python-js逆向之js加密

目标网站：http://glidedsky.com/level/web/crawler-javascript-obfuscation-1

既然叫js加密，那么打开源代码看看，果然没有这些数字。

然后抱着试试心态，来个省时省力操作在左边搜索框搜索，哟吼.......发现了，还是个xhr文件，恩不错

打开它在底部发现page，t，sign

虽然才学js逆向一个月不到，那还是能分辨出page应该就是页了，t就是时间戳，sign就是密文。

接下来就是找加密位置，刚好它又是个xhr，可以用xhr断点

首先在最上方url处随意复制：cation-1/items?pag

再如图1,2，添加完xhr断点后，刷新，会出现如图3，那是个调用栈，可以进行追踪。

然后就往下点点啊点点啊点

嗯？有p，t，sign，应该就这里了，在往下点看看，

嗯..这里应该就是加密后的代码，好，回到上面，打断点，去掉原先的xhr断点，刷新，果然停住了。

然后点击下一步，嗯 ，不错，p=1，下一步,t=1587370827,下一步,原来是传入了一个固定字符串加时间戳，鼠标悬停在sha1，然后进入函数内部，在黄行处。

 

观察发现这个js里就一个函数，不管了，整体复制到编辑器里，在传入参数：如下

!function() {
    "use strict";
    function t(t) {
        t ? (f[0] = f[16] = f[1] = f[2] = f[3] = f[4] = f[5] = f[6] = f[7] = f[8] = f[9] = f[10] = f[11] = f[12] = f[13] = f[14] = f[15] = 0,
        this.blocks = f) : this.blocks = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
        this.h0 = 1732584193,
        this.h1 = 4023233417,
        this.h2 = 2562383102,
        this.h3 = 271733878,
        this.h4 = 3285377520,
        this.block = this.start = this.bytes = this.hBytes = 0,
        this.finalized = this.hashed = !1,
        this.first = !0
    }
    var h = "object" == typeof window ? window : {}
      , s = !h.JS_SHA1_NO_NODE_JS && "object" == typeof process && process.versions && process.versions.node;
    s && (h = global);
    var i = !h.JS_SHA1_NO_COMMON_JS && "object" == typeof module && module.exports
      , e = "function" == typeof define && define.amd
      , r = "0123456789abcdef".split("")
      , o = [-2147483648, 8388608, 32768, 128]
      , n = [24, 16, 8, 0]
      , a = ["hex", "array", "digest", "arrayBuffer"]
      , f = []
      , u = function(h) {
        return function(s) {
            return new t(!0).update(s)[h]()
        }
    }
      , c = function() {
        var h = u("hex");
        s && (h = p(h)),
        h.create = function() {
            return new t
        }
        ,
        h.update = function(t) {
            return h.create().update(t)
        }
        ;
        for (var i = 0; i < a.length; ++i) {
            var e = a[i];
            h[e] = u(e)
        }
        return h
    }
      , p = function(t) {
        var h = eval("require('crypto')")
          , s = eval("require('buffer').Buffer")
          , i = function(i) {
            if ("string" == typeof i)
                return h.createHash("sha1").update(i, "utf8").digest("hex");
            if (i.constructor === ArrayBuffer)
                i = new Uint8Array(i);
            else if (void 0 === i.length)
                return t(i);
            return h.createHash("sha1").update(new s(i)).digest("hex")
        };
        return i
    };
    t.prototype.update = function(t) {
        if (!this.finalized) {
            var s = "string" != typeof t;
            s && t.constructor === h.ArrayBuffer && (t = new Uint8Array(t));
            for (var i, e, r = 0, o = t.length || 0, a = this.blocks; r < o; ) {
                if (this.hashed && (this.hashed = !1,
                a[0] = this.block,
                a[16] = a[1] = a[2] = a[3] = a[4] = a[5] = a[6] = a[7] = a[8] = a[9] = a[10] = a[11] = a[12] = a[13] = a[14] = a[15] = 0),
                s)
                    for (e = this.start; r < o && e < 64; ++r)
                        a[e >> 2] |= t[r] << n[3 & e++];
                else
                    for (e = this.start; r < o && e < 64; ++r)
                        (i = t.charCodeAt(r)) < 128 ? a[e >> 2] |= i << n[3 & e++] : i < 2048 ? (a[e >> 2] |= (192 | i >> 6) << n[3 & e++],
