echo094 / decode-js

JS混淆代码的AST分析工具 AST analysis tool for obfuscated JS code
MIT License
648 stars 324 forks source link

jsjiami v7挂了 #81

Closed black-fruit closed 6 months ago

echo094 commented 6 months ago

贴个样本吧

black-fruit commented 6 months ago

连官网加密例子都解不了,也有可能是我选择有问题,但是我所有插件试一遍都没解开,二次封装的在线的那个挂掉了

var _0xodH='jsjiami.com.v7';function _0xb03f(_0x4c1d39,_0x4c247b){var _0x1ae8be=_0x1ae8();return _0xb03f=function(_0xb03f7b,_0x464b92){_0xb03f7b=_0xb03f7b-0xee;var _0x84e7a3=_0x1ae8be[_0xb03f7b];if(_0xb03f['smdrnE']===undefined){var _0x100979=function(_0x1977e0){var _0xcef8f8='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';var _0x132dcd='',_0x154157='';for(var _0x49768e=0x0,_0x4ac9ca,_0x233cab,_0x218207=0x0;_0x233cab=_0x1977e0['charAt'](_0x218207++);~_0x233cab&&(_0x4ac9ca=_0x49768e%0x4?_0x4ac9ca*0x40+_0x233cab:_0x233cab,_0x49768e++%0x4)?_0x132dcd+=String['fromCharCode'](0xff&_0x4ac9ca>>(-0x2*_0x49768e&0x6)):0x0){_0x233cab=_0xcef8f8['indexOf'](_0x233cab);}for(var _0x3642a9=0x0,_0xf0fd48=_0x132dcd['length'];_0x3642a9<_0xf0fd48;_0x3642a9++){_0x154157+='%'+('00'+_0x132dcd['charCodeAt'](_0x3642a9)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x154157);};var _0x2a8e88=function(_0x50b48a,_0x1e2c79){var _0x26b281=[],_0x4faa1d=0x0,_0x57c0d4,_0x3413a1='';_0x50b48a=_0x100979(_0x50b48a);var _0x59fbc9;for(_0x59fbc9=0x0;_0x59fbc9<0x100;_0x59fbc9++){_0x26b281[_0x59fbc9]=_0x59fbc9;}for(_0x59fbc9=0x0;_0x59fbc9<0x100;_0x59fbc9++){_0x4faa1d=(_0x4faa1d+_0x26b281[_0x59fbc9]+_0x1e2c79['charCodeAt'](_0x59fbc9%_0x1e2c79['length']))%0x100,_0x57c0d4=_0x26b281[_0x59fbc9],_0x26b281[_0x59fbc9]=_0x26b281[_0x4faa1d],_0x26b281[_0x4faa1d]=_0x57c0d4;}_0x59fbc9=0x0,_0x4faa1d=0x0;for(var _0x4deed6=0x0;_0x4deed6<_0x50b48a['length'];_0x4deed6++){_0x59fbc9=(_0x59fbc9+0x1)%0x100,_0x4faa1d=(_0x4faa1d+_0x26b281[_0x59fbc9])%0x100,_0x57c0d4=_0x26b281[_0x59fbc9],_0x26b281[_0x59fbc9]=_0x26b281[_0x4faa1d],_0x26b281[_0x4faa1d]=_0x57c0d4,_0x3413a1+=String['fromCharCode'](_0x50b48a['charCodeAt'](_0x4deed6)^_0x26b281[(_0x26b281[_0x59fbc9]+_0x26b281[_0x4faa1d])%0x100]);}return _0x3413a1;};_0xb03f['UboeQq']=_0x2a8e88,_0x4c1d39=arguments,_0xb03f['smdrnE']=!![];}var _0x4876ff=_0x1ae8be[0x0],_0x425802=_0xb03f7b+_0x4876ff,_0x28ce7f=_0x4c1d39[_0x425802];return!_0x28ce7f?(_0xb03f['dEmBOt']===undefined&&(_0xb03f['dEmBOt']=!![]),_0x84e7a3=_0xb03f['UboeQq'](_0x84e7a3,_0x464b92),_0x4c1d39[_0x425802]=_0x84e7a3):_0x84e7a3=_0x28ce7f,_0x84e7a3;},_0xb03f(_0x4c1d39,_0x4c247b);}function _0x1ae8(){var _0x3de0a0=(function(){return[_0xodH,'tfbjrkslYjIIitwamhSi.yFhcetToGmAP.Av7rhO==','WPHvw8o2vaVcN8o3kfa5qW','ygRcUSouW7HKWPZcNG','k8kgFmogpqefBCkf','WRNdJc5hWQ3cJ0GusSo1WRXW','W5eABrfNAcFcN8kJAwjs','WRxdPeZcOSoeatJdQtG','WRBcUwu+WQL/W5NdTG'].concat((function(){return['WPPDxCo1xq3cJCo0i3OzFq','qCkjW7dcPSkhWR9KW4u','DHVdNH3cLg3dUwK7WPJcIw3dIW','zSoxpCoT','5PYy56UT5y6b5PAlW73LUktLJ6tNO7JLJ6dNMRBMLRtNIzZMNjldKSkl5yMj54IT776j5yAE5P2Y5AwO5Oc15OoT5yMW5A6i776T56ki6kwU6zIX5BM+5PUD6AMq44cz','WO9jW6/dP2KuW4P7WRZdJSkRW5i','W5myAbvHys7cPCklBx9v','cSkqc8kwmNpdG8ojkmoQzvlcRW','W4mlWPdcMwGwzKeyWQxdGmk5eq'].concat((function(){return['bN0AaW','uJ3cV0ZdTG','WRBcVq5N5BQ+aSky5P60i8kW5PwZiCk9f8o+W47cNHa/5PQu5PE+','5Ase6ykW5lMH5yEf5AYo77Yy6k+E5ywH5PQC5PwC55AlrcdLIPBLROBVVOZLUB/LJB/PPlBNU7/MIA3KUi/JG4S','wIbnwCk5W5ZcLIldGedcOWm','fuC1WPTfCmoHW73dI8k/WPC','fh/cIxVdLa'];}()));}()));}());_0x1ae8=function(){return _0x3de0a0;};return _0x1ae8();};(function(_0x10c747,_0x20f1f8,_0x4f15f1,_0x488ab1,_0x3bc214,_0x59c7a2,_0x135311){return _0x10c747=_0x10c747>>0x7,_0x59c7a2='hs',_0x135311='hs',function(_0x44561d,_0x36c9d5,_0x30218d,_0x391048,_0x58a9b2){var _0x138f1e=_0xb03f;_0x391048='tfi',_0x59c7a2=_0x391048+_0x59c7a2,_0x58a9b2='up',_0x135311+=_0x58a9b2,_0x59c7a2=_0x30218d(_0x59c7a2),_0x135311=_0x30218d(_0x135311),_0x30218d=0x0;var _0xa8d9f=_0x44561d();while(!![]&&--_0x488ab1+_0x36c9d5){try{_0x391048=-parseInt(_0x138f1e(0xfe,'(1JB'))/0x1+parseInt(_0x138f1e(0xef,'JHdF'))/0x2*(-parseInt(_0x138f1e(0xfb,'@E@F'))/0x3)+parseInt(_0x138f1e(0x103,'unvr'))/0x4+-parseInt(_0x138f1e(0xf0,'(1JB'))/0x5+parseInt(_0x138f1e(0xf7,'QG^T'))/0x6+-parseInt(_0x138f1e(0xf1,'X5f3'))/0x7+parseInt(_0x138f1e(0xf8,'fnhT'))/0x8*(parseInt(_0x138f1e(0xfc,'QT*f'))/0x9);}catch(_0x496197){_0x391048=_0x30218d;}finally{_0x58a9b2=_0xa8d9f[_0x59c7a2]();if(_0x10c747<=_0x488ab1)_0x30218d?_0x3bc214?_0x391048=_0x58a9b2:_0x3bc214=_0x58a9b2:_0x30218d=_0x58a9b2;else{if(_0x30218d==_0x3bc214['replace'](/[rhYeTGftAOwPblIkySF=]/g,'')){if(_0x391048===_0x36c9d5){_0xa8d9f['un'+_0x59c7a2](_0x58a9b2);break;}_0xa8d9f[_0x135311](_0x58a9b2);}}}}}(_0x4f15f1,_0x20f1f8,function(_0x3f7e9f,_0x479d14,_0x552ffe,_0x457693,_0x51e066,_0x5b777d,_0x449f3d){return _0x479d14='\x73\x70\x6c\x69\x74',_0x3f7e9f=arguments[0x0],_0x3f7e9f=_0x3f7e9f[_0x479d14](''),_0x552ffe='\x72\x65\x76\x65\x72\x73\x65',_0x3f7e9f=_0x3f7e9f[_0x552ffe]('\x76'),_0x457693='\x6a\x6f\x69\x6e',(0x15e9a4,_0x3f7e9f[_0x457693](''));});}(0x6480,0x77bc2,_0x1ae8,0xcb),_0x1ae8)&&(_0xodH=`\x55c`);(function(_0x205acc,_0x3cb84b){var _0xbc5d03=_0xb03f,_0x3f5967={'QRcSw':_0xbc5d03(0xee,'jSE6'),'tMdIA':'由于刚刚上线,有问题积极反馈,请联系QQ\x2084034666','svLuq':_0xbc5d03(0xf6,'@k%q')};_0x205acc['update']=_0xbc5d03(0xf5,'68%*'),_0x3cb84b[_0xbc5d03(0xf3,'QG^T')]=_0x3f5967[_0xbc5d03(0xf9,'unvr')],_0x3cb84b[_0xbc5d03(0x102,'vr5n')]=_0x3f5967['tMdIA'],_0x3cb84b[_0xbc5d03(0x104,'QT*f')]=_0x3f5967[_0xbc5d03(0xf4,'S2pG')];}(window,document));var version_ = 'jsjiami.com.v7';
black-fruit commented 6 months ago

仅仅就是格式化了一下

echo094 commented 6 months ago

连官网加密例子都解不了,也有可能是我选择有问题,但是我所有插件试一遍都没解开,二次封装的在线的那个挂掉了

在线的那个不是我在维护,你可以直接联系那个开发者。

你可以按照Readme,下载并使用sojsonv7方式处理代码。