解密脚本编写

ast/111.js

-function Tp(t, e) {
-    var n = ip();
-    return (Tp = function (t, e) {
-        return n[t -= 185];
-    })(t, e);
-}
-
-var op = Tp;
-
-function ip() {
-    var t = ["NjR0QllZTQ", "bind", "reload", "NjR0QltQTw", "NjR0QV1dTw", "pxInit", "uid", "pxvid", "length", "72630ywVgnM", "platform", "vid", "trigger", "NjR0QVxRSA", "random", "67349mopHGY", "NjR0Ql9cQg", "306744MLTLsI", "NjR0QV9fTw", "_pxvid", "getTime", "xhrFailure", "527700doOldY", "_pxRootUrl", "_pxmvid", "top", "NjR0QVNQQg", "xhrResponse", "NjR0QVhbSg", "NjR0QV5QSg", "getItem", "_pxVid", "removeItem", "one", "NjR0QllfTg", "_asyncInit", "NjQ", "3060155IbqKSZ", "subscribe", "1026255lNKhiL", "self", "588762aejAEn", "xhrSuccess"];
-    return (ip = function () {
-        return t;
-    })();
-}
-
-!function (t, e) {
-    for (var l = Tp, f = t(); ;) {
+function U(t) {
+    return f(J) === "function" ? J(t) : function (t) {
+      var e;
+      var n;
+      var r;
+      var a;
+      var o = [];
+      var i = 0;
+      var c = t["length"];
       try {
-            if (126902 === parseInt(l(227)) / 1 + -parseInt(l(221)) / 2 + -parseInt(l(186)) / 3 + -parseInt(l(191)) / 4 + -parseInt(l(208)) / 5 + parseInt(l(210)) / 6 + parseInt(l(206)) / 7) {
-                break;
+        if (/[^+/=0-9A-Za-z]/["test"](t) || /=/["test"](t) && (/=[^=]/["test"](t) || /={3}/["test"](t))) {
+          return null;
+        }
+        for (c % 4 > 0 && (c = (t += v["Array"](4 - c % 4 + 1)["join"]("="))["length"]); i < c;) {
+          n = [];
+          for (a = i; i < a + 4;) {
+            n["push"]("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="["indexOf"](t["charAt"](i++)));
+          }
+          r = [((e = (n[0] << 18) + (n[1] << 12) + ((63 & n[2]) << 6) + (63 & n[3])) & 255 << 16) >> 16, 64 === n[2] ? -1 : (65280 & e) >> 8, 64 === n[3] ? -1 : 255 & e];
+          for (a = 0; a < 3; ++a) {
+            (r[a] >= 0 || 0 === a) && o["push"](String["fromCharCode"](r[a]));
           }
-            f["push"](f["shift"]());
+        }
+        return o["join"]("");
       } catch (t) {
-            f["push"](f["shift"]());
+        return null;
+      }
+    }(t);
   }
+
+   var J = function () {
+    try {
+      return atob;
+    } catch (t) {}
+  }();
+function f(t) {
+    f = "function" == typeof Symbol && "symbol" == typeof Symbol["iterator"] ? function (t) {
+      return typeof t;
+    } : function (t) {
+      return t && "function" == typeof Symbol && t["constructor"] === Symbol && t !== Symbol["prototype"] ? "symbol" : typeof t;
+    };
+    return f(t);
   }
-}(ip);
-console.log(op(225))
-console.log(op(225))
\ No newline at end of file
+console.log(U("aXNUcnVzdGVk"))
\ No newline at end of file

ast/decode2.js

@@ -324,6 +324,92 @@ traverse(ast, {
     }
 })
 
