猿人学第二题js 混淆动态cookie但是hook不到m参数

哈里路大旋风啊啊啊啊啊啊啊啊啊

已于 2024-07-02 14:42:32 修改

阅读量251

点赞数 4

文章标签： javascript 开发语言 ecmascript 爬虫 python

于 2024-07-02 14:41:14 首次发布

本文链接：https://blog.csdn.net/qq_52465706/article/details/140124771

版权

声明
本文章中所有内容仅供学习交流，抓包内容、敏感网址、数据接口均已做脱敏处理，严禁用于商业用途和非法用途，否则由此产生的一切后果均与作者无关，若有侵权，请联系我立即删除！

按照网上的方法hook，cookie内的参数m发现并不成功，看起来这题很繁琐实则一点也不简单

// ==UserScript==
// @name         getM
// @namespace    http://tampermonkey.net/
// @version      0.1
// @description  try to take over the world!
// @author       You
// @match        https://*/*
// @icon         data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==
// @grant        none
// @run-at       document-start
// ==/UserScript==

(function () {
  'use strict';
  var cookieTemp = '';
  Object.defineProperty(document, 'cookie', {
    set: function (val) {
      if (val.indexOf('m') != -1) {
        debugger;
      }
      console.log('Hook捕获到cookie设置->', val);
      cookieTemp = val;
      return val;
    },
    get: function () {
      return cookieTemp;
    },
  });
})();

后面发现请求分为两次，第一次请求回返回一段js，浏览器运行后生成m参数，后面的请求都会带有m参数。而且第一次返回的js有反调试代码，会正则匹配死循环导致浏览器奔溃，我的浏览器很难hook到。
后面用charles工具抓包，将第一次请求的js扣下来调试。

在这里插入图片描述
这里推荐一个js解混淆工具：
https://github.com/cilame/v_jstools

在这里插入图片描述
将setInterval注释掉后发现报错：

随即在开头补上 document = {};

后面发现程序在某地死循环了。

首先我们关注的是m的生成过程那么就从m生成过程中debug。

找到document.cookie 生成位置。

在这里插入图片描述
可以直接将代码删掉测是哪里死循环

这样代码运行无报错说明是这几个函数中出现死循环，依次点击进入查看调试

第一个函数内constructor动态构造了一个方法会返回 this 对象，不过这里好像没什么关系，_0x41c338函数内部在调用return !_0xdc09f2.test(_0x41c338)，递归调用自己造成死循环，这里直接将return结果改为true即可。

而浏览器为什么没死循环，扣下来的js却死循环了呢？原因可能在于浏览器代码有一段 setInterval(_0x349184(), 500);
而我们扣下来代码时为了正常运行把这些删掉了。

接下来运行发现报错ReferenceError: history is not defined
在这里插入图片描述
注释掉重写console.log函数的地方

接下来运行发现navigator缺少

浏览器为空本地代码也定义一个空值

在这里插入图片描述
报错堆栈溢出，直接注释。
此时console.log打印m的值发现是正确的。

在这里插入图片描述

写个python脚本调用一下即可。

以下代码

import re

import requests
import execjs

def get_page(page):
    url = f"https://match.yuanrenxue.cn/api/match/2?page={page}"

    payload={}
    m = ''
    with open('y2.js','r',encoding='utf-8') as f:
        y2 = f.read()
        str_m = execjs.compile(y2).call('get_m')
        match = re.findall(r"m=(.*?);",str_m)
        print(match[0])
        m = match[0]
    print(m)
    headers = {
       'priority': 'u=0, i',
       'x-requested-with': 'XMLHttpRequest',
       'Cookie': f'm={m}; +那个东西',
       'User-Agent': 'Apifox/1.0.0 (https://apifox.com)'
    }

    response = requests.request("GET", url, headers=headers, data=payload)

    return response.json()
sum = 0
for i in range(1 , 6):
    res = get_page(i)
    for j in res['data']:
        print(j['value'])
        sum += int(j['value'])

print(sum)

document = {};
m_res = '';
var aa;
(aa = function $dbsm_0x15e611(_0x56acd6) {
  var _0x2d6c06 = function () {
    var _0xdda4dc = !![];

    return function (_0x590d4e, _0x1c4c32) {
      var _0x2eec07;

      if (_0xdda4dc) {
        _0x2eec07 = function () {
          if (_0x1c4c32) {
            var _0x47cc6d = _0x1c4c32.apply(_0x590d4e, arguments);

