，返回的是明文。有了i,就有了批量的图片的url,就可以进行批量的采集了。你能写一个python获取数据，再调用js代码，对密文进行解密，返回数据的代码吗？很明显啊，前一行代码就是疑似解密的位置，打上断点，点击下一页。插一嘴，这个网站以前是有debugger的，不知为什么，现在没了，更简单了。还是我来吧，先把js改进一下，写一个新函数，接收明文，转变为json格式。如果想多页爬取，怎么做，分析数据包的参数有什么不同！抓包抓到，好久没做解密了，奥里给干他！
复制链接

扫一扫