+// U
+
+function U(t) {
+    return f(J) === "function" ? J(t) : function (t) {
+      var e;
+      var n;
+      var r;
+      var a;
+      var o = [];
+      var i = 0;
+      var c = t["length"];
+      try {
+        if (/[^+/=0-9A-Za-z]/["test"](t) || /=/["test"](t) && (/=[^=]/["test"](t) || /={3}/["test"](t))) {
+          return null;
+        }
+        for (c % 4 > 0 && (c = (t += v["Array"](4 - c % 4 + 1)["join"]("="))["length"]); i < c;) {
+          n = [];
+          for (a = i; i < a + 4;) {
+            n["push"]("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="["indexOf"](t["charAt"](i++)));
+          }
+          r = [((e = (n[0] << 18) + (n[1] << 12) + ((63 & n[2]) << 6) + (63 & n[3])) & 255 << 16) >> 16, 64 === n[2] ? -1 : (65280 & e) >> 8, 64 === n[3] ? -1 : 255 & e];
+          for (a = 0; a < 3; ++a) {
+            (r[a] >= 0 || 0 === a) && o["push"](String["fromCharCode"](r[a]));
+          }
+        }
+        return o["join"]("");
+      } catch (t) {
+        return null;
+      }
+    }(t);
+  }
+
+   var J = function () {
+    try {
+      return atob;
+    } catch (t) {}
+  }();
+function f(t) {
+    f = "function" == typeof Symbol && "symbol" == typeof Symbol["iterator"] ? function (t) {
+      return typeof t;
+    } : function (t) {
+      return t && "function" == typeof Symbol && t["constructor"] === Symbol && t !== Symbol["prototype"] ? "symbol" : typeof t;
+    };
+    return f(t);
+  }
+traverse(ast, {
+    FunctionDeclaration(path) {
+        let {id, body} = path.node;
+        if (id.name !== 'U') return;
+        let binding = path.scope.getBinding(id.name)
+        console.log(id.name, binding.references)
+        for (const referencePath of binding.referencePaths) {
+            // console.log(generator(referencePath.parent).code, referencePath.parent.type)
+            if (types.isVariableDeclarator(referencePath.parent)) {
+                let idName = referencePath.parent.id.name;
+                getBinding(referencePath.scope, idName, function (p) {
+                    if (types.isCallExpression(p.parent)) {
+                        let arguments = p.parent.arguments;
+                        if (arguments.length !== 1) return
+                        try {
+                            let res = i(arguments[0].value);
+                            if (res === 'PX12571') debugger;
+                            p.parentPath.replaceWith(types.valueToNode((res)))
+                        } catch (e) {
+                            // console.error(generator(p.parent).code)
+
+                        }
+                    }
+
+                })
+
+            } else if (types.isCallExpression(referencePath.parent)) {
+                let arguments = referencePath.parent.arguments;
+                if (arguments.length !== 1) continue
+                try {
+                    let res = U(arguments[0].value);
+                    referencePath.parentPath.replaceWith(types.valueToNode((res)))
+                } catch (e) {
+                    // console.error(generator(p.parent).code)
+
+                }
+            }
+
+        }
+    }
+})
 //end
 console.timeEnd("处理完毕，耗时");
 

ast/main_ok.js

@@ -5786,6 +5786,7 @@ window["_pxAppId"] = "PXVb73hTEg";
     return !(!e || "object" !== f(e)) && (e["do"] || e["ob"]);
   }
   function jh(t, e) {
+    console.log(t)
     if (t) {
       for (var l, h = [], m = 0; m < t[eh(195)]; m++) {
         var d = t[m];

test_url.py

@@ -9,6 +9,7 @@ session.proxies = {
 
 # prox = 'http://user-uni001-region-us-sessid-1111-sesstime-5-keep-true:q39CEBTs5A5YQXor@pr.roxlabs.cn:4600'
 prox = 'http://unfflcc:76cc14-47b8dd-1f8ace-827836-0c740e@usa.rotating.proxyrack.net:9000'
+# prox = 'http://127.0.0.1:7890'
 session.proxies = {
     'http': prox,
     'https': prox,
@@ -34,9 +35,7 @@ headers = {
     "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36"
 }
 
-headers['cookie'] =  '_gcl_au=1.1.2003685075.1699338031; pxcts=238eb403-7d36-11ee-a378-ab37025b0b7a; _pxvid=238ea67a-7d36-11ee-a378-9d364b2d49e5; _px2=eyJ1IjoiZjcxOTQwNzAtN2QzNS0xMWVlLTk0OWYtN2JhNmJmODcwZDllIiwidiI6IjIzOGVhNjdhLTdkMzYtMTFlZS1hMzc4LTlkMzY0YjJkNDllNSIsInQiOjYyMDIzMzg4MDAwNywiaCI6IjkzMTA1NTY3ZjdmNzdkNGIwNDBkY2U0NWFiYWVjMzFmNDIxNTJlYTRhNDU5NWU5YzExMmM4Y2M5NjZmZWRlMTQifQ==; _ga_XXXX=GS1.1.1699338199.1.0.1699338199.0.0.0; _uetsid=253ae0b07d3611ee9a7dbdbc64e1853a; _uetvid=253aff907d3611eebd7aebbb6d317592; _ga=GA1.2.1758561366.1699338200; _gid=GA1.2.1765445025.1699338200; _gat_UA-2678252-1=1; wisepops_visits=%5B%222023-11-07T06%3A23%3A17.104Z%22%5D; _fbp=fb.1.1699338201686.948301047; _pin_unauth=dWlkPU1EWXdPRGc0WVRFdE1HWTBNQzAwWTJOa0xUZzRORFV0TVRFM1pXSmlZalJtTUROag; _tt_enable_cookie=1; _ttp=cp0KTyDaHYsk4PR-QF-OiODmhPb; _up=1.2.1740726236.1699338204; wisepops=%7B%22csd%22%3A1%2C%22popups%22%3A%7B%22429858%22%3A%7B%22dc%22%3A1%2C%22d%22%3A1699338203960%7D%7D%2C%22sub%22%3A0%2C%22ucrn%22%3A56%2C%22cid%22%3A%2278471%22%2C%22v%22%3A4%2C%22bandit%22%3A%7B%22recos%22%3A%7B%7D%7D%7D; wisepops_session=%7B%22arrivalOnSite%22%3A%222023-11-07T06%3A23%3A17.104Z%22%2C%22mtime%22%3A1699338203961%2C%22pageviews%22%3A1%2C%22popups%22%3A%7B%22429858%22%3A0%7D%2C%22bars%22%3A%7B%7D%2C%22sticky%22%3A%7B%7D%2C%22countdowns%22%3A%7B%7D%2C%22src%22%3Anull%2C%22utm%22%3A%7B%7D%2C%22testIp%22%3Anull%7D; _ga_P2WLKWBNNW=GS1.1.1699338199.1.0.1699338205.54.0.0'
-
-
+headers['cookie'] =  '_gcl_au=1.1.2146924139.1699349071; _gid=GA1.2.1600529178.1699349074; _fbp=fb.1.1699349075532.386303519; _tt_enable_cookie=1; _ttp=P8kKbrNobKZ2GVibPD09fxd__BY; _pin_unauth=dWlkPVpEYzFaVEJsTW1NdE5UY3pPQzAwTWpVeUxXSTVOVEF0TkRjMVptTXlOamhsWlRrNA; _up=1.2.724730174.1699349077; wisepops=%7B%22csd%22%3A1%2C%22popups%22%3A%7B%22429858%22%3A%7B%22dc%22%3A1%2C%22d%22%3A1699349078060%7D%7D%2C%22sub%22%3A0%2C%22ucrn%22%3A30%2C%22cid%22%3A%2278471%22%2C%22v%22%3A4%2C%22bandit%22%3A%7B%22recos%22%3A%7B%7D%7D%7D; pxcts=ecee77ca-7d4f-11ee-b00a-fb02dfc227ba; _pxvid=ecee6d06-7d4f-11ee-b00a-034ff0a158cd; ORA_FPC=id=9a05e14f-61e6-446d-93a7-dbd521aef582; WTPERSIST=; wisepops_visits=%5B%222023-11-07T10%3A02%3A56.166Z%22%2C%222023-11-07T10%3A01%3A57.407Z%22%2C%222023-11-07T10%3A00%3A05.868Z%22%2C%222023-11-07T09%3A58%3A45.666Z%22%2C%222023-11-07T09%3A54%3A20.305Z%22%2C%222023-11-07T09%3A41%3A15.316Z%22%2C%222023-11-07T09%3A40%3A10.528Z%22%2C%222023-11-07T09%3A27%3A52.040Z%22%2C%222023-11-07T09%3A27%3A13.951Z%22%2C%222023-11-07T09%3A24%3A31.239Z%22%5D; wisepops_session=%7B%22arrivalOnSite%22%3A%222023-11-07T10%3A02%3A56.166Z%22%2C%22mtime%22%3A1699351382405%2C%22pageviews%22%3A1%2C%22popups%22%3A%7B%22429858%22%3A9%7D%2C%22bars%22%3A%7B%7D%2C%22sticky%22%3A%7B%7D%2C%22countdowns%22%3A%7B%7D%2C%22src%22%3Anull%2C%22utm%22%3A%7B%7D%2C%22testIp%22%3Anull%7D; dtCookie=v_4_srv_-2D75_sn_GCA74QCN3F5TURM3TP5FU5BR94NQ3GNH; rxVisitor=16993514158835CR4HI1L9971DG7GSTEGCRUTR8KKKIK5; dtSa=-; _ga_XXXX=GS1.1.1699349072.1.1.1699351418.0.0.0; _uetsid=7630b8407d4f11ee968005559e690048; _uetvid=7630d5107d4f11ee8ca7578536cb8873; _gat_UA-2678252-1=1; _ga=GA1.1.147873423.1699349072; _px2=eyJ1IjoiZWQyZjAyYjAtN2Q1NC0xMWVlLTllNWEtOGJjODhkMjFmOGVjIiwidiI6IjYzOGJhZGVhLTdjODQtMTFlZS05YjZjLWViMzBjMGQ1YTg5MyIsInQiOjE2OTkzNTE3MjMxMDksImgiOiI5NDk5ZWI5NGYyMmYzOGU0YWRkZWY0NjUxMTc5YzI1OGI2MTVkNjg3MDc1NjM2ZDUzM2FjZmQ0NzczZDNjNGI4In0=; rxvt=1699353225111|1699351415884; _ga_P2WLKWBNNW=GS1.1.1699349072.1.1.1699351425.53.0.0; dtPC=-75$151415881_960h-vFFEKIKVCJPRALEUAPUCFUWCUTCOHATRP-0e0'
 
 # cks = {'_px2': 'eyJ1IjoiOTY0ODdjMzAtNzk4OC0xMWVlLTgxYTktMjUyZjY0MDdjMTYxIiwidiI6Ijk3NmYxYzBlLTc5ODgtMTFlZS1iODYwLTAyNTVmY2JmZTU2MCIsInQiOjYyMDIzMzg4MDAwNCwiaCI6ImViY2U4ZmQ2ZjA3ZGIxNTkxY2YzMmI0MTg3OTcwZWI5NGY5ZDZkN2I2YjY4NGUxZjJiMjE2MGZlZjQxYWI0MzQifQ==', '_pxvid': '976f1c0e-7988-11ee-b860-0255fcbfe560', 'pxcts': '976f338c-7988-11ee-b860-865043e6e7b4'}