            _0x1c4c32 = null;
            return _0x47cc6d;
          }
        };
      } else {
        _0x2eec07 = function () {};
      }

      _0xdda4dc = ![];
      return _0x2eec07;
    };
  }();

  var _0x97b8f = function () {
    var _0x9e9343 = !![];

    return function (_0x21569b, _0x418822) {
      var _0x2493c5;

      if (_0x9e9343) {
        _0x2493c5 = function () {
          if (_0x418822) {
            var _0x5f3fda = _0x418822.apply(_0x21569b, arguments);

            _0x418822 = null;
            return _0x5f3fda;
          }
        };
      } else {
        _0x2493c5 = function () {};
      }

      _0x9e9343 = ![];
      return _0x2493c5;
    };
  }();

  function _0x592c1e(_0x9a4725, _0x2a2caf) {
    var _0x4e6454 = (65535 & _0x9a4725) + (65535 & _0x2a2caf);

    return (_0x9a4725 >> 16) + (_0x2a2caf >> 16) + (_0x4e6454 >> 16) << 16 | 65535 & _0x4e6454;
  }

  function _0x4b5b46(_0x2bbbf6, _0x3726af) {
    return _0x2bbbf6 << _0x3726af | _0x2bbbf6 >>> 32 - _0x3726af;
  }

  function _0x53357e(_0x2803f6, _0x1c6a77, _0x8b8ea0, _0x4748a2, _0x4c1dbf, _0x2818c8) {
    return _0x592c1e(_0x4b5b46(_0x592c1e(_0x592c1e(_0x1c6a77, _0x2803f6), _0x592c1e(_0x4748a2, _0x2818c8)), _0x4c1dbf), _0x8b8ea0);
  }

  function _0x9ee34c(_0x5bfdab, _0x41e885, _0x4323e6, _0x3b83b6, _0x395504, _0xd04174, _0x1191c7) {
    return _0x53357e(_0x41e885 & _0x4323e6 | ~_0x41e885 & _0x3b83b6, _0x5bfdab, _0x41e885, _0x395504, _0xd04174, _0x1191c7);
  }

  function _0x48b0fc(_0x32e9a3, _0x31ee0e, _0x3b4df8, _0x25d25f, _0xd52718, _0x1e8e45, _0x4f0864) {
    return _0x53357e(_0x31ee0e & _0x25d25f | _0x3b4df8 & ~_0x25d25f, _0x32e9a3, _0x31ee0e, _0xd52718, _0x1e8e45, _0x4f0864);
  }

  function _0x4fdf8e(_0x18a748, _0x1e431b) {
    let _0x235bdc = [99, 111, 110, 115, 111, 108, 101];
    let _0xe67e0 = "";

    for (let _0x637a73 = 0; _0x637a73 < _0x235bdc.length; _0x637a73++) {
      _0xe67e0 += String.fromCharCode(_0x235bdc[_0x637a73]);
    }

    return _0xe67e0;
  }

  function _0x5ce219(_0xd68bcf, _0x5690eb, _0x38f6c0, _0x95a2dc, _0xfd528b, _0x5c7a63, _0x446297) {
    return _0x53357e(_0x5690eb ^ _0x38f6c0 ^ _0x95a2dc, _0xd68bcf, _0x5690eb, _0xfd528b, _0x5c7a63, _0x446297);
  }

  function _0x3b6321(_0x51834f, _0x703cfb, _0x4a8ce3, _0x2e50c2, _0x223c15, _0x5bda9f, _0x154c0c) {
    return _0x53357e(_0x4a8ce3 ^ (_0x703cfb | ~_0x2e50c2), _0x51834f, _0x703cfb, _0x223c15, _0x5bda9f, _0x154c0c);
  }

  function _0x32919d(_0x379ffb, _0x2b228) {
    if (_0x2b228) {
      return _0x3b6321(_0x379ffb);
    }

    return _0x4fdf8e(_0x379ffb);
  }

  function _0x324af7(_0x2edad6, _0x3b9edd) {
    let _0x39e994 = "";

    for (let _0x346c46 = 0; _0x346c46 < _0x2edad6.length; _0x346c46++) {
      _0x39e994 += String.fromCharCode(_0x2edad6[_0x346c46]);
    }

    return _0x39e994;
  }

  function _0x349184(_0xf097cb, _0xf3f45b) {
    var _0x41c338 = _0x2d6c06(this, function () {
      var _0x2520ed = function () {
        var _0xdc09f2 = _0x2520ed.constructor("return /\" + this + \"/")().compile("^([^ ]+( +[^ ]+)+)+[^ ]}");

        return true;
      };

      return _0x2520ed();
    });

    _0x41c338();

    (function () {
      _0x97b8f(this, function () {
        var _0x9b1f40 = new RegExp("function *\\( *\\)");

        var _0x14eba6 = new RegExp("\\+\\+ *(?:[a-zA-Z_$][0-9a-zA-Z_$]*)", "i");

        var _0x28e3de = $dbsm_0x5c6761("init");

        if (!_0x9b1f40.test(_0x28e3de + "chain") || !_0x14eba6.test(_0x28e3de + "input")) {
          _0x28e3de("0");
        } else {
          $dbsm_0x5c6761();
        }
      })();
    })();

    _0x32919d();

    qz = [10, 99, 111, 110, 115, 111, 108, 101, 32, 61, 32, 110, 101, 119, 32, 79, 98, 106, 101, 99, 116, 40, 41, 10, 99, 111, 110, 115, 111, 108, 101, 46, 108, 111, 103, 32, 61, 32, 102, 117, 110, 99, 116, 105, 111, 110, 32, 40, 115, 41, 32, 123, 10, 32, 32, 32, 32, 119, 104, 105, 108, 101, 32, 40, 49, 41, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 102, 111, 114, 40, 105, 61, 48, 59, 105, 60, 49, 49, 48, 48, 48, 48, 48, 59, 105, 43, 43, 41, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 104, 105, 115, 116, 111, 114, 121, 46, 112, 117, 115, 104, 83, 116, 97, 116, 101, 40, 48, 44, 48, 44, 105, 41, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 125, 10, 32, 32, 32, 32, 125, 10, 10, 125, 10, 99, 111, 110, 115, 111, 108, 101, 46, 116, 111, 83, 116, 114, 105, 110, 103, 32, 61, 32, 39, 91, 111, 98, 106, 101, 99, 116, 32, 79, 98, 106, 101, 99, 116, 93, 39, 10, 99, 111, 110, 115, 111, 108, 101, 46, 108, 111, 103, 46, 116, 111, 83, 116, 114, 105, 110, 103, 32, 61, 32, 39, 402, 32, 116, 111, 83, 116, 114, 105, 110, 103, 40, 41, 32, 123, 32, 91, 110, 97, 116, 105, 118, 101, 32, 99, 111, 100, 101, 93, 32, 125, 39, 10];
    // eval(_0x324af7(qz));

    try {
      if (global) {
        console.log("人生苦短，何必python？");
      } else {
        while (1) {
          console.log("人生苦短，何必python？");
          debugger;
        }
      }
    } catch (_0x159c70) {
      // console.log(_0x159c70);
      return '';
    }
  }


  function _0x2a57cc(_0xe7dd4, _0x461b0d) {
    _0xe7dd4[_0x461b0d >> 5] |= 128 << _0x461b0d % 32;
    _0xe7dd4[14 + (_0x461b0d + 64 >>> 9 << 4)] = _0x461b0d;

    if (qz) {
      var _0x24105d;

      var _0x2971fd;

      var _0x193ee0;

      var _0x5f0443;

      var _0x12ef8d;

      var _0x3aafe2 = 1732584193;

      var _0x22eaec = -271733879;

      var _0x57619b = -1732584194;

      var _0x5e32e5 = 271733878;
    } else {
      var _0x24105d;

      var _0x2971fd;

      var _0x193ee0;

      var _0x5f0443;

      var _0x12ef8d;

      var _0x3aafe2 = 0;

      var _0x22eaec = -0;

      var _0x57619b = -0;

      var _0x5e32e5 = 0;
    }

    for (_0x24105d = 0; _0x24105d < _0xe7dd4.length; _0x24105d += 16) {
      _0x2971fd = _0x3aafe2;
      _0x193ee0 = _0x22eaec;
      _0x5f0443 = _0x57619b;
      _0x12ef8d = _0x5e32e5;
      _0x3aafe2 = _0x9ee34c(_0x3aafe2, _0x22eaec, _0x57619b, _0x5e32e5, _0xe7dd4[_0x24105d], 7, -680876936);
      _0x5e32e5 = _0x9ee34c(_0x5e32e5, _0x3aafe2, _0x22eaec, _0x57619b, _0xe7dd4[_0x24105d + 1], 12, -389564586);
      _0x57619b = _0x9ee34c(_0x57619b, _0x5e32e5, _0x3aafe2, _0x22eaec, _0xe7dd4[_0x24105d + 2], 17, 606105819);
      _0x22eaec = _0x9ee34c(_0x22eaec, _0x57619b, _0x5e32e5, _0x3aafe2, _0xe7dd4[_0x24105d + 3], 22, -1044525330);
      _0x3aafe2 = _0x9ee34c(_0x3aafe2, _0x22eaec, _0x57619b, _0x5e32e5, _0xe7dd4[_0x24105d + 4], 7, -176418897);
      _0x5e32e5 = _0x9ee34c(_0x5e32e5, _0x3aafe2, _0x22eaec, _0x57619b, _0xe7dd4[_0x24105d + 5], 12, 1200080426);
      _0x57619b = _0x9ee34c(_0x57619b, _0x5e32e5, _0x3aafe2, _0x22eaec, _0xe7dd4[_0x24105d + 6], 17, -1473231341);
      _0x22eaec = _0x9ee34c(_0x22eaec, _0x57619b, _0x5e32e5, _0x3aafe2, _0xe7dd4[_0x24105d + 7], 22, -45705983);
      _0x3aafe2 = _0x9ee34c(_0x3aafe2, _0x22eaec, _0x57619b, _0x5e32e5, _0xe7dd4[_0x24105d + 8], 7, 1770010416);
      _0x5e32e5 = _0x9ee34c(_0x5e32e5, _0x3aafe2, _0x22eaec, _0x57619b, _0xe7dd4[_0x24105d + 9], 12, -1958414417);
      _0x57619b = _0x9ee34c(_0x57619b, _0x5e32e5, _0x3aafe2, _0x22eaec, _0xe7dd4[_0x24105d + 10], 17, -42063);