                        a[e >> 2] |= (128 | 63 & i) << n[3 & e++]) : i < 55296 || i >= 57344 ? (a[e >> 2] |= (224 | i >> 12) << n[3 & e++],
                        a[e >> 2] |= (128 | i >> 6 & 63) << n[3 & e++],
                        a[e >> 2] |= (128 | 63 & i) << n[3 & e++]) : (i = 65536 + ((1023 & i) << 10 | 1023 & t.charCodeAt(++r)),
                        a[e >> 2] |= (240 | i >> 18) << n[3 & e++],
                        a[e >> 2] |= (128 | i >> 12 & 63) << n[3 & e++],
                        a[e >> 2] |= (128 | i >> 6 & 63) << n[3 & e++],
                        a[e >> 2] |= (128 | 63 & i) << n[3 & e++]);
                this.lastByteIndex = e,
                this.bytes += e - this.start,
                e >= 64 ? (this.block = a[16],
                this.start = e - 64,
                this.hash(),
                this.hashed = !0) : this.start = e
            }
            return this.bytes > 4294967295 && (this.hBytes += this.bytes / 4294967296 << 0,
            this.bytes = this.bytes % 4294967296),
            this
        }
    }
    ,
    t.prototype.finalize = function() {
        if (!this.finalized) {
            this.finalized = !0;
            var t = this.blocks
              , h = this.lastByteIndex;
            t[16] = this.block,
            t[h >> 2] |= o[3 & h],
            this.block = t[16],
            h >= 56 && (this.hashed || this.hash(),
            t[0] = this.block,
            t[16] = t[1] = t[2] = t[3] = t[4] = t[5] = t[6] = t[7] = t[8] = t[9] = t[10] = t[11] = t[12] = t[13] = t[14] = t[15] = 0),
            t[14] = this.hBytes << 3 | this.bytes >>> 29,
            t[15] = this.bytes << 3,
            this.hash()
        }
    }
    ,
    t.prototype.hash = function() {
        var t, h, s = this.h0, i = this.h1, e = this.h2, r = this.h3, o = this.h4, n = this.blocks;
        for (t = 16; t < 80; ++t)
            h = n[t - 3] ^ n[t - 8] ^ n[t - 14] ^ n[t - 16],
            n[t] = h << 1 | h >>> 31;
        for (t = 0; t < 20; t += 5)
            s = (h = (i = (h = (e = (h = (r = (h = (o = (h = s << 5 | s >>> 27) + (i & e | ~i & r) + o + 1518500249 + n[t] << 0) << 5 | o >>> 27) + (s & (i = i << 30 | i >>> 2) | ~s & e) + r + 1518500249 + n[t + 1] << 0) << 5 | r >>> 27) + (o & (s = s << 30 | s >>> 2) | ~o & i) + e + 1518500249 + n[t + 2] << 0) << 5 | e >>> 27) + (r & (o = o << 30 | o >>> 2) | ~r & s) + i + 1518500249 + n[t + 3] << 0) << 5 | i >>> 27) + (e & (r = r << 30 | r >>> 2) | ~e & o) + s + 1518500249 + n[t + 4] << 0,
            e = e << 30 | e >>> 2;
        for (; t < 40; t += 5)
            s = (h = (i = (h = (e = (h = (r = (h = (o = (h = s << 5 | s >>> 27) + (i ^ e ^ r) + o + 1859775393 + n[t] << 0) << 5 | o >>> 27) + (s ^ (i = i << 30 | i >>> 2) ^ e) + r + 1859775393 + n[t + 1] << 0) << 5 | r >>> 27) + (o ^ (s = s << 30 | s >>> 2) ^ i) + e + 1859775393 + n[t + 2] << 0) << 5 | e >>> 27) + (r ^ (o = o << 30 | o >>> 2) ^ s) + i + 1859775393 + n[t + 3] << 0) << 5 | i >>> 27) + (e ^ (r = r << 30 | r >>> 2) ^ o) + s + 1859775393 + n[t + 4] << 0,
            e = e << 30 | e >>> 2;
        for (; t < 60; t += 5)
            s = (h = (i = (h = (e = (h = (r = (h = (o = (h = s << 5 | s >>> 27) + (i & e | i & r | e & r) + o - 1894007588 + n[t] << 0) << 5 | o >>> 27) + (s & (i = i << 30 | i >>> 2) | s & e | i & e) + r - 1894007588 + n[t + 1] << 0) << 5 | r >>> 27) + (o & (s = s << 30 | s >>> 2) | o & i | s & i) + e - 1894007588 + n[t + 2] << 0) << 5 | e >>> 27) + (r & (o = o << 30 | o >>> 2) | r & s | o & s) + i - 1894007588 + n[t + 3] << 0) << 5 | i >>> 27) + (e & (r = r << 30 | r >>> 2) | e & o | r & o) + s - 1894007588 + n[t + 4] << 0,
