AST反混淆实战|Akamai加密字符串还原详解

关注它，不迷路。       

本文章中所有内容仅供学习交流，不可用于任何商业用途和非法用途，否则后果自负，如有侵权，请联系作者立即删除！

1.目标地址

今天要拿捏的demo站点是这个:

https://www.dhl.com/cn-zh/home.html

2.混淆分析

抓包，看到下面的这个混淆js:

然后全局搜索 上面这个函数名(tgvmkQAMfT)，定位到source面板中,再次搜索 = []; 如下图:‍

往下翻，看到 try语句:

继续往下翻，定位到与之对应的catch语句，在catch语句上面打断点:

刷新页面，停到断点位置:

这个时候发现了一些函数调用，如:

深入研究后得知，函数调用的结果与实参没有关系，如:

从上图可以看出，无论有没有实参，或者实参有几个，均不会影响它的调用结果。

因此，我们可以写几个行代码来保存它的调用值:

let enObj = TT; //这里的TT需要修改


let deObj = new Object();


for (let key of Object.keys(enObj)) {
    try {
        deObj[key] = enObj[key].apply(null,);
    } catch { }
}


copy(JSON.stringify(deObj))

因为不同的混淆代码，上面的变量TT不一样，因此需要手动填写。

上面的代码在控制台上运行后，得到了下面的数据:

