鼠标移动轨迹检测

     本文章中内容仅供项目展示使用，不用于其他任何目的，逆向项目不提供完整代码，抓包内容、敏感网址、数据接口等均已做脱敏处理，严禁用于商业用途和非法用途，否则由此产生的一切后果均与作者无关！ 本文章未经许可禁止转载，禁止任何修改后二次传播，擅自使用本文讲解的技术而导致的任何意外，作者均不负任何法律责任，若有侵权，请联系作者立即删除！

鼠标轨迹检测demo

     在某反爬的安全产品中，检测了鼠标轨迹，鼠标轨迹会发送到后端，后端会用机器学习算法判断是否为正常人类的移动轨迹。
     如果你是用自动化工具操作，例如selenium，playwright这种来操作dom元素，是不存在鼠标轨迹的。如果你用补环境的方法去做，没有做鼠标轨迹的算法，会发现最终生成的加密长度不对。
     下面是一个小demo，F12在网页中运行

(function(_0x2df185, _0x941b30) {
    function _0x28cc0a(_0x3f8b95, _0x2f36d4, _0x1ff75d, _0x24beee, _0x7141e9) {
        return _0x552f(_0x1ff75d - -0x3c, _0x7141e9);
    }
    const _0x3c4855 = _0x2df185();
    function _0x2840f7(_0x32108f, _0x304d77, _0x5b4cfb, _0x55e10f, _0x5425b8) {
        return _0x552f(_0x55e10f - 0x18d, _0x32108f);
    }
    function _0x13952f(_0xb17751, _0x5bcbba, _0x52d5e4, _0x64ab7a, _0x232646) {
        return _0x552f(_0x64ab7a - 0x30b, _0x5bcbba);
    }
    function _0xb7907d(_0x58fdcc, _0x16cfc6, _0x31412d, _0x8495d8, _0x2b0f61) {
        return _0x552f(_0x16cfc6 - 0x17c, _0x8495d8);
    }
    function _0x2787e7(_0x19be86, _0x5122e3, _0x4c7681, _0x17d2b4, _0x5bdbc8) {
        return _0x552f(_0x5bdbc8 - 0xf4, _0x17d2b4);
    }
    while (!![]) {
        try {
            const _0x5d35b8 = -parseInt(_0x2787e7(0x295, 0x297, 0x2a8, 0x288, 0x29e)) / (0x3d2 * 0x4 + 0x1829 + -0x2770 * 0x1) * (parseInt(_0x2787e7(0x2bc, 0x2b3, 0x2b4, 0x2a1, 0x2a5)) / (-0x1 * 0x1e07 + -0x8dd + 0x26e6)) + -parseInt(_0x2840f7(0x32a, 0x32e, 0x327, 0x32b, 0x337)) / (0xed * -0xb + -0x1 * -0xed2 + -0x25 * 0x20) * (-parseInt(_0xb7907d(0x314, 0x30a, 0x2f4, 0x307, 0x31a)) / (0x9 * -0x1f + 0x6f5 + -0x5da)) + parseInt(_0x2840f7(0x32a, 0x339, 0x33b, 0x341, 0x350)) / (0x1963 * 0x1 + 0xb2d * -0x2 + -0x304) * (parseInt(_0x28cc0a(0x167, 0x161, 0x158, 0x157, 0x159)) / (-0xbd * -0x1f + -0x3ee + -0x12ef)) + -parseInt(_0x13952f(0x496, 0x4a7, 0x47e, 0x492, 0x4a2)) / (-0x1 * -0x16ac + -0xb1e + -0x1 * 0xb87) * (parseInt(_0xb7907d(0x32d, 0x317, 0x310, 0x32d, 0x31b)) / (-0x1 * -0x2489 + 0x1 * -0x1c73 + -0x80e)) + -parseInt(_0x28cc0a(0x159, 0x15d, 0x168, 0x16b, 0x17c)) / (0x21d0 + 0xea1 + -0x1 * 0x3068) * (-parseInt(_0x2787e7(0x281, 0x290, 0x2a9, 0x27b, 0x294)) / (0x91 + 0x2f + -0x2 * 0x5b)) + -parseInt(_0x13952f(0x4a6, 0x4d4, 0x4ae, 0x4be, 0x4be)) / (-0x1bb5 + -0x175d + 0x331d) + -parseInt(_0x2787e7(0x2a1, 0x2a4, 0x292, 0x2a5, 0x29c)) / (-0x242 + -0x1b10 + 0x1d5e) * (-parseInt(_0x13952f(0x491, 0x4a6, 0x483, 0x496, 0x481)) / (-0x16fa + 0x108 * -0x6 + 0x1d37));
            if (_0x5d35b8 === _0x941b30)
                break;
            else