      _0x22eaec = _0x9ee34c(_0x22eaec, _0x57619b, _0x5e32e5, _0x3aafe2, _0xe7dd4[_0x24105d + 11], 22, -1990404162);
      _0x3aafe2 = _0x9ee34c(_0x3aafe2, _0x22eaec, _0x57619b, _0x5e32e5, _0xe7dd4[_0x24105d + 12], 7, 1804603682);
      _0x5e32e5 = _0x9ee34c(_0x5e32e5, _0x3aafe2, _0x22eaec, _0x57619b, _0xe7dd4[_0x24105d + 13], 12, -40341101);
      _0x57619b = _0x9ee34c(_0x57619b, _0x5e32e5, _0x3aafe2, _0x22eaec, _0xe7dd4[_0x24105d + 14], 17, -1502882290);
      _0x22eaec = _0x9ee34c(_0x22eaec, _0x57619b, _0x5e32e5, _0x3aafe2, _0xe7dd4[_0x24105d + 15], 22, 1236535329);
      _0x3aafe2 = _0x48b0fc(_0x3aafe2, _0x22eaec, _0x57619b, _0x5e32e5, _0xe7dd4[_0x24105d + 1], 5, -165796510);
      _0x5e32e5 = _0x48b0fc(_0x5e32e5, _0x3aafe2, _0x22eaec, _0x57619b, _0xe7dd4[_0x24105d + 6], 9, -1069501632);
      _0x57619b = _0x48b0fc(_0x57619b, _0x5e32e5, _0x3aafe2, _0x22eaec, _0xe7dd4[_0x24105d + 11], 14, 643717713);
      _0x22eaec = _0x48b0fc(_0x22eaec, _0x57619b, _0x5e32e5, _0x3aafe2, _0xe7dd4[_0x24105d], 20, -373897302);
      _0x3aafe2 = _0x48b0fc(_0x3aafe2, _0x22eaec, _0x57619b, _0x5e32e5, _0xe7dd4[_0x24105d + 5], 5, -701558691);
      _0x5e32e5 = _0x48b0fc(_0x5e32e5, _0x3aafe2, _0x22eaec, _0x57619b, _0xe7dd4[_0x24105d + 10], 9, 38016083);
      _0x57619b = _0x48b0fc(_0x57619b, _0x5e32e5, _0x3aafe2, _0x22eaec, _0xe7dd4[_0x24105d + 15], 14, -660478335);
      _0x22eaec = _0x48b0fc(_0x22eaec, _0x57619b, _0x5e32e5, _0x3aafe2, _0xe7dd4[_0x24105d + 4], 20, -405537848);
      _0x3aafe2 = _0x48b0fc(_0x3aafe2, _0x22eaec, _0x57619b, _0x5e32e5, _0xe7dd4[_0x24105d + 9], 5, 568446438);
      _0x5e32e5 = _0x48b0fc(_0x5e32e5, _0x3aafe2, _0x22eaec, _0x57619b, _0xe7dd4[_0x24105d + 14], 9, -1019803690);
      _0x57619b = _0x48b0fc(_0x57619b, _0x5e32e5, _0x3aafe2, _0x22eaec, _0xe7dd4[_0x24105d + 3], 14, -187363961);
      _0x22eaec = _0x48b0fc(_0x22eaec, _0x57619b, _0x5e32e5, _0x3aafe2, _0xe7dd4[_0x24105d + 8], 20, 1163531501);
      _0x3aafe2 = _0x48b0fc(_0x3aafe2, _0x22eaec, _0x57619b, _0x5e32e5, _0xe7dd4[_0x24105d + 13], 5, -1444681467);
      _0x5e32e5 = _0x48b0fc(_0x5e32e5, _0x3aafe2, _0x22eaec, _0x57619b, _0xe7dd4[_0x24105d + 2], 9, -51403784);
      _0x57619b = _0x48b0fc(_0x57619b, _0x5e32e5, _0x3aafe2, _0x22eaec, _0xe7dd4[_0x24105d + 7], 14, 1735328473);
      _0x22eaec = _0x48b0fc(_0x22eaec, _0x57619b, _0x5e32e5, _0x3aafe2, _0xe7dd4[_0x24105d + 12], 20, -1926607734);
      _0x3aafe2 = _0x5ce219(_0x3aafe2, _0x22eaec, _0x57619b, _0x5e32e5, _0xe7dd4[_0x24105d + 5], 4, -378558);
      _0x5e32e5 = _0x5ce219(_0x5e32e5, _0x3aafe2, _0x22eaec, _0x57619b, _0xe7dd4[_0x24105d + 8], 11, -2022574463);
      _0x57619b = _0x5ce219(_0x57619b, _0x5e32e5, _0x3aafe2, _0x22eaec, _0xe7dd4[_0x24105d + 11], 16, 1839030562);
      _0x22eaec = _0x5ce219(_0x22eaec, _0x57619b, _0x5e32e5, _0x3aafe2, _0xe7dd4[_0x24105d + 14], 23, -35309556);
      _0x3aafe2 = _0x5ce219(_0x3aafe2, _0x22eaec, _0x57619b, _0x5e32e5, _0xe7dd4[_0x24105d + 1], 4, -1530992060);
      _0x5e32e5 = _0x5ce219(_0x5e32e5, _0x3aafe2, _0x22eaec, _0x57619b, _0xe7dd4[_0x24105d + 4], 11, 1272893353);
      _0x57619b = _0x5ce219(_0x57619b, _0x5e32e5, _0x3aafe2, _0x22eaec, _0xe7dd4[_0x24105d + 7], 16, -155497632);
      _0x22eaec = _0x5ce219(_0x22eaec, _0x57619b, _0x5e32e5, _0x3aafe2, _0xe7dd4[_0x24105d + 10], 23, -1094730640);
      _0x3aafe2 = _0x5ce219(_0x3aafe2, _0x22eaec, _0x57619b, _0x5e32e5, _0xe7dd4[_0x24105d + 13], 4, 681279174);
      _0x5e32e5 = _0x5ce219(_0x5e32e5, _0x3aafe2, _0x22eaec, _0x57619b, _0xe7dd4[_0x24105d], 11, -358537222);
      _0x57619b = _0x5ce219(_0x57619b, _0x5e32e5, _0x3aafe2, _0x22eaec, _0xe7dd4[_0x24105d + 3], 16, -722521979);
      _0x22eaec = _0x5ce219(_0x22eaec, _0x57619b, _0x5e32e5, _0x3aafe2, _0xe7dd4[_0x24105d + 6], 23, 76029189);
      _0x3aafe2 = _0x5ce219(_0x3aafe2, _0x22eaec, _0x57619b, _0x5e32e5, _0xe7dd4[_0x24105d + 9], 4, -640364487);
      _0x5e32e5 = _0x5ce219(_0x5e32e5, _0x3aafe2, _0x22eaec, _0x57619b, _0xe7dd4[_0x24105d + 12], 11, -421815835);
      _0x57619b = _0x5ce219(_0x57619b, _0x5e32e5, _0x3aafe2, _0x22eaec, _0xe7dd4[_0x24105d + 15], 16, 530742520);
      _0x22eaec = _0x5ce219(_0x22eaec, _0x57619b, _0x5e32e5, _0x3aafe2, _0xe7dd4[_0x24105d + 2], 23, -995338651);
      _0x3aafe2 = _0x3b6321(_0x3aafe2, _0x22eaec, _0x57619b, _0x5e32e5, _0xe7dd4[_0x24105d], 6, -198630844);
      _0x5e32e5 = _0x3b6321(_0x5e32e5, _0x3aafe2, _0x22eaec, _0x57619b, _0xe7dd4[_0x24105d + 7], 10, 1126891415);
      _0x57619b = _0x3b6321(_0x57619b, _0x5e32e5, _0x3aafe2, _0x22eaec, _0xe7dd4[_0x24105d + 14], 15, -1416354905);
      _0x22eaec = _0x3b6321(_0x22eaec, _0x57619b, _0x5e32e5, _0x3aafe2, _0xe7dd4[_0x24105d + 5], 21, -57434055);
      _0x3aafe2 = _0x3b6321(_0x3aafe2, _0x22eaec, _0x57619b, _0x5e32e5, _0xe7dd4[_0x24105d + 12], 6, 1700485571);
      _0x5e32e5 = _0x3b6321(_0x5e32e5, _0x3aafe2, _0x22eaec, _0x57619b, _0xe7dd4[_0x24105d + 3], 10, -1894986606);
      _0x57619b = _0x3b6321(_0x57619b, _0x5e32e5, _0x3aafe2, _0x22eaec, _0xe7dd4[_0x24105d + 10], 15, -1051523);
      _0x22eaec = _0x3b6321(_0x22eaec, _0x57619b, _0x5e32e5, _0x3aafe2, _0xe7dd4[_0x24105d + 1], 21, -2054922799);
      _0x3aafe2 = _0x3b6321(_0x3aafe2, _0x22eaec, _0x57619b, _0x5e32e5, _0xe7dd4[_0x24105d + 8], 6, 1873313359);
      _0x5e32e5 = _0x3b6321(_0x5e32e5, _0x3aafe2, _0x22eaec, _0x57619b, _0xe7dd4[_0x24105d + 15], 10, -30611744);
      _0x57619b = _0x3b6321(_0x57619b, _0x5e32e5, _0x3aafe2, _0x22eaec, _0xe7dd4[_0x24105d + 6], 15, -1560198380);
      _0x22eaec = _0x3b6321(_0x22eaec, _0x57619b, _0x5e32e5, _0x3aafe2, _0xe7dd4[_0x24105d + 13], 21, 1309151649);
      _0x3aafe2 = _0x3b6321(_0x3aafe2, _0x22eaec, _0x57619b, _0x5e32e5, _0xe7dd4[_0x24105d + 4], 6, -145523070);
      _0x5e32e5 = _0x3b6321(_0x5e32e5, _0x3aafe2, _0x22eaec, _0x57619b, _0xe7dd4[_0x24105d + 11], 10, -1120210379);
      _0x57619b = _0x3b6321(_0x57619b, _0x5e32e5, _0x3aafe2, _0x22eaec, _0xe7dd4[_0x24105d + 2], 15, 718787259);
      _0x22eaec = _0x3b6321(_0x22eaec, _0x57619b, _0x5e32e5, _0x3aafe2, _0xe7dd4[_0x24105d + 9], 21, -343485441);
      _0x3aafe2 = _0x592c1e(_0x3aafe2, _0x2971fd);
      _0x22eaec = _0x592c1e(_0x22eaec, _0x193ee0);
      _0x57619b = _0x592c1e(_0x57619b, _0x5f0443);
      _0x5e32e5 = _0x592c1e(_0x5e32e5, _0x12ef8d);
    }