{"DD":"","EL":",cpen:","lC":"-105","YC":"-110","G9":"-116","s9":"-124","O9":"-127","X9":"-129","S9":"-70","MD":".","wS":"/","Os":"//","AS":"/_bm/_data","lK":"3","pK":":","Jh":";","fE":"<bpd>","Kk":"<init/>","Y3":"ActiveXObject","GD":"Array","OL":"Buffer","xK":"CT","Kh":"CT5","kC":"CTEx","Rh":"CTe","WE":"DeviceMotionEvent","IE":"DeviceOrientationEvent","VK":"Function","k7":"ZvnuYSxf3tXRrEKqZC+42g==","Qg":"__driver_unwrapped","pg":"__fxdriver_unwrapped","zg":"__lastWatirAlert","Fg":"__lastWatirPrompt","wg":"__webdriver_script_func","T7":"__webdriver_unwrapped","R9":"addEventListener","S7":"ak_ax","z1":"all","r1":"ambient-light-sensor","B3":"assign","K1":"autocomplete","ML":"availWidth","m1":"background-sync","VL":"bat:","AE":"bluetooth","F9":"blur","R1":"brave","ZD":"c","mD":"cTc","K7":"calledSelenium","mk":"click","q1":"clipboard-read","OE":"collectHeadlessSignals","Q3":"concat","g3":"configurable","rD":"constructor","G7":"cookie","T1":"deviceorientation","kL":"documentMode","D7":"domAutomationController","P1":"driver","bs":"dummy","r3":"encodeURIComponent","zD":"enumerable","X3":"floor","J9":"focus","q7":"forEach","RE":"fpValCalculated","gE":"getCookie","TC":"getStorageUpdates","s1":"getVoices","Es":"hostname","DN":"https://","SC":"hypot","B1":"id","wE":"imul","jL":"innerHeight","R3":"isNaN","Dh":"join","Hg":"localStorage","d1":"map","Y1":"maxTouchPoints","KC":"mozIsLocallyAvailable","w1":"msMaxTouchPoints","DE":"navigatorPermissions","QD":"o","A1":"ontouchstart","N1":"onvoiceschanged","vL":"opera","fK":"parseFloat","p3":"parseInt","x1":"payment-handler","mg":"plugins","bk":"pointerdown","c3":"pow","U3":"protocol","WK":"prototype","H7":"remove","OC":"serviceWorker","NL":"spawn","YE":"storage","d3":"test","Gk":"touchcancel","w7":"type","m3":"unescape","LD":"url","LC":"webkitTemporaryStorage","fL":"wrc:","ZL":"x12:","hh":"|","h7":"$chrome_asyncScriptInfo","LE":",,,,,,,","N7":"-1","AC":"-101","K9":"-103","M9":"-109","j9":"-111","D9":"-115","wC":"-117","h9":"-119","g9":"-123","N9":"-126","L9":"-133","wK":"0","nK":"1","BD":"4","AK":"5","KD":"7","TD":"9","Bh":"CT5e","UL":"FileReader","Vg":"OSMJIF","XC":"PiZtE","p1":"Promise","W7":"Set","L3":"String","A3":"XMLHttpRequest","Wg":"_Selenium_IDE_Recorder","Zg":"__$webdriverAsyncExecutor","nD":"__esModule","lg":"__webdriverFuncgeb","Yg":"__webdriver_script_fn","Mk":"_setIpr","b1":"accelerometer","Dk":"aeiouy13579","L7":"ak_a","lE":"appMinorVersion","j7":"awesomium","gD":"bd-2-32-19.js","s3":"btoa","BE":"buildPostData","KE":"calcSynthesisSpeechHash","B7":"callSelenium","Ig":"cdc_adoQpoasnfa76pfcZLmcfl_Promise","tg":"cdc_adoQpoasnfa76pfcZLmcfl_Symbol","FK":"charCodeAt","H1":"clipboard","ND":"currentScript","UD":"d","h1":"defaultValue","pD":"defineProperty","SL":"dm:","UE":"dm_en","VE":"do_en","cL":"fc:","GC":"firstLoad","b3":"fromCharCode","NE":"getBrowser","sE":"getDeviceData","UC":"getElementsByTagName","MC":"getGamepads","v1":"gyroscope","M3":"hasOwnProperty","mh":"height","RK":"indexOf","BL":"innerWidth","x7":"isArray","b7":"key","ck":"keydown","qk":"keypress","Hk":"keyup","VD":"l","HK":"length","ED":"location","c1":"magnetometer","nE":"mouseMoveData","Xk":"mousemove","IL":"mozInnerScreenY","DC":"mozPhoneNumberService","wD":"n","jE":"navPerm","H3":"navigator","mL":"non:","S1":"notifications","rL":"onLine","T3":"p","vk":"pointerup","pL":"product","ID":"push","Ph":"rVal","gC":"registerProtocolHandler","x3":"replace","j3":"s","l1":"selenium","HD":"setTimeout","rs":"size","vD":"sjs_r","fD":"splice","OD":"src","p7":"startTs","EC":"storeWebWideTrackingException","c7":"subscribe","PD":"t","pE":"t_en","I1":"then","J3":"toLowerCase","ZK":"toString","kk":"touchstart","tK":"undefined","tL":"vibrate","Xh":"width","C3":"window","h3":"writable","J1":"$cdc_asdjflasutopfhvcZLmcfl_","gL":",uaend,","PC":"-100","T9":"-102","B9":"-114","E9":"-131","C9":"-132","k9":"-80","PK":"2","jD":"6","YK":"8","xg":"Boolean","Q7":"CT53x","sC":"CT5O","SE":"CTmmmmmm","dL":"Constructor","qD":"Date","xL":"HTMLElement","HL":"InstallTrigger","G3":"Math","JD":"Module","P3":"Number","UK":"OT","rg":"RTCPeerConnection","zE":"URL","n1":"XPathResult","Ug":"__driver_evaluate","Rg":"__lastWatirConfirm","dg":"__nightmare","Jg":"__phantomas","ng":"__selenium_evaluate","Pg":"__selenium_unwrapped","Ag":"__webdriver__chr","M7":"__webdriver_script_function","C7":"_abck","t9":"_sdTrace","Tk":"applyFunc","TL":"availHeight","E7":"bm_sz","CL":"callPhantom","k1":"camera","QK":"case ","U1":"catch","fg":"cdc_adoQpoasnfa76pfcZLmcfl_Array","v3":"ceil","hD":"charAt","hE":"collectSeleniumData","PE":"credentials","GL":"cwen:","Bk":"debug","m7":"decodeURIComponent","X1":"device-info","JE":"deviceData","j1":"devicemotion","sD":"document","hL":"domAutomation","JK":"e","sL":"emit","tD":"exports","g7":"fmget_targets","s7":"geb","L1":"geolocation","RD":"get","zS":"get_telemetry","IK":"hT","Zs":"hardwareConcurrency","EE":"https:","LL":"i1:","SD":"index","O7":"k","YS":"lastIndexOf","WD":"m","rk":"mousedown","jC":"mozAlarms","BC":"mozConnection","hC":"msManipulationViewsEnabled","E3":"name","xD":"now","bL":"opc:","DL":"outerWidth","QL":"productSub","f1":"query","FD":"r","lh":"rCFP","NC":"requestWakeLock","qL":"sc:","gh":"screen","l3":"search","bD":"set","gs":"setItem","XD":"slice","G1":"speaker","g1":"speechSynthesis","X7":"split","z3":"sqrt","FE":"startTimestamp","YD":"string","V9":"unk","q3":"userAgent","kD":"value","cD":"valueOf","z9":"visibilitychange","CC":"webkitGetGamepads","XL":"webstore","WL":"x11:","r7":"~","hj":"webdriver","dj":"","rT":"toStringTag","mK":"","nj":"","tT":"","WB":"required","kB":"","GB":"","GT":"i","mj":"getItem","NK":"","Rj":"","FB":"documentElement","UT":"","pj":"","CK":"","RB":"clipboard-write","tB":"","IB":"","dT":"abcdefghijklmnopaqrstuvxyzABCDEFGHIJKLMNOPAQRSTUVXYZ!@#%&-_=;:<>,~","XK":"_setPowState","Tj":"__webdriver_evaluate","mT":"Symbol","SB":"","HT":"","jB":"CTF","BK":"","Fj":"","bB":"-122","XB":"-108","qB":"","MK":",loc:","qT":"","Bj":"watinExpressionError","bK":"touchmove","FT":"td","lj":"synthesisSpeechHash","fj":"","Aj":"setBraveSignal","OB":"sendBeacon","Yj":"rir","bj":"removeItem","BB":"","pB":"persistent-storage","vj":"","wj":"","Pj":"","gB":"mediaDevices","GK":"listFunctions","JT":"","SK":"form_submit","hB":"deltaTimestamp","Uj":"","xj":"chrome","sK":"","vT":"a","nB":"_phantom","Mj":"__fxdriver_evaluate","Vj":"","wT":"","CB":"","XT":"Object","Ij":"","tj":"","gK":"","Ej":"","zj":"","pT":"","cB":"-90","xB":"","kj":"","MB":"","cj":"","vK":"touchend","Lj":"","sj":"substring","rK":"setInterval","NB":"requestMediaKeySystemAccess","fB":"","QB":"microphone","TK":"language","AB":"isc:","Xj":"","VB":"input","ZT":"","dB":"hidden","wB":"getBattery","IT":"getAttribute","RT":"fpValStr","QT":"","zT":"","bT":"","WT":"","jj":"calledPhantom","lT":"","Hj":"","KB":"TouchEvent","PB":"PointerEvent","YT":"","Wj":"","EB":"","nT":"","hK":"","KK":"","jK":"","HB":"","vB":"-128","xT":",","kK":"","Qj":"","Kj":"watinExpressionResult","YB":"vib:","Gj":"","DB":"totVel","Dj":"spynner_additional_js_loaded","Sj":"","fT":"random","Nj":"publish","qj":"","sB":"permissions","ZB":"off","lB":"number","Oj":"","cK":"mouseup","Cj":"","UB":"midi","LK":"","cT":"function","Jj":"","JB":"","rj":"","zB":"accessibility-events","VT":"XDomainRequest","EK":"","PT":"","AT":"","LB":"","Zj":"","DK":"","gj":"","rB":"-112","mB":"-106","TB":"","OK":"","CT5e":10,"CT5":1,"CT5r":16,"CTe":0,"CT53x":10000,"CT53F":1000,"CThz":0.7,"CThmZ":0.98,"CTh5":0.1,"CTmmmmmm":999999,"CTF":3,"CT5O":15,"CTEx":24,"CTFr3O":3600000,"CTrOzmF":65793}