            e = e << 30 | e >>> 2;
        for (; t < 80; t += 5)
            s = (h = (i = (h = (e = (h = (r = (h = (o = (h = s << 5 | s >>> 27) + (i ^ e ^ r) + o - 899497514 + n[t] << 0) << 5 | o >>> 27) + (s ^ (i = i << 30 | i >>> 2) ^ e) + r - 899497514 + n[t + 1] << 0) << 5 | r >>> 27) + (o ^ (s = s << 30 | s >>> 2) ^ i) + e - 899497514 + n[t + 2] << 0) << 5 | e >>> 27) + (r ^ (o = o << 30 | o >>> 2) ^ s) + i - 899497514 + n[t + 3] << 0) << 5 | i >>> 27) + (e ^ (r = r << 30 | r >>> 2) ^ o) + s - 899497514 + n[t + 4] << 0,
            e = e << 30 | e >>> 2;
        this.h0 = this.h0 + s << 0,
        this.h1 = this.h1 + i << 0,
        this.h2 = this.h2 + e << 0,
        this.h3 = this.h3 + r << 0,
        this.h4 = this.h4 + o << 0
    }
    ,
    t.prototype.hex = function() {
        this.finalize();
        var t = this.h0
          , h = this.h1
          , s = this.h2
          , i = this.h3
          , e = this.h4;
        return r[t >> 28 & 15] + r[t >> 24 & 15] + r[t >> 20 & 15] + r[t >> 16 & 15] + r[t >> 12 & 15] + r[t >> 8 & 15] + r[t >> 4 & 15] + r[15 & t] + r[h >> 28 & 15] + r[h >> 24 & 15] + r[h >> 20 & 15] + r[h >> 16 & 15] + r[h >> 12 & 15] + r[h >> 8 & 15] + r[h >> 4 & 15] + r[15 & h] + r[s >> 28 & 15] + r[s >> 24 & 15] + r[s >> 20 & 15] + r[s >> 16 & 15] + r[s >> 12 & 15] + r[s >> 8 & 15] + r[s >> 4 & 15] + r[15 & s] + r[i >> 28 & 15] + r[i >> 24 & 15] + r[i >> 20 & 15] + r[i >> 16 & 15] + r[i >> 12 & 15] + r[i >> 8 & 15] + r[i >> 4 & 15] + r[15 & i] + r[e >> 28 & 15] + r[e >> 24 & 15] + r[e >> 20 & 15] + r[e >> 16 & 15] + r[e >> 12 & 15] + r[e >> 8 & 15] + r[e >> 4 & 15] + r[15 & e]
    }
    ,
    t.prototype.toString = t.prototype.hex,
    t.prototype.digest = function() {
        this.finalize();
        var t = this.h0
          , h = this.h1
          , s = this.h2
          , i = this.h3
          , e = this.h4;
        return [t >> 24 & 255, t >> 16 & 255, t >> 8 & 255, 255 & t, h >> 24 & 255, h >> 16 & 255, h >> 8 & 255, 255 & h, s >> 24 & 255, s >> 16 & 255, s >> 8 & 255, 255 & s, i >> 24 & 255, i >> 16 & 255, i >> 8 & 255, 255 & i, e >> 24 & 255, e >> 16 & 255, e >> 8 & 255, 255 & e]
    }
    ,
    t.prototype.array = t.prototype.digest,
    t.prototype.arrayBuffer = function() {
        this.finalize();
        var t = new ArrayBuffer(20)
          , h = new DataView(t);
        return h.setUint32(0, this.h0),
        h.setUint32(4, this.h1),
        h.setUint32(8, this.h2),
        h.setUint32(12, this.h3),
        h.setUint32(16, this.h4),
        t
    }
    ;
    var y = c();   
    i ? module.exports = y : (h.sha1 = y,
    e && define(function() {
        return y
    }))
}();
var t = '1587370827'
let sign = sha1('Xr0Z-javascript-obfuscation-1' + t);
console.log(sign)

然后运行，竟然报错了，ReferenceError: sha1 is not defined，突然发现末尾处和之前做过的一个md5加密案例很像，于是加上了

global.sha1 = y，如下：

var y = c();

global.sha1 = y

i ? module.exports = y : (h.sha1 = y,

e && define(function() { return y

然后运行，嗯....没毛病。这时突然想到既然是sha1加密，是不是可以用CryptoJS呢？心动不如行动。

var CryptoJS = require('crypto-js')
var value = 'Xr0Z-javascript-obfuscation-11587370827'
let hash = CryptoJS.SHA1(value)
console.log(hash.toString())

果然加密结果是一模一样，嗯，不错。

这时又突然想到，python有md5加密，那是否有sha1加密？心动不如行动。

import hashlib
value = 'Xr0Z-javascript-obfuscation-11587370827'
print(hashlib.sha1(value.encode(encoding='UTF-8')).hexdigest())

果然加密结果是一模一样，嗯，不错。

到这里，程序框架已然成型

程序有待补充...........