Skip to content

P
px3
Commit 0215b893 authored by wang's avatar wang
Browse files
Options

ast反混淆 修复

parent 3e46f185
Expand all Show whitespace changes
Inline Side-by-side
Showing with 18717 additions and 17097 deletions
ast/ast.js 0 → 100644
View file @ 0215b893
This diff is collapsed.
ast/decode.js
View file @ 0215b893
...@@ -6,7 +6,7 @@ const generator = require("@babel/generator").default; ...@@ -6,7 +6,7 @@ const generator = require("@babel/generator").default;
//js混淆代码读取 //js混淆代码读取
process.argv.length > 2 ? encodeFile = process.argv[2] : encodeFile = "./main.js"; process.argv.length > 2 ? encodeFile = process.argv[2] : encodeFile = "./main_ok.js";
process.argv.length > 3 ? decodeFile = process.argv[3] : decodeFile = "./decodeResult.js"; process.argv.length > 3 ? decodeFile = process.argv[3] : decodeFile = "./decodeResult.js";
//将源代码解析为AST //将源代码解析为AST
...@@ -623,47 +623,47 @@ function o(n) { ...@@ -623,47 +623,47 @@ function o(n) {
return u; return u;
} }
traverse(ast, { // traverse(ast, {
VariableDeclaration(path) { // VariableDeclaration(path) {
let {declarations} = path.node; // let {declarations} = path.node;
let scope = path.scope; // let scope = path.scope;
if (declarations.length !== 1) return; // if (declarations.length !== 1) return;
let declaration = declarations[0] // let declaration = declarations[0]
let {id, init} = declaration; // let {id, init} = declaration;
if (!init) return // if (!init) return
if (!types.isIdentifier(init)) return; // if (!types.isIdentifier(init)) return;
if (init.name === 'i') { // if (init.name === 'i') {
let binding = scope.getBinding(id.name); // let binding = scope.getBinding(id.name);
if (id.name === 'xs') { // if (id.name === 'xs') {
debugger // debugger
} // }
if (!binding) return; // if (!binding) return;
console.log(id.name, init.name, binding.references) // console.log(id.name, init.name, binding.references)
//
for (const referencePath of binding.referencePaths) { // for (const referencePath of binding.referencePaths) {
// console.log(referencePath); // // console.log(referencePath);
// console.log(generator(referencePath.parent).code) // // console.log(generator(referencePath.parent).code)
// console.log(referencePath.parentPath.type) // // console.log(referencePath.parentPath.type)
//
if (types.isCallExpression(referencePath.parent)) { // if (types.isCallExpression(referencePath.parent)) {
let {callee, arguments} = referencePath.parent; // let {callee, arguments} = referencePath.parent;
//
if (arguments.length === 1 && types.isStringLiteral(arguments[0])) { // if (arguments.length === 1 && types.isStringLiteral(arguments[0])) {
let res = o(arguments[0].value) // let res = o(arguments[0].value)
// if (id.name === 'xs') { // // if (id.name === 'xs') {
// // //
// console.log(generator(referencePath.parent).code, res) // // console.log(generator(referencePath.parent).code, res)
// } // // }
referencePath.parentPath.replaceWith(types.StringLiteral(res)) // referencePath.parentPath.replaceWith(types.StringLiteral(res))
} // }
} else { // } else {
//
} // }
} // }
} // }
//
} // }
}) // })
//end //end
......
ast/decode2.js
View file @ 0215b893
...@@ -107,13 +107,15 @@ function restoreValue(inName, scope, funcName) { ...@@ -107,13 +107,15 @@ function restoreValue(inName, scope, funcName) {
if (!binding3) return; if (!binding3) return;
console.log(funcName, inName, binding3.references) console.log(funcName, inName, binding3.references)
for (const inReferencePath of binding3.referencePaths) { for (const inReferencePath of binding3.referencePaths) {
console.log(generator(inReferencePath.parent).code, inReferencePath.parent.type) // if (generator(inReferencePath.parent).code == 'n(348)')debugger
if (types.isCallExpression(inReferencePath.parent)) { if (types.isCallExpression(inReferencePath.parent)) {
let {arguments} = inReferencePath.parent let {arguments} = inReferencePath.parent
if (arguments.length !== 1) continue if (arguments.length !== 1) continue
let res = globalFuncs[funcName](arguments[0].value) let res = globalFuncs[funcName](arguments[0].value)
// console.log(funcName,inName,arguments[0].value,res) // console.log(funcName,inName,arguments[0].value,res)
inReferencePath.parentPath.replaceWith(types.valueToNode(res)) inReferencePath.parentPath.replaceWith(types.valueToNode(res))
console.log(generator(inReferencePath.parent).code, inReferencePath.parent.type, res)
} else if (types.isVariableDeclarator(inReferencePath.parent)) { } else if (types.isVariableDeclarator(inReferencePath.parent)) {
// 如果是继续引用 直接再找 // 如果是继续引用 直接再找
let inName2 = inReferencePath.parent.id.name; let inName2 = inReferencePath.parent.id.name;
...@@ -273,7 +275,7 @@ function i(n) { ...@@ -273,7 +275,7 @@ function i(n) {
u = o[n]; u = o[n];
} else { } else {
for (var c = a(n), u = "", f = 0; f < c["length"]; ++f) { for (var c = a(n), u = "", f = 0; f < c["length"]; ++f) {
var s = "EjAWylS"["charCodeAt"](f % 7); var s = "toLgQ3X"["charCodeAt"](f % 7);
u += String["fromCharCode"](s ^ c["charCodeAt"](f)); u += String["fromCharCode"](s ^ c["charCodeAt"](f));
} }
o[n] = u; o[n] = u;
...@@ -370,6 +372,8 @@ function f(t) { ...@@ -370,6 +372,8 @@ function f(t) {
}; };
return f(t); return f(t);
} }
traverse(ast, { traverse(ast, {
FunctionDeclaration(path) { FunctionDeclaration(path) {
let {id, body} = path.node; let {id, body} = path.node;
...@@ -385,9 +389,12 @@ traverse(ast, { ...@@ -385,9 +389,12 @@ traverse(ast, {
let arguments = p.parent.arguments; let arguments = p.parent.arguments;
if (arguments.length !== 1) return if (arguments.length !== 1) return
try { try {
// if (!types.isNumericLiteral(arguments[0]))return;
let res = i(arguments[0].value); let res = i(arguments[0].value);
if(arguments[0].value === 'JDd9VWMFbA')debugger
if (res === 'PX12573') debugger; if (res === 'PX12573') debugger;
p.parentPath.replaceWith(types.valueToNode((res))) p.parentPath.replaceWith(types.valueToNode((res)))
console.log(arguments[0].value, res)
} catch (e) { } catch (e) {
// console.error(generator(p.parent).code) // console.error(generator(p.parent).code)
...@@ -401,7 +408,7 @@ traverse(ast, { ...@@ -401,7 +408,7 @@ traverse(ast, {
if (arguments.length !== 1) continue if (arguments.length !== 1) continue
try { try {
let res = U(arguments[0].value); let res = i(arguments[0].value);
referencePath.parentPath.replaceWith(types.valueToNode((res))) referencePath.parentPath.replaceWith(types.valueToNode((res)))
} catch (e) { } catch (e) {
// console.error(generator(p.parent).code) // console.error(generator(p.parent).code)
...@@ -412,6 +419,8 @@ traverse(ast, { ...@@ -412,6 +419,8 @@ traverse(ast, {
} }
} }
}) })
//end //end
console.timeEnd("处理完毕，耗时"); console.timeEnd("处理完毕，耗时");
......
ast/decodeResult.js
View file @ 0215b893
This diff is collapsed.
ast/decodeResult22.js
View file @ 0215b893
This diff is collapsed.
ast/main.js
View file @ 0215b893
This source diff could not be displayed because it is too large. You can view the blob instead.
ast/main_ok.js
View file @ 0215b893
This diff is collapsed.
src/f91.js
View file @ 0215b893
...@@ -5248,12 +5248,12 @@ class PxBypass { ...@@ -5248,12 +5248,12 @@ class PxBypass {
async function run() { async function run() {
while (true) { while (true) {
try { try {
let res = await axios.get('http://ymx-lcc.unififi.com/header/task/pull/cookieF9?brush_name=test') // let res = await axios.get('http://ymx-lcc.unififi.com/header/task/pull/cookieF9?brush_name=test')
let data = res.data; // let data = res.data;
// //
// let data = { let data = {
// status: 0 status: 0
// } }
console.log(data) console.log(data)
// if r.json()['status'] != 0: // if r.json()['status'] != 0:
// # logger.debug(f'不需要刷值') // # logger.debug(f'不需要刷值')
......
src/package-lock.json
View file @ 0215b893
This diff is collapsed.
src/package.json
View file @ 0215b893
...@@ -22,8 +22,11 @@ ...@@ -22,8 +22,11 @@
"query-string": "^8.1.0" "query-string": "^8.1.0"
}, },
"devDependencies": { "devDependencies": {
"@babel/core": "^7.22.11", "@babel/core": "^7.24.6",
"@babel/types": "^7.22.11" "@babel/traverse": "^7.24.6",
"@babel/types": "^7.24.6",
"@types/babel__generator": "^7.6.8",
"@types/babel__traverse": "^7.20.6"
}, },
"type": "module" "type": "module"
} }
src/run.js
View file @ 0215b893
...@@ -56,9 +56,9 @@ class PxBypass { ...@@ -56,9 +56,9 @@ class PxBypass {
this.prox = `http://user-uni001-region-us-sessid-${randint(1000, 5000)}-sesstime-5-keep-true:q39CEBTs5A5YQXor@pr.roxlabs.cn:4600` this.prox = `http://user-uni001-region-us-sessid-${randint(1000, 5000)}-sesstime-5-keep-true:q39CEBTs5A5YQXor@pr.roxlabs.cn:4600`
// prox = `http://uni00001_custom_zone_US_sid_${randint(67336718, 67336728)}_time_5:q39CEBTs5A@us.foxyip.com:7778` // prox = `http://uni00001_custom_zone_US_sid_${randint(67336718, 67336728)}_time_5:q39CEBTs5A@us.foxyip.com:7778`
// prox = `http://unfflcc:76cc14-47b8dd-1f8ace-827836-0c740e@usa.rotating.proxyrack.net:${randint(10000, 13500)}` // prox = `http://unfflcc:76cc14-47b8dd-1f8ace-827836-0c740e@usa.rotating.proxyrack.net:${randint(10000, 13500)}`
// this.prox = 'http://127.0.0.1:8890' this.prox = 'http://127.0.0.1:8890'
this.tlsUrl = 'http://52.52.23.116/tls/forward' // this.tlsUrl = 'http://52.52.23.116/tls/forward'
// this.tlsUrl = 'http://127.0.0.1:58000/tls/forward' this.tlsUrl = 'http://127.0.0.1:58000/tls/forward'
this.pxHeaders = { this.pxHeaders = {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment