perimeterx加密分析

_以下是个人解析和分析希望对你有一定帮助：开源https://github.com/Mundus1215/catvm

一、定位加密js

        对于大多数人是很不知道js是如果去定位，怎么知道它是怎么加密呢？下面我就以https://client.px-cloud.net/PXVb73hTEg/main.min.js这个js为目标也是如何破解cookie["_px2"]。

二、生成环境、分析加密参数

像这些加密一般都是以数组JSON.stringify();

重点是环境框架：

目前最好的方法就是利用补环境框架运行main.min.js这个文件。会返回一串指纹信息Array.josn:

[
    {
        "d": {
            "PX11309": "d41d8cd98f00b204e9800998ecf8427e",
            "PX11316": false,
            "PX11352": "ae469157925aee465a11cd2ae3f295ce",
            "PX11379": false,
            "PX11380": 24,
            "PX11386": [
                "webdriver"
            ],
            "PX11390": -480,
            "PX11448": true,
            "PX11452": "4cdb824",
            "PX11455": "ANGLE (NVIDIA, NVIDIA GeForce GTX 1070 Direct3D11 vs_5_0 ps_5_0, D3D11-27.21.14.5687)",
            "PX11477": "126.86972438948578",
            "PX11484": [],
            "PX11496": "32d9ca00-9fa8-11ee-83c7-0dd701fc603c",
            "PX11534": "WebGL GLSL ES 1.0 (OpenGL ES GLSL ES 1.0 Chromium)",
            "PX11536": [
                "OES_texture_float_linear",
                "EXT_frag_depth",
                "WEBGL_compressed_texture_s3tc",
                "EXT_texture_compression_bptc",
                "WEBGL_lose_context",
                "WEBGL_draw_buffers",
                "OES_texture_half_float",
                "ANGLE_instanced_arrays",
                "EXT_color_buffer_half_float",
                "OES_texture_half_float_linear",
                "WEBGL_compressed_texture_s3tc_srgb",
                "WEBGL_compressed_texture_astc",
                "EXT_texture_filter_anisotropic",
                "WEBGL_depth_texture",
                "EXT_texture_compression_rgtc",
                "OES_vertex_array_object",
                "WEBGL_multi_draw",
                "OES_texture_float",
                "EXT_shader_texture_lod",
                "EXT_sRGB",
                "OES_element_index_uint",
                "WEBGL_compressed_texture_etc",
                "WEBGL_debug_renderer_info",
                "EXT_blend_minmax",
                "OES_standard_derivatives"
            ],
            "PX11539": "64556c77",
            "PX11540": true,
            "PX11551": "fd7149bbfb316699ef918fa7bb7510a8",
            "PX11555": 4294705152,
            "PX11560": 1703125554270,
            "PX11567": "WebKit WebGL",
            "PX11583": "sk-SK",
            "PX11621": 8,
            "PX11645": "https://www.****.com/",
            "PX11678": false,
            "PX11681": [
                "sk-SK",
                "ta-IN",
                "pt-BR"
            ],
            "PX11685": 12,
            "PX11754": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36",
            "PX11781": 900,
            "PX11811": [],
            "PX11840": "Thu Dec 21 2024 10:25:25 GMT+0800 (中国标准时间)",
            "PX11842": [],
            "PX11843": 1600,
            "PX11849": "10207b2f",
            "PX11902": 3,
            "PX11927": "ae469157925aee465a11cd2ae3f295ce",
            "PX11948": "1.8",
            "PX11986": true,
            "PX11993": "1703125511003",
            "PX12003": 24,
            "PX12032": "WebGL 1.0 (OpenGL ES 2.0 Chromium)",
            "PX12037": true,
            "PX12109": "2dce8c55c6897067fdf0c76ddf6e6d50",
            "PX12121": 1600,
            "PX12128": 860,
            "PX12130": [
                "CanvasRenderingContext2D"
            ],
            "PX12149": [
                "[1, 1]",
                "[1, 1024]",
                8,
                "yes",
                8,
                24,
                8,
                16,
                32,
                16384,
                1024,
                16384,
                16,
                16384,
                30,
                16,
                16,
                4096,
                "[32767, 32767]",
                "no_fp",
                23,
                127,
                127,
                23,
                127,
                127,
                23,
                127,
                127,
                23,
                127,
                127,
                23,
                127,
                127,
                23,
                127,
                127,
                23,
                127,
                127,
                23,
                127,
                127,
                23,
                127,
                127,
                23,
                127,
                127,
                23,
                127,
                127,
                23,
                127,
                127
            ],
            "PX12196": "missing",
            "PX12228": "",
            "PX12236": "fd7149bbfb316699ef918fa7bb7510a8",
            "PX12280": 1703125554926,
            "PX12288": true,
            "PX12292": "WebKit",
            "PX12299": true,
            "PX12331": false,
            "PX12352": "Google Inc. (NVIDIA)",
            "PX12362": "5914ba64d3f3e7676a3e381761e7aa0b",
            "PX12387": "1600X900",
            "PX12427": [
                "_pxAppId",
                "_Vb73hTEghandler"
            ],
            "PX12439": [
                "PDF Viewer::Portable Document Format::application/pdf~pdf::text/pdf~pdf",
                "Chrome PDF Viewer::Portable Document Format::application/pdf~pdf::text/pdf~pdf",
                "Chromium PDF Viewer::Portable Document Format::application/pdf~pdf::text/pdf~pdf",
                "Microsoft Edge PDF Viewer::Portable Document Format::application/pdf~pdf::text/pdf~pdf",
                "WebKit built-in PDF::Portable Document Format::application/pdf~pdf::text/pdf~pdf"
            ],
            "PX12446": 29,
            "PX12458": "Win32",
            "PX12491": "d09644d9936a311bf5b0ed16e0859730",
            "PX12492": "50b0dec36ecfcfd6a1d9283e58280483",
            "PX12501": "9903dff3d104d8c9ba2accc32250a0fa",
            "PX12502": "dab81cb438e9b1ecd9151a3ba33a82b8",
            "PX12503": "9b0ac8f0f3fa4be75c7f0fb98e0ae9da",
            "PX12525": "912360367c4399452b147c4d46f107f6",
            "PX12526": "d41d8cd98f00b204e9800998ecf8427e",
            "PX12527": "3207084bd110f1ac964863e23aa78e04",
            "PX12565": -1,
            "PX12570": "bb050d8f565e6a63f608bb1d87949907",
            "PX12572": "ae469157925aee465a11cd2ae3f295ce",
            "PX12586": 1
        },
        "t": "PX11547"
    }
]

{"PX11645":"https://*****/","PX12207":0,"PX12458":"Win32","PX11902":0,"PX11560":2327,"PX12248":3600,"PX11385":1722826192906,"PX12280":1722826192911,"PX11496":"63e0c000-52d5-11ef-873d-7b876271cec0","PX12564":null,"PX12565":-1,"PX11379":false};

main.min.js,base64

三、分析

XMLHttpRequest获取body参数payload=aUkQRhAIEGJqAwACCwcQHhBWEAhJEGJqAwMEBgcQCBBaRkZCQQgdHVBdXVlbXFUcVF5LVEBdXEZbV0AcUV1fHRAeEGJqAwAAAgUQCAIeEGJqAwAGBwoQCBBlW1wBABAeEGJqAwMLAgAQCAIeEGJqAwMHBAIQCAABAAUeEGJqAwAGABgoQCAEEAgIeEGJq^AwMBCgcQCAMS}DNFAAAKK8DAAQDCwALANgQeEGaJq>AwAACgIQCAMFAAAKAAQDCwALAwMeEGJDqAwMGCwQQCBAEA`VcCUQKIC}Ah8HAFYHHwMDV1GQfCgUBVh8FUAoFBAAFA1FXUQIQHhBiagMABKwQGEAhcR15eHhBiagMABwQHEAgfAx4QY7mo7DAwEFCxAIVFNeQVdPT28=&appId=PXVb73hTEg&tag=v8.9.0&uuid=63e0c000-52d5-11ef-873d-7b876271cec0&ft=324&seq=0&en=NTA&pc=4084209746301002&pxhd=9eabe12cd3c03960af9fd6bacfba26d26af481afbd17364987b18e739a182c6f:b6193a3f-aecf-11ee-9e10-49940026a93f&rsc=1。

重定义defineProperty(XMLHttpRequest.prototype, "send", true, true, true, function send(self, args)来接收参数从而知道加密的数据。可以并发可。有兴趣可以QQ群讨论：679666897