    return [_0x3aafe2, _0x22eaec, _0x57619b, _0x5e32e5];
  }

  function _0x364aed(_0x4df970) {
    var _0x4110e4;

    var _0x3987fc = "";

    var _0x26ba7b = 32 * _0x4df970.length;

    for (_0x4110e4 = 0; _0x4110e4 < _0x26ba7b; _0x4110e4 += 8) _0x3987fc += String.fromCharCode(_0x4df970[_0x4110e4 >> 5] >>> _0x4110e4 % 32 & 255);

    return _0x3987fc;
  }

  function _0x238469(_0x4c355a) {
    var _0x5b6037;

    var _0x4b3261 = [];

    for (_0x4b3261[(_0x4c355a.length >> 2) - 1] = void 0, _0x5b6037 = 0; _0x5b6037 < _0x4b3261.length; _0x5b6037 += 1) _0x4b3261[_0x5b6037] = 0;

    var _0x1ac6e1 = 8 * _0x4c355a.length;

    for (_0x5b6037 = 0; _0x5b6037 < _0x1ac6e1; _0x5b6037 += 8) _0x4b3261[_0x5b6037 >> 5] |= (255 & _0x4c355a.charCodeAt(_0x5b6037 / 8)) << _0x5b6037 % 32;

    return _0x4b3261;
  }

  function _0x51d15e(_0x40b6c7) {
    return _0x364aed(_0x2a57cc(_0x238469(_0x40b6c7), 8 * _0x40b6c7.length));
  }

  function _0x19aa8c(_0x5cef23) {
    var _0x5b9898;

    var _0x3bf3a3;

    var _0x1196aa = "0123456789abcdef";
    var _0x41b0fb = "";

    for (_0x3bf3a3 = 0; _0x3bf3a3 < _0x5cef23.length; _0x3bf3a3 += 1) {
      _0x5b9898 = _0x5cef23.charCodeAt(_0x3bf3a3);
      _0x41b0fb += _0x1196aa.charAt(_0x5b9898 >>> 4 & 15) + _0x1196aa.charAt(15 & _0x5b9898);
    }

    return _0x41b0fb;
  }

  function _0x56abf7(_0x28b484) {
    return unescape(encodeURIComponent(_0x28b484));
  }

  function _0x29f454(_0x1dd19a) {
    return _0x51d15e(_0x56abf7(_0x1dd19a));
  }

  function _0x24065f(_0x2fd186) {
    return _0x19aa8c(_0x29f454(_0x2fd186));
  }

  function _0x3b21f8(_0x5985e0, _0x87474c, _0x1511b0) {
    _0x349184();

    return _0x87474c ? _0x1511b0 ? _0x4fdf8e(_0x87474c, _0x5985e0) : y(_0x87474c, _0x5985e0) : _0x1511b0 ? _0x29f454(_0x5985e0) : _0x24065f(_0x5985e0);
  }

  function _0x4ae643(_0x1edf63, _0x35fc41) {
    document.cookie = "m" + "=" + _0x3b21f8(_0x1edf63) + "|" + _0x1edf63 + "; path=/";
    m_res = document.cookie
    // location.reload();
  }

  function _0x58ff33(_0x24d2b2, _0x1777aa) {
    return Date.parse(new Date());
  }

  _0x4ae643(_0x58ff33());
})();

function $dbsm_0x5c6761(_0x58b4f8) {
  function _0x591cdd(_0x28c256) {
    if (typeof _0x28c256 === "string") {
      return function (_0x30e175) {}.constructor("while (true) {}").apply("counter");
    } else {
      if (("" + _0x28c256 / _0x28c256).length !== 1 || _0x28c256 % 20 === 0) {
        (function () {
          return !![];
        }).constructor("debugger").call("action");
      } else {
        (function () {
          return ![];
        }).constructor("debugger").apply("stateObject");
      }
    }

    // _0x591cdd(++_0x28c256);
  }

  try {
    if (_0x58b4f8) {
      return _0x591cdd;
    } else {
      _0x591cdd(0);
    }
  } catch (_0x28daca) {
    console.log(_0x28daca);
  }
}

function get_m(){
  aa()
  console.log(m_res)
}

get_m()

哈里路大旋风啊啊啊啊啊啊啊啊啊

关注

4
点赞
踩
7

收藏

觉得还不错? 一键收藏
0
评论
猿人学第二题js 混淆动态cookie但是hook不到m参数

0xdc09f2.test(_0x41c338)，递归调用自己造成死循环，这里直接将return结果改为true即可。后面发现请求分为两次，第一次请求回返回一段js，浏览器运行后生成m参数，后面的请求都会带有m参数。而且第一次返回的js有反调试代码，会正则匹配死循环导致浏览器奔溃，我的浏览器很难hook到。按照网上的方法hook，cookie内的参数m发现并不成功，看起来这题很繁琐实则一点也不简单。首先我们关注的是m的生成过程那么就从m生成过程中debug。后面发现程序在某地死循环了。
复制链接

扫一扫