某验二代，三代滑块底图还原

二代底图还原

def restore_picture(self,bg_path,path):
    location_list = [{"x": -157, "y": -58}, {"x": -145, "y": -58}, {"x": -265, "y": -58}, {"x": -277, "y": -58},
                     {"x": -181, "y": -58}, {"x": -169, "y": -58}, {"x": -241, "y": -58}, {"x": -253, "y": -58},
                     {"x": -109, "y": -58}, {"x": -97, "y": -58}, {"x": -289, "y": -58}, {"x": -301, "y": -58},
                     {"x": -85, "y": -58}, {"x": -73, "y": -58}, {"x": -25, "y": -58}, {"x": -37, "y": -58},
                     {"x": -13, "y": -58}, {"x": -1, "y": -58}, {"x": -121, "y": -58}, {"x": -133, "y": -58},
                     {"x": -61, "y": -58}, {"x": -49, "y": -58}, {"x": -217, "y": -58}, {"x": -229, "y": -58},
                     {"x": -205, "y": -58}, {"x": -193, "y": -58}, {"x": -145, "y": 0}, {"x": -157, "y": 0},
                     {"x": -277, "y": 0}, {"x": -265, "y": 0}, {"x": -169, "y": 0}, {"x": -181, "y": 0},
                     {"x": -253, "y": 0}, {"x": -241, "y": 0}, {"x": -97, "y": 0}, {"x": -109, "y": 0},
                     {"x": -301, "y": 0}, {"x": -289, "y": 0}, {"x": -73, "y": 0}, {"x": -85, "y": 0},
                     {"x": -37, "y": 0}, {"x": -25, "y": 0}, {"x": -1, "y": 0}, {"x": -13, "y": 0},
                     {"x": -133, "y": 0}, {"x": -121, "y": 0}, {"x": -49, "y": 0}, {"x": -61, "y": 0},
                     {"x": -229, "y": 0}, {"x": -217, "y": 0}, {"x": -193, "y": 0}, {"x": -205, "y": 0}]

    im = Image.open(bg_path)

    im_list_upper = []
    im_list_down = []
    for location in location_list:
        if location['y'] == -58:
            im_list_upper.append(
                im.crop((abs(location['x']), 58, abs(location['x']) + 10, 116)))  # 有关参数的介绍请看下方的crop方法的介绍， 可自行调整
        if location['y'] == 0:
            im_list_down.append(im.crop((abs(location['x']), 0, abs(location['x']) + 10, 0 + 58)))

    new_im = Image.new('RGB', (260, 116))  # 生成的图片的大小， 可调整

    x_offset = 0
    for im in im_list_upper:
        new_im.paste(im, (x_offset, 0))
        x_offset += im.size[0]

    x_offset = 0
    for im in im_list_down:
        new_im.paste(im, (x_offset, 58))
        x_offset += im.size[0]
    new_im.save(f"./{path}.png")

三代底图还原

拿到的完整背景图以及带缺口背景图都是被打乱了的，这里需要还原才能计算滑动距离以及轨迹等，极验的底图是通过 Canvas 绘制出来的，直接打下事件断点：

点击按钮进行验证即会断住，格式化后跳转到第 295 行，

简单解一波混淆，会清晰一些：

function $_BEG(t, e) {
    var $_DAHHo = QBLnx.$_Db()[12][19];
    for (; $_DAHHo !== QBLnx.$_Db()[15][16];) {
        switch ($_DAHHo) {
            case QBLnx.$_Db()[15][19]:
                t = t["$_CGz"],
                e = e["$_CGz"];
                var n = t["width"]
                    , r = t["height"]
                    , i = h["createElement"]("canvas");
                i["width"] = n,
                i["height"] = r;
                $_DAHHo = QBLnx.$_Db()[3][18];
                break;
            case QBLnx.$_Db()[0][18]:
                var o = i["getContext"]("2d");
                o["drawImage"](t, 0, 0);
                var s = e["getContext"]("2d");
                $_DAHHo = QBLnx.$_Db()[0][17];
                break;
            case QBLnx.$_Db()[12][17]:
                e["height"] = 160,
                e["width"] = 260;
                for (var a = r / 2, _ = 0; _ < 52; _ += 1) {
                    var c = Ut[_] % 26 * 12 + 1
                        , u = 25 < Ut[_] ? a : 0
                        , l = o["getImageData"](c, u, 10, a);
                    s["putImageData"](l, _ % 26 * 10, 25 < _ ? a : 0);
                }
                $_DAHHo = QBLnx.$_Db()[15][16];
                break;
        }
    }
}

控制流平坦化混淆，可以通过 AST 技术解混淆，这里就是 Canvas 绘图的过程，关键乱序算法部分在 QBLnx.$_Db()[12][17] 中：

e["height"] = 160,
e["width"] = 260;
for (var a = r / 2, _ = 0; _ < 52; _ += 1) {
    var c = Ut[_] % 26 * 12 + 1
        , u = 25 < Ut[_] ? a : 0
        , l = o["getImageData"](c, u, 10, a);
    s["putImageData"](l, _ % 26 * 10, 25 < _ ? a : 0);
}

原图比例为 312 x 160，宽为 320，长为 160：

e[“height”] = 160、e[“width”] = 260 指还原后的图片比例为 260 x 160，a 的值为 r / 2 即 80，就是将整张图片分为了上下两等分，再将图片纵向切割为了 26 等份，Ut 数组的长度为 52，Ut[_] 即依次取数组中的元素，Ut 数组即为图片还原的顺序，是固定的，25 < Ut[_] ? a : 0 判断图片是上半部分还是下半部分，_ % 26 * 10 表示每个小块取 10 px 像素，正确图片的顺序为：

[39,38,48,49,41,40,46,47,35,34,50,51,33,32,28,29,27,26,36,37,31,30,44,45,43,42,12,13,23,22,14,15,21,20,8,9,25,24,6,7,3,2,0,1,11,10,4,5,19,18,16,17]

实例：

Python 复现：

def restore_picture():
    img_list = ["./乱序缺口背景图.png", "./乱序背景图.png"]
    for index, img in enumerate(img_list):
        image = Image.open(img)
        s = Image.new("RGBA", (260, 160))
        ut = [39, 38, 48, 49, 41, 40, 46, 47, 35, 34, 50, 51, 33, 32, 28, 29, 27, 26, 36, 37, 31, 30, 44, 45, 43,42,12, 13, 23, 22, 14, 15, 21, 20, 8, 9, 25, 24, 6, 7, 3, 2, 0, 1, 11, 10, 4, 5, 19, 18, 16, 17]
        height_half = 80
        for inx in range(52):
            c = ut[inx] % 26 * 12 + 1
            u = height_half if ut[inx] > 25 else 0
            l_ = image.crop(box=(c, u, c + 10, u + 80))
            s.paste(l_, box=(inx % 26 * 10, 80 if inx > 25 else 0))
        if index == 0:
            s.save("./缺口背景图片.png")
        else:
            s.save("./背景图片.png")

还原后如下: