xhs sign算法生成X-s
推荐 原创0x01 前言
幺蛾子的xsh又又更新了，今天给大家分析sign算法生成X-s思路及实现，本文仅供大家学习及研究使用、切勿用于各种非法用途。
0x02 X-s定位
F12 打开开发者工具，刷新页面，点击源代码，找到main.7085c53.js，搜索x-s可定位到：
看代码：
|
1
|
c
=
(a || void
0
!
=
=
window._webmsxyw ? window._webmsxyw : sign)(u, i) || {};
|
一个三元表达式
从代码可知 a 是从 e.configInit 被赋值的，每次进入都为 true；
void 0 !== window._webmsxyw 的含义是：
如果 window._webmsxyw 不等于 undefined，则表达式的结果为真（true），否则为假（false）,所以：void 0 !== window._webmsxyw 用于验证变量 _webmsxyw 是否已在全局环境中以及是否已赋值。
a || void 0 !== window._webmsxyw 两者进行或操作则只要有一方为 true 则走 window._webmsxyw 方法，要想走 sign 方法则需要两者都为 false。
操作，在控制台进行 hook 操作，输入如下：
|
1
2
|
e.configInit
=
false
window._webmsxyw
=
undefined
|
0x03 sign 函数分析：
完成上述操作后调试步入 sign 函数：
函数有两个参数，第一个参数为去除头部的 url，第二个值一直都为 undefined，可不理会。
在 case “6” 中对 X-s 和 X-t 进行了返回：
控制台调试输出得：
分析到这 X-s 生成得整个思路就清晰了，接下来就是扣代码还原了！
0x04 sign 函数还原
1、sign 函数原型
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
|
function sign(e, t) {
var r
=
1
,n
=
82
,o
=
9
,i
=
57
,a
=
122
,s
=
40
,u
=
6
,c
=
46
,l
=
300
,p
=
189
,f
=
8
,d
=
27
,g
=
254
,A
=
103
,h
=
34
,v
=
66
,y
=
91
,m
=
240
,_
=
77
,b
=
59
,w
=
139
,T
=
56
,x
=
71
,E
=
268
,S
=
98
,k
=
82
,I
=
64
,B
=
70
,C
=
45
,O
=
112
,M
=
49
,L
=
30
,D
=
128
,R
=
62
,N
=
13
,j
=
201
,F
=
159
,P
=
196
,W
=
90
,U
=
39
,z
=
126
,H
=
67
,Z
=
28
,V
=
348
,G
=
160
,q
=
39
,Q
=
181
,K
=
47
,Y
=
278
,X
=
162
,J
=
239
,$
=
185
,ee
=
35
,te
=
116
,re
=
223
,ne
=
125
,oe
=
131
,ie
=
13
,ae
=
0
,se
=
43
,ue
=
151
,ce
=
198
,le
=
8
,pe
=
301
,fe
=
180
,de
=
47
,ge
=
210
,Ae
=
509
,he
=
344
,ve
=
353
,ye
=
392
,me
=
44
,_e
=
45
,be
=
161
,we
=
285
,Te
=
192
,xe
=
328
,Ee
=
521
,Se
=
392
,ke
=
522
,Ie
=
339
,Be
=
365
,Ce
=
396
,Oe
=
159
,Me
=
225
,Le
=
473
,De
=
542
,Re
=
396
,Ne
=
166
,je
=
154
,Fe
=
203
,Pe
=
56
,We
=
339
,Ue
=
396
,ze
=
342
,He
=
483
,Ze
=
396
,Ve
=
221
,Ge
=
54
,qe
=
143
,Qe
=
72
,Ke
=
312
,Ye
=
339
,Xe
=
419
,Je
=
396
,$e
=
400
,et
=
102
,tt
=
234
,rt
=
180
,nt
=
85
,ot
=
241
,it
=
319
,at
=
359
,st
=
754
,ut
=
624
,ct
=
416
,lt
=
458
,pt
=
355
,ft
=
327
,dt
=
272
,gt
=
558
,At
=
590
,ht
=
407
,vt
=
292
,yt
=
543
,mt
=
552
,_t
=
309
,bt
=
323
,wt
=
384
,Tt
=
500
,xt
=
341
,Et
=
472
,St
=
547
,kt
=
534
,It
=
141
,Bt
=
293
,Ct
=
659
,Ot
=
594
,Mt
=
517
,Lt
=
551
,Dt
=
594
,Rt
=
281
,Nt
=
341
,jt
=
351
,Ft
=
384
,Pt
=
383
,Wt
=
632
,Ut
=
629
,zt
=
401
,Ht
=
538
,Zt
=
550
,Vt
=
640
,Gt
=
416
,qt
=
1036
,Qt
=
238
,Kt
=
58
,Yt
=
299
,Xt
=
270
,Jt
=
396
,$t
=
1350
,er
=
1447
,tr
=
169
,rr
=
340
,nr
=
811
,
or
=
625
,ir
=
603
,ar
=
1
,sr
=
13
,ur
=
145
,cr
=
69
,lr
=
224
,pr
=
495
,fr
=
557
,dr
=
399
,gr
=
391
,Ar
=
537
,hr
=
278
,vr
=
644
,yr
=
601
,mr
=
1348
, _r
=
{
oGIPg: function(e, t) {
return
e !
=
=
t
},
ofNul: Tr(
-
158
,
-
54
)
+
"ed"
,
YUgHM: Tr(r,
8
),
fdXbs: function(e, t) {
return
e < t
},
LmgEU: function(e, t) {
return
e > t
},
FjgPK: function(e, t) {
return
e >> t
},
rVTGu: function(e, t) {
return
e | t
},
pBIon: function(e, t) {
return
e | t
},
sYpSd: Tr(n, o)
+
Tr(i, a),
vnWPy: Tr(
-
s,
-
u)
+
Tr(
58
,
29
)
+
Tr(
-
c,
-
55
),
ckmlP: function(e, t) {
return
e << t
},
njKvQ: function(e, t) {
return
e & t
},
ZyeCw: function(e, t) {
return
e
+
t
},
ijPny: function(e, t) {
return
e(t)
},
bHRnl: Tr(
-
l,
-
p)
+
Tr(
-
f, d)
+
Tr(
-
g,
-
A)
+
Tr(h,
-
v)
+
Tr(
-
y,
-
60
)
+
Tr(
-
m,
-
144
)
+
Tr(_,
76
)
+
Tr(
-
b,
88
)
+
Tr(w,
112
)
+
"m3"
,
kEjFq: Tr(
139
, T),
PmRiF: function(e, t) {
return
e(t)
},
AgtoL: function(e, t) {
return
e
=
=
=
t
},
pBQVD: Tr(
-
80
,
-
x)
+
Tr(E, S)
+
"]"
,
horPD: Tr(
-
146
,
-
x)
+
Tr(k, I)
},
br
=
(Tr(
-
x,
-
14
)
+
Tr(B, C)
+
Tr(O,
-
M))[Tr(
27
,
-
42
)](
"|"
),
wr
=
0
;
function Tr(e, t) {
return
a0_0x5bf4a2(t
-
-
mr, e)
}
for
(;;) {
switch (br[wr
+
+
]) {
case
"0"
:
_r[Tr(L,
-
D)]((
0
, esm_typeof.Z)(Br), _r[Tr(
-
R,
-
N)]) && Br && Br[Tr(
-
j,
-
159
)
+
"or"
] && Br[Tr(
-
189
,
-
F)
+
"or"
][Tr(P, W)
+
"nt"
] && Br[Tr(U,
-
z)] && (Sr
=
_r[Tr(H, Z)]);
continue
;
case
"1"
:
var xr
=
{
pAnrE: function(e, t) {
var r, n;
return
_r[(r
=
vr, n
=
yr, Tr(n, r
-
667
))](e, t)
},
GEFbL: function(e, t) {
return
_r[(r
=
-
gr, n
=
-
Ar, Tr(n, r
-
-
hr))](e, t);
var r, n
}, HInoH: function(e, t) {
return
e | t
},
Iqqni: function(e, t) {
return
_r[(r
=
pr, n
=
fr, Tr(r, n
-
dr))](e, t);
var r, n
}, bVwGo: function(e, t) {
return
e & t
},
rNCWZ: function(e, t) {
return
e | t
},
hKqxo: function(e, t) {
return
e >> t
},
wsVCK: function(e, t) {
var r, n;
return
_r[(r
=
lr, n
=
242
, Tr(r, n
-
274
))](e, t)
},
FFGBs: function(e, t) {
return
e >> t
},
nUgYR: function(e, t) {
return
_r[(r
=
244
, n
=
cr, Tr(n, r
-
266
))](e, t);
var r, n
}, UwDmp: _r[Tr(
-
V,
-
G)],
uyiOy: _r[Tr(q,
12
)],
pUeGA: function(e, t) {
return
_r[(r
=
ar, n
=
sr, Tr(r, n
-
-
ur))](e, t);
var r, n
}, FqzNC: function(e, t) {
return
_r[(r
=
-
nr, n
=
-
or
, Tr(r, n
-
-
ir))](e, t);
var r, n
}, QWgdM: function(e, t) {
return
_r[(r
=
277
, n
=
rr, Tr(n, r
-
316
))](e, t);
var r, n
}, JfMBq: function(e, t) {
var r, n;
return
_r[(r
=
183
, n
=
tr, Tr(n, r
-
377
))](e, t)
},
gJOmQ: function(e, t) {
var r, n;
return
_r[(r
=
$t, n
=
er, Tr(n, r
-
1192
))](e, t)
},
AyuWg: function(e, t) {
return
_r[(r
=
-
349
, n
=
-
Jt, Tr(r, n
-
-
532
))](e, t);
var r, n
}, rGcjO: function(e, t) {
return
e
+
t
},
ZuXog: function(e, t) {
return
_r[(r
=
Yt, n
=
Xt, Tr(r, n
-
134
))](e, t);
var r, n
}, rbzrd: function(e, t) {
return
_r[(r
=
-
Qt, n
=
-
Kt, Tr(r, n
-
-
6
))](e, t);
var r, n
}, ExLNh: function(e, t) {
return
e & t
},
CSkFe: function(e, t) {
var r, n;
return
_r[(r
=
1002
, n
=
qt, Tr(n, r
-
844
))](e, t)
}
};
continue
;
case
"2"
:
var Er
=
_r[Tr(Q, K)];
continue
;
case
"3"
:
var Sr
=
_r[Tr(
111
,
23
)];
continue
;
case
"4"
:
var kr
=
function(e) {
function t(e, t) {
return
Tr(e, t
-
-
Gt)
}
for
(var r
=
xr[t(
-
344
,
-
it)][t(
-
298
,
-
458
)](
"|"
), n
=
0
;) {
switch (r[n
+
+
]) {
case
"0"
:
var o
=
0
;
continue
;
case
"1"
:
return
g;
case
"2"
:
var i, a, s, u, c, l, p;
continue
;
case
"3"
:
for
(; xr[t(
-
at,
-
277
)](o, e[t(
-
st,
-
ut)]);)
for
(var f
=
xr[t(
-
ct,
-
309
)][t(
-
448
,
-
lt)](
"|"
), d
=
0
;) {
switch (f[d
+
+
]) {
case
"0"
:
p
=
xr[t(
-
pt,
-
ft)](s,
63
);
continue
;
case
"1"
:
u
=
xr[t(
-
dt,
-
dt)](i,
2
);
continue
;
case
"2"
:
c
=
xr[t(
-
gt,
-
At)](xr[t(
-
ht,
-
vt)](xr[t(
-
yt,
-
mt)](i,
3
),
4
), xr[t(
-
_t,
-
bt)](a,
4
));
continue
;
case
"3"
:
i
=
e[t(
-
256
,
-
wt)
+
t(
-
Tt,
-
xt)](o
+
+
);
continue
;
case
"4"
:
g
=
xr[t(
-
Et,
-
474
)](xr[t(
-
St,
-
kt)](xr[t(
-
It,
-
Bt)](g
+
Er[t(
-
Ct,
-
Ot)](u), Er[t(
-
Mt,
-
594
)](c)), Er[t(
-
548
,
-
594
)](l)), Er[t(
-
Lt,
-
Dt)](p));
continue
;
case
"5"
:
s
=
e[t(
-
472
,
-
wt)
+
t(
-
Rt,
-
Nt)](o
+
+
);
continue
;
case
"6"
:
a
=
e[t(
-
jt,
-
Ft)
+
t(
-
Pt,
-
Nt)](o
+
+
);
continue
;
case
"7"
:
isNaN(a) ? l
=
p
=
64
: xr[t(
-
Wt,
-
Ut)](isNaN, s) && (p
=
64
);
continue
;
case
"8"
:
l
=
xr[t(
-
161
,
-
vt)](xr[t(
-
497
,
-
zt)](a,
15
),
2
) | xr[t(
-
Ht,
-
Zt)](s,
6
);
continue
}
break
}
continue
;
case
"4"
:
e
=
xr[t(
-
Vt,
-
629
)](Cr, e);
continue
;
case
"5"
:
var g
=
"";
continue
}
break
}
};
continue
;
case
"5"
:
var Ir
=
(new Date)[Tr(
-
Y,
-
X)]();
continue
;
case
"6"
:
return
{
"X-s"
:
_r[Tr(
99
,
-
52
)](kr, _r[Tr(
-
J,
-
$)](MD5, [Ir, Sr, e, Or ? JSON[Tr(
-
ee, te)
+
"fy"
](t) : "
"][Tr(re, ne)]("
"))),
"X-t"
: Ir
};
case
"7"
:
var Br
=
(
"undefined"
=
=
typeof window ?
"undefined"
: (
0
, esm_typeof.Z)(window))
=
=
=
_r[Tr(oe,
-
ie)] ? __webpack_require__.g: window;
continue
;
case
"8"
:
var Cr
=
function(e) {
function t(e, t) {
return
Tr(e, t
-
253
)
}
e
=
e[t(Ae, he)](
/
\r\n
/
g,
"\n"
);
for
(var r
=
"",
n
=
0
; xr[t(ve, ye)](n, e[t(
-
me, _e)]); n
+
+
) {
var o
=
e[t(be, we)
+
t(Te, xe)](n);
xr[t(Ee, Se)](o,
128
) ? r
+
=
String[t(ke, Ie)
+
t(Be, Ce)](o) : xr[t(Oe, Me)](o,
127
) && xr[t(Le, Se)](o,
2048
) ? (r
+
=
String[t(
226
, Ie)
+
t(De, Re)](xr[t(Ne, je)](xr[t(Fe, Pe)](o,
6
),
192
)), r
+
=
String[t(
208
, We)
+
t(
268
, Ue)](
128
| xr[t(
511
, ze)](o,
63
))) : (r
+
=
String[t(
292
,
339
)
+
t(He, Ze)](xr[t(Ve, Ge)](xr[t(qe, Qe)](o,
12
),
224
)), r
+
=
String[t(Ke, Ye)
+
t(Xe, Je)](xr[t(
496
, $e)](
63
& xr[t(et, tt)](o,
6
),
128
)), r
+
=
String[t(
332
, Ye)
+
t(Je, Je)](xr[t(rt, nt)](xr[t(ot,
342
)](o,
63
),
128
)))
}
return
r
};
continue
;
case
"9"
:
var Or
=
_r[Tr(
-
63
, ae)](
Object
[Tr(
170
, se)
+
"pe"
][Tr(
-
ue,
-
ce)
+
"g"
][Tr(le,
-
180
)](t), _r[Tr(
-
99
,
3
)]) ||
Object
[Tr(
-
ne, se)
+
"pe"
][Tr(
-
10
,
-
198
)
+
"g"
][Tr(
-
pe,
-
fe)](t)
=
=
=
_r[Tr(
-
de,
-
ge)];
continue
}
break
}
}
|
2、扣代码后给参数执行
|
1
2
3
|
var e
=
'/api/sns/web/v2/comment/page?note_id=64704e5d00000000130003c5&cursor='
var t
=
''
console.log(sign(e, t));
|
3、补环境
直接执行报错：ReferenceError: a0_0x5bf4a2 is not defined
一个函数，在源代码中查找a0_0x5bf4a2，可得：
|
1
2
3
|
function a0_0x5bf4a2(e, t) {
return
a0_0x4e04(e
-
975
, t)
}
|
补上执行，报错ReferenceError: a0_0x4e04 is not defined
继续找a0_0x4e04函数，得：
|
1
2
3
4
5
6
7
|
function a0_0x4e04(e, t) {
var r
=
a0_0x2216();
return
(a0_0x4e04
=
function(e, t) {
return
r[e
-
=
157
]
}
)(e, t)
}
|
|
1
2
3
4
5
6
7
|
function a0_0x2216() {
var e
=
[
" Array]"
,
"BKlTG"
,
"bKzCF"
,
"QEjqG"
,
"MIBDd"
,
"lTzWN"
,
"456789+"
,
"rable"
,
"TWqcu"
,
"AbucO"
,
"KVFmX"
,
"eAt"
,
"yRnhISG"
,
"_ff"
,
"VTbZO"
,
"Ebvdl"
,
"xbNCz"
,
"XZJYH"
,
"aDKZQ"
,
"PImcW"
,
"qbsfA"
,
"XELvr"
,
"fromCha"
,
"hhpmz"
,
"KblCWi+"
,
"bVwGo"
,
"userAge"
,
"replace"
,
"x3VT16I"
,
"gJOmQ"
,
"xkufh"
,
"1423755YoONuB"
,
"OcKoU"
,
"UwDmp"
,
" Object"
,
"tRIaN"
,
"utf8"
,
"fOtaQ"
,
"String"
,
"pPTeX"
,
"FtpSe"
,
"HLigX"
,
"ivzJu"
,
"uyiOy"
,
"BWpCW"
,
"ULPBW"
,
"_digest"
,
"kptIO"
,
"LpfE8xz"
,
"ayXCW"
,
"readFlo"
,
"FsSjC"
,
"stringi"
,
"Zymkz"
,
"bin"
,
"QCmLq"
,
"URzpu"
,
"bJXmh"
,
"|3|1"
,
"ZuXog"
,
"QWgdM"
,
"join"
,
"dlvDl"
,
"push"
,
"_blocks"
,
"XyCSd"
,
"VvVIb"
,
"LjQYx"
,
"ajtxP"
,
"yWXJR"
,
"zCWHZ"
,
"rotl"
,
"ZyeCw"
,
"wordsTo"
,
"jnBeR"
,
"pAnrE"
,
"NdIIp"
,
"8lYxANC"
,
"XGsUl"
,
"rCode"
,
"pUeGA"
,
"zGNlp"
,
"cdefghi"
,
"wsVCK"
,
"IPplF"
,
"kUMTd"
,
"JHZDn"
,
"tkLYM"
,
"rXWku"
,
"wOKuD"
,
"701812dHtSeL"
,
"RhoIX"
,
"GfZNv"
,
"Qdnej"
,
"FjgPK"
,
"OPQRSTU"
,
"asStrin"
,
"6421023qDUTlG"
,
"GwcGK"
,
"rbzrd"
,
"ZmserbB"
,
"IuNbm"
,
"horPD"
,
"dlEti"
,
"length"
,
"defineP"
,
"fMQeE"
,
"tucXA"
,
"isBuffe"
,
"Csdwa"
,
"GMnXY"
,
"wXAzc"
,
"hECvuRX"
,
"rNCWZ"
,
"toStrin"
,
"Iqqni"
,
"gMCOT"
,
"mPqBk"
,
"njKvQ"
,
"iVrVM"
,
"BZDgY"
,
"aLEDD"
,
"zqlLt"
,
"A4NjFqY"
,
"qrstuvw"
,
"nlloK"
,
"XoRcW"
,
"PmRiF"
,
"gNPmw"
,
"qfKTl"
,
"size"
,
"hKqxo"
,
"call"
,
"ule"
,
"charAt"
,
"CVGZf"
,
"LApMt"
,
"GIOVd"
,
"FqzNC"
,
"BlYYJ"
,
"iveAI"
,
"0DSfdik"
,
"floor"
,
"AFspt"
,
"nUgYR"
,
"vwKJd"
,
"vvUDs"
,
"functio"
,
"QHyuq"
,
"MVAwP"
,
"getTime"
,
"MMCMk"
,
"sYpSd"
,
"navigat"
,
"lUAFM97"
,
"14166300GRKScn"
,
"_gg"
,
"PTckW"
,
"9828858gDvJWH"
,
"zQHLA"
,
"onGsF"
,
"jYLZN"
,
"LfzDW"
,
"fXyCY"
,
"pMnQF"
,
"KXVXf"
,
"tYPHy"
,
"xjGie"
,
"Bvk6/7="
,
"default"
,
"q42KWYj"
,
"uLaUm"
,
"qQEvx"
,
"WhtXq"
,
"bytesTo"
,
"pow"
,
"JfMBq"
,
"asBytes"
,
"CSkFe"
,
"oVSCj"
,
"zxlnG"
,
"YfWLP"
,
"isArray"
,
"vKozY"
,
"oGIPg"
,
"_hh"
,
"alert"
,
"WGYNO"
,
"qKVdC"
,
"XIyHu"
,
"35gJWoke"
,
"qHhcm"
,
"JAJSl"
,
"SiQnD"
,
"rGcjO"
,
"iAdEk"
,
"hasOwnP"
,
"jkBcl"
,
"qRUYU"
,
"LmgEU"
,
"indexOf"
,
"jklmnop"
,
"oBytes"
,
"pWkTP"
,
"mzbVd"
,
"ZConF"
,
"SybVD"
,
"giCxm"
,
"DKJgG"
,
"0XTdDgM"
,
"ZKOQP"
,
"jlpEd"
,
"atLE"
,
"HInoH"
,
"xvACd"
,
"UUpXV"
,
"xZKow"
,
"iiDsP"
,
"zDWFE"
,
"WDznH"
,
"1510EVYxDf"
,
"encodin"
,
"_isBuff"
,
"ewsiq"
,
"nypTe"
,
"JGiLO"
,
"JPvwn"
,
"dLkrl"
,
"GVKTc"
,
"maGnI"
,
" argume"
,
"QZCeF"
,
"LpEPK"
,
"ndbxf"
,
"HIJKLMN"
,
"zpXoh"
,
"yzFgN"
,
"LQzcw"
,
"mVqpt"
,
"EsNua"
,
"fMLzk"
,
"[object"
,
"JzsgP"
,
"exports"
,
"sUVZX"
,
"random"
,
"a2r1ZQo"
,
"iXIuP"
,
"JXCdt"
,
"OgZjF"
,
"ZyrdF"
,
"ZPSxl"
,
"cVte9UJ"
,
"gsXZX"
,
"AyuWg"
,
"jpgNW"
,
"fhBCN"
,
"7|4"
,
"undefin"
,
"iEbrz"
,
"ijPny"
,
"vQLRG"
,
"wOcza/L"
,
"0|9|6"
,
"roANW"
,
"gHrQO"
,
"lImSF"
,
"__esMod"
,
"xjwrk"
,
"yrsxt"
,
"split"
,
"ble"
,
"wrQPO"
,
"ckmlP"
,
"stringT"
,
"IIbJk"
,
"wQkPs"
,
"substr"
,
"Hex"
,
"FcvYN"
,
"rVTGu"
,
"CJhpg"
,
"GPKgf"
,
"VWXYZab"
,
"GEFbL"
,
"lnMXU"
,
"ytRAA"
,
"sscMP"
,
"YYwTi"
,
"fdXbs"
,
"pBIon"
,
"HahEp"
,
"epseL"
,
"FFGBs"
,
"dGTfa"
,
"oHQtNP+"
,
"nt "
,
"|2|5|0|"
,
"1|8|2|4"
,
"ofNul"
,
"roperty"
,
"ctor"
,
"configu"
,
"FUmrx"
,
"Words"
,
"Bytes"
,
"3|6|5|1"
,
"zNDxq"
,
"MziVH"
,
"Illegal"
,
"PjFzZ"
,
"wFbRI"
,
"AgtoL"
,
"ulmju"
,
"eMMmS"
,
"pBQVD"
,
"OXCLS"
,
"pZJmk"
,
"JLuYf"
,
"pngG8yJ"
,