拿到了这个数据，再对混淆代码进行处理。

3.函数调用还原

关于这个object(TT)的函数调用有下面三种形式:

TT.DD.call(null, Az, R8, XZ, Sz);
TT.DD.apply(null, [Vl, R8, XZ, q8]);
TT.Q3(Z4, A2, NJ, bz);

因此，都需要进行兼容，还原的插件如下:

const callToStringLiteral =
{
    CallExpression(path) {
        let { callee } = path.node;


        if (!types.isMemberExpression(callee)) {
            return;
        }


        let { object, property, compute } = callee;


        if (types.isIdentifier(object, { "name": enObjName })) {
            let proName = compute ? property.value : property.name;


            if (deObj.hasOwnProperty(proName)) {
                console.log(path.toString(),"-->",deObj[proName]);
                path.replaceWith(types.valueToNode(deObj[proName]));
                return;
            }
        }


        if (types.isMemberExpression(object)) {
            let proName = compute ? property.value : property.name;
            if (!['apply', "call"].includes(proName)) {
                return;
            }


            if (object.object.name == enObjName) {
                let proName = object.compute ? object.property.value : object.property.name;
                if (deObj.hasOwnProperty(proName)) {
                    
                    path.replaceWith(types.valueToNode(deObj[proName]));
                    return;
                }
            }
        }
    }
}


traverse(ast,callToStringLiteral);

还原后的效果如图:

当然，经过这一步操作后，有些函数调用仍然没有被还原，是因为有些代码没有被执行到所导致的。

完整代码请看下面的链接:

https://t.zsxq.com/kpdfK

今天的文章就分享到这里，感谢大家的阅读！

欢迎加入知识星球，学习更多AST和爬虫技巧。