                _0x3c4855['push'](_0x3c4855['shift']());
        } catch (_0x3fbf61) {
            _0x3c4855['push'](_0x3c4855['shift']());
        }
    }
}(_0x5d16, -0x2ff54 + -0x555bd + 0xe28c3));
let _0x15c1f2 = [];
function _0x5d16() {
    const _0x4cde78 = ['split', 'mouse', 'dzBOa', '935464LLLpHe', '3|4|6', '5338366fGnHlB', '895EdqMAn', 'oOOEC', 'offse', 'butto', '35oqIGZa', 'stene', 'ing', 'lengt', '923qhdLMb', 'push', 'HWoOi', '18676qmOwAb', 'log', 'sCiPT', 'XsNNN', '|1|7|', 'IhJlO', '21246reCCQT', 'BHWif', 'clien', 'move', 'tamp', 'nagvl', 'fjHRT', '656408IGXjBc', '|8|2', 'toStr', '303VmBEdf', 'addEv', '80aLiNcA', 'down', 'entLi', '0|5|9', '660861aOMHSC', 'pekhP', 'hwTlr', 'scree', '8844SCwkOX', 'timeS', '1ouNQDc', 'HYFFC', 'waSFP', 'RJsMH'];
    _0x5d16 = function() {
        return _0x4cde78;
    }
    ;
    return _0x5d16();
}
function _0x163dc5(_0x233aef, _0x294c87, _0x18a78d, _0x5ba24e, _0x4d48c8) {
    return _0x552f(_0x233aef - -0x261, _0x18a78d);
}
function _0x5ec96b(_0x43135f, _0x456034, _0xd60681, _0x3d70c6, _0x10919a) {
    return _0x552f(_0x10919a - 0x368, _0x3d70c6);
}
let _0x3861e4 = function _0x401f53(_0x44f836) {
    function _0x390a4a(_0x174c60, _0x432c19, _0x25af01, _0x2f1018, _0x1473c5) {
        return _0x552f(_0x2f1018 - -0x391, _0x174c60);
    }
    const _0x20e010 = {
        'oOOEC': function(_0x53cefc, _0x7413dc) {
            return _0x53cefc < _0x7413dc;
        },
        'hwTlr': function(_0x11473a, _0x194caa) {
            return _0x11473a !== _0x194caa;
        },
        'BHWif': _0x3038fe(-0x174, -0x185, -0x199, -0x195, -0x187),
        'sCiPT': _0x3038fe(-0x17c, -0x18b, -0x195, -0x17b, -0x190) + _0x37960c(-0xdb, -0xe9, -0xec, -0xd5, -0xe9) + _0x390a4a(-0x1d6, -0x1ef, -0x1df, -0x1df, -0x1e3) + _0x37960c(-0xd7, -0xe5, -0xe2, -0xcf, -0xcc),
        'HWoOi': function(_0x22a805, _0x9bbeac) {
            return _0x22a805(_0x9bbeac);
        }
    };
    let _0x30a17c = [];
    function _0x1e7e14(_0x2abd75, _0x3a1dd2, _0x685d4f, _0x382d49, _0x4e0313) {
        return _0x552f(_0x685d4f - -0x207, _0x3a1dd2);
    }
    for (let _0x3f1919 = 0x22 * 0xc7 + 0x97b * 0x1 + 0x23e9 * -0x1; _0x20e010[_0x390a4a(-0x1e0, -0x1c9, -0x1d5, -0x1dc, -0x1ce)](_0x3f1919, -0x1 * 0x17ea + -0x18c1 + -0x1 * -0x30b5); _0x3f1919++) {
        if (_0x20e010[_0x37960c(-0xcb, -0xf0, -0xd8, -0xd5, -0xc1)](_0x20e010[_0x390a4a(-0x205, -0x1f4, -0x1eb, -0x1fc, -0x1e3)], _0x20e010[_0x37960c(-0xd4, -0xd8, -0xe9, -0xd4, -0xf7)]))
            _0x911d4d[_0x3038fe(-0x1a6, -0x1af, -0x1a1, -0x193, -0x1a7)](_0x14f973);
        else {
            const _0x1e7c8e = _0x20e010[_0x1e7e14(-0x65, -0x87, -0x77, -0x7c, -0x70)][_0x37960c(-0xba, -0xc9, -0xd0, -0xd6, -0xe9)]('|');
            let _0x27d827 = -0x4 * 0x50 + -0x1cc7 + -0x1e07 * -0x1;
            while (!![]) {
                switch (_0x1e7c8e[_0x27d827++]) {
                case '0':
                    _0x30a17c[_0x3038fe(-0x19c, -0x1bf, -0x19b, -0x18f, -0x1a7)](_0x44f836[_0x3f1919][_0x1e7e14(-0x6c, -0x87, -0x71, -0x62, -0x87) + 'tX']);
                    continue;
                case '1':
                    _0x30a17c[_0x390a4a(-0x200, -0x21d, -0x21c, -0x205, -0x213)](_0x44f836[_0x3f1919][_0x37960c(-0xed, -0xe9, -0xd7, -0xc7, -0xcf) + 'nX']);
                    continue;
                case '2':
                    _0x30a17c[_0x37960c(-0x10b, -0x106, -0xf2, -0xf3, -0x102)](_0x44f836[_0x3f1919]['y']);
                    continue;
                case '3':
                    _0x30a17c[_0x390a4a(-0x1ed, -0x214, -0x212, -0x205, -0x211)](_0x44f836[_0x3f1919][_0x3038fe(-0x1b1, -0x1b3, -0x1a3, -0x1a6, -0x1ad) + 'n']);
                    continue;
                case '4':
                    _0x30a17c[_0x3038fe(-0x1bd, -0x1bc, -0x1bc, -0x19e, -0x1a7)](_0x44f836[_0x3f1919][_0x390a4a(-0x20b, -0x211, -0x211, -0x20c, -0x203) + 'tX']);
                    continue;
                case '5':
                    _0x30a17c[_0x3038fe(-0x199, -0x1a2, -0x1ba, -0x1b8, -0x1a7)](_0x44f836[_0x3f1919][_0x1e7e14(-0x5e, -0x72, -0x71, -0x86, -0x82) + 'tY']);
                    continue;
                case '6':
                    _0x30a17c[_0x4fde0c(-0x21e, -0x22b, -0x226, -0x227, -0x22e)](_0x44f836[_0x3f1919][_0x1e7e14(-0x7e, -0x80, -0x82, -0x6e, -0x90) + 'tY']);
                    continue;
                case '7':
                    _0x30a17c[_0x3038fe(-0x191, -0x19c, -0x192, -0x1ab, -0x1a7)](_0x44f836[_0x3f1919][_0x3038fe(-0x19a, -0x18b, -0x18e, -0x193, -0x18c) + 'nY']);
                    continue;
                case '8':
                    _0x30a17c[_0x390a4a(-0x203, -0x1fe, -0x20a, -0x205, -0x1ff)](_0x44f836[_0x3f1919]['x']);
                    continue;
                case '9':
                    _0x30a17c[_0x1e7e14(-0x79, -0x65, -0x7b, -0x74, -0x8c)](_0x44f836[_0x3f1919][_0x37960c(-0xda, -0xe2, -0xd5, -0xd8, -0xd7) + _0x3038fe(-0x18c, -0x1a4, -0x184, -0x18a, -0x19b)]);
                    continue;
                }
                break;
            }
        }
    }
    function _0x4fde0c(_0x4cf5d4, _0x6f598e, _0x35b8ef, _0x5e04fc, _0x37e4ba) {
        return _0x552f(_0x6f598e - -0x3b7, _0x5e04fc);
    }
    function _0x3038fe(_0x577e55, _0x11c6ba, _0x1f02e7, _0x5e86a8, _0x1c3efe) {
        return _0x552f(_0x1c3efe - -0x333, _0x1f02e7);
    }
    function _0x37960c(_0x5d23de, _0x22eb8a, _0x49dd68, _0x1447a3, _0x4618e4) {
        return _0x552f(_0x49dd68 - -0x27e, _0x5d23de);
    }
    let _0x452b16 = _0x20e010[_0x3038fe(-0x1a6, -0x192, -0x1ae, -0x192, -0x1a6)](btoa, _0x30a17c[_0x390a4a(-0x1e2, -0x202, -0x1e3, -0x1f4, -0x1e3) + _0x390a4a(-0x21e, -0x21f, -0x201, -0x208, -0x213)]());
    console[_0x390a4a(-0x1fe, -0x212, -0x20b, -0x202, -0x216)](_0x452b16);
}
  , _0x4b2a86 = function _0x225322(_0x1bb6f7) {
    function _0x42b418(_0x202013, _0x126729, _0x295d25, _0x16543c, _0x61c7e6) {
        return _0x552f(_0x295d25 - -0x140, _0x16543c);
    }
    _0x15c1f2[_0x42b418(0x42, 0x44, 0x4c, 0x54, 0x4b)](_0x1bb6f7);
}
  , _0x4e9dab = function _0x3186ea(_0x5468bd) {
    function _0x135421(_0x3bf148, _0x387ce9, _0x457cd4, _0x3692b1, _0x5dd4dd) {
        return _0x552f(_0x3692b1 - -0x14a, _0x457cd4);
    }
    _0x15c1f2[_0x135421(0x57, 0x35, 0x5a, 0x42, 0x54)](_0x5468bd);
}
  , _0x30a83b = function _0x926746(_0xb0a42f) {
    function _0x526d18(_0x3c5bcc, _0x10d524, _0x51b0c2, _0x2a43ec, _0x37b029) {
        return _0x552f(_0x2a43ec - -0x1b5, _0x37b029);
    }
    function _0x48064d(_0x4a8940, _0x11b020, _0x45379a, _0x5bda13, _0x3fdfb7) {
        return _0x552f(_0x11b020 - -0x7b, _0x5bda13);
    }
    const _0x15b912 = {
        'XsNNN': function(_0x275765, _0x29ceca) {
            return _0x275765 - _0x29ceca;
        },
        'dzBOa': function(_0x210a21, _0xb95b32) {
            return _0x210a21 < _0xb95b32;
        },
        'RJsMH': function(_0x5e7a79, _0x300e86) {
            return _0x5e7a79 === _0x300e86;
        },
        'nagvl': _0x48064d(0x12a, 0x11f, 0x138, 0x110, 0x120),
        'HYFFC': _0x48064d(0x104, 0x118, 0x12d, 0x124, 0x114),
        'pekhP': function(_0x1a5889, _0x572d0d) {
            return _0x1a5889(_0x572d0d);
        }
    };
    _0x15c1f2[_0x526d18(-0x10, -0x1c, -0x36, -0x29, -0x11)](_0xb0a42f);
    function _0x19d980(_0x4879f7, _0x6b3db2, _0x2abb0a, _0x2e2430, _0x385ddc) {
        return _0x552f(_0x385ddc - 0x323, _0x4879f7);
    }
    function _0x529a34(_0x417e3c, _0x617cfd, _0x195127, _0x2d2728, _0x1a9697) {
        return _0x552f(_0x617cfd - -0x20f, _0x195127);
    }
    let _0x3bcb90 = _0x15c1f2[_0x526d18(-0x22, -0x25, -0x30, -0x2b, -0x21) + 'h'];
    function _0x35550d(_0x5c9240, _0x54cf28, _0xa9d863, _0x3e1f82, _0x382e1e) {
