一个专做里番的网站深圳外贸seo
关注它,不迷路。
本文章中所有内容仅供学习交流,不可用于任何商业用途和非法用途,否则后果自负,如有侵权,请联系作者立即删除!
1.混淆代码
下面的这段代码是来自px3验证码核心混淆代码:
function _u() {var n = r(v(980, 817));return (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = n["replace"](/px_width/g, qu))["replace"](/px_cnt_width/g, hu))["replace"](/px_height/g, Iu))["replace"](/px_background/g, su))["replace"](/pxcntId/g, Uc))["replace"](/pxcId/g, Mc))["replace"](/pxdc/g, Bc))["replace"](/pxcd/g, Hc))["replace"](/pxcac/g, Ec))["replace"](/pxifc/g, Rc))["replace"](/pxbbwof/g, Uu))["replace"](/pxba/g, Zc))["replace"](/pxtc/g, jc))["replace"](/px_bar_height/g, wu))["replace"](/pxtId/g, bc))["replace"](/pxbtnwarpper/g, xc))["replace"](/px_border_width/g, tu))["replace"](/px_border_color/g, vu))["replace"](/px_border_radius/g, cu))["replace"](/px_fill_color/g, uu))["replace"](/px_text_color/g, iu))["replace"](/px_text_size/g, fu))["replace"](/px_text_font/g, ou))["replace"](/px_inner_height/g, eu))["replace"](/px_target_color/g, Cu))["replace"](/px_font_weight/g, zu))["replace"](/px_btn_padding/g, Lu))["replace"](/px_pressable_area_padding/g, ku))["replace"](/px_pressable_area_width/g, lu))["replace"](/px_pressable_area_top/g, du))["replace"](/px_text_transform/g, yu))["replace"](/px_checkmark_thickness/g, Du))["replace"](/px_checkmark_height/g, au))["replace"](/px_checkmark_width/g, Au))["replace"](/px_acc_text/g, Wc))["replace"](/px_acc_email_input/g, Tc))["replace"](/px_acc_value_box/g, Yc))["replace"](/px_acc_value_hyphen/g, Nc))["replace"](/px_acc_step_two_continue_btn/g, Jc))["replace"](/px_value_box_container/g, pc))["replace"](/px_acc_img/g, _c))["replace"](/px_acc_tooltip/g, Fc))["replace"](/pxvisuallyhidden/g, ru);}
可以说,非常的恶心,
2.反混淆插件
我们可以写个插件,将其进行还原处理:
const reduceAssign =
{AssignmentExpression(path) {let { parentPath, node } = path;if (!parentPath.isMemberExpression({ object: node })) {return;}let { left, operator, right } = node;if (operator != "=") return;let expressionPath = path.findParent(p => p.isStatement());if (!expressionPath) {return;}expressionPath.insertBefore(types.ExpressionStatement(node));path.replaceWith(left);}
}traverse(ast, reduceAssign);
3.还原效果
经过上面的插件处理后,代码很清晰:
function _u() {var n = r(v(980, 817));n = n["replace"](/px_width/g, qu);n = n["replace"](/px_cnt_width/g, hu);n = n["replace"](/px_height/g, Iu);n = n["replace"](/px_background/g, su);n = n["replace"](/pxcntId/g, Uc);n = n["replace"](/pxcId/g, Mc);n = n["replace"](/pxdc/g, Bc);n = n["replace"](/pxcd/g, Hc);n = n["replace"](/pxcac/g, Ec);n = n["replace"](/pxifc/g, Rc);n = n["replace"](/pxbbwof/g, Uu);n = n["replace"](/pxba/g, Zc);n = n["replace"](/pxtc/g, jc);n = n["replace"](/px_bar_height/g, wu);n = n["replace"](/pxtId/g, bc);n = n["replace"](/pxbtnwarpper/g, xc);n = n["replace"](/px_border_width/g, tu);n = n["replace"](/px_border_color/g, vu);n = n["replace"](/px_border_radius/g, cu);n = n["replace"](/px_fill_color/g, uu);n = n["replace"](/px_text_color/g, iu);n = n["replace"](/px_text_size/g, fu);n = n["replace"](/px_text_font/g, ou);n = n["replace"](/px_inner_height/g, eu);n = n["replace"](/px_target_color/g, Cu);n = n["replace"](/px_font_weight/g, zu);n = n["replace"](/px_btn_padding/g, Lu);n = n["replace"](/px_pressable_area_padding/g, ku);n = n["replace"](/px_pressable_area_width/g, lu);n = n["replace"](/px_pressable_area_top/g, du);n = n["replace"](/px_text_transform/g, yu);n = n["replace"](/px_checkmark_thickness/g, Du);n = n["replace"](/px_checkmark_height/g, au);n = n["replace"](/px_checkmark_width/g, Au);n = n["replace"](/px_acc_text/g, Wc);n = n["replace"](/px_acc_email_input/g, Tc);n = n["replace"](/px_acc_value_box/g, Yc);n = n["replace"](/px_acc_value_hyphen/g, Nc);n = n["replace"](/px_acc_step_two_continue_btn/g, Jc);n = n["replace"](/px_value_box_container/g, pc);n = n["replace"](/px_acc_img/g, _c);n = n["replace"](/px_acc_tooltip/g, Fc);return n["replace"](/pxvisuallyhidden/g, ru);
}
3.思路说明
找到最里边的赋值语句,发现它的父节点是 MemberExpression 类型,因此以这个来进行过滤处理:
需要插入到return语句前面,因此需要获取它的(return)Statement节点;
因为当前节点是赋值语句,因此插入的时候还要先转变成 ExpressionStatement 节点;
插入成功后,节点仅保留left子节点。
4.通用还原插件
上面的代码因为有判断父节点类型,因此只能专用,无法进行通用。
那如何才能写一个通用的嵌套赋值语句还原插件呢?
我帮大家写好了,地址:
https://t.zsxq.com/mx5cg
如果代码看不懂,大家可以在链接下面留言。
如果发现代码有bug,请及时反馈,感谢。
今天的分享就到这里,感谢阅读。
欢迎加入知识星球,学习更多AST和爬虫技巧。