        return _0x552f(_0x382e1e - 0xc6, _0xa9d863);
    }
    let _0x3b8e93 = [];
    for (let _0x4b9bd5 = _0x15b912[_0x35550d(0x26d, 0x245, 0x261, 0x26f, 0x257)](_0x3bcb90, -0x80a + -0xc2 * -0x2 + 0x690); _0x15b912[_0x35550d(0x27b, 0x266, 0x26d, 0x286, 0x276)](_0x4b9bd5, _0x3bcb90); _0x4b9bd5++) {
        _0x15b912[_0x19d980(0x4c0, 0x4c3, 0x4ce, 0x4e8, 0x4d0)](_0x15b912[_0x35550d(0x258, 0x26f, 0x247, 0x265, 0x25f)], _0x15b912[_0x48064d(0x12e, 0x130, 0x130, 0x13e, 0x11a)]) ? _0x6d069b[_0x529a34(-0x91, -0x83, -0x79, -0x8a, -0x88)](_0x693aaa) : _0x3b8e93[_0x529a34(-0x7f, -0x83, -0x89, -0x6e, -0x99)](_0x15c1f2[_0x4b9bd5]);
    }
    _0x15b912[_0x526d18(-0x1d, -0x3, -0x7, -0x10, -0x1a)](_0x3861e4, _0x3b8e93);
};
function _0x963edd(_0x44e3a3, _0x48b5e4, _0x1baeef, _0x3e84f1, _0x45a0bf) {
    return _0x552f(_0x3e84f1 - 0x148, _0x48b5e4);
}
function _0x552f(_0x39fbb0, _0x43f9a6) {
    const _0x977e0f = _0x5d16();
    return _0x552f = function(_0x159570, _0x4c2ae6) {
        _0x159570 = _0x159570 - (0x1a63 + 0x5e7 * 0x1 + -0x1ec5 * 0x1);
        let _0x17552e = _0x977e0f[_0x159570];
        return _0x17552e;
    }
    ,
    _0x552f(_0x39fbb0, _0x43f9a6);
}
function _0x1cd033(_0x2e7f19, _0x906d76, _0x43781, _0x9d0c0f, _0x233116) {
    return _0x552f(_0x2e7f19 - 0xab, _0x906d76);
}
document[_0x163dc5(-0xc2, -0xb1, -0xd8, -0xae, -0xb6) + _0x163dc5(-0xbf, -0xc0, -0xc9, -0xc5, -0xb5) + _0x5ec96b(0x4e3, 0x4f9, 0x507, 0x4ed, 0x4f0) + 'r'](_0x963edd(0x2fe, 0x2df, 0x2e6, 0x2f7, 0x2f9) + _0x5ec96b(0x4e9, 0x50e, 0x4ff, 0x4fe, 0x4ff), _0x4b2a86);
function _0x494690(_0x657274, _0x3ea3f8, _0x38d190, _0x42d48e, _0x2b50cf) {
    return _0x552f(_0x2b50cf - 0x1bd, _0x42d48e);
}
document[_0x5ec96b(0x514, 0x518, 0x511, 0x515, 0x507) + _0x494690(0x34a, 0x35e, 0x371, 0x347, 0x35f) + _0x163dc5(-0xd9, -0xc2, -0xec, -0xd9, -0xee) + 'r'](_0x963edd(0x2fd, 0x300, 0x2e9, 0x2f7, 0x304) + _0x1cd033(0x24c, 0x24e, 0x242, 0x245, 0x264), _0x4e9dab),
document[_0x494690(0x344, 0x36f, 0x347, 0x354, 0x35c) + _0x1cd033(0x24d, 0x24f, 0x249, 0x253, 0x238) + _0x963edd(0x2d7, 0x2ce, 0x2c9, 0x2d0, 0x2c8) + 'r'](_0x1cd033(0x25a, 0x265, 0x253, 0x252, 0x269) + 'up', _0x30a83b);

     当你移动鼠标点击屏幕，并且松手的时候，会发现在控制栏输出一串加密的字符串

     这里是怎么检测的呢？实际上是网页中监听了mousemove，mousedown与mouseup事件，你移动的时候会触发mousemove事件，会将你的鼠标移动轨迹添加到一个数组中，当你鼠标抬起的时候，它会将之前收集的所有鼠标轨迹进行加密

鼠标轨迹的event里面有很多属性，位置信息，时间戳等等。这些都可以作为检测的手段

补环境做法

     将所有的异步事件利用代理拦截，将网页监听事件单独加到一个变量中，当代码执行完成后，执行自己写的异步代码逻辑（需要将异步改成同步）。当检测到这个变量中有鼠标事件后，去遍历继承MouseEvent这个事件原型，前提是在初始化的时候录制好一个轨迹，然后回调，去调用这个鼠标函数地方的逻辑。
     然后你会发现，又触发了很多事件，补全以后，你会发现最终加密生成的结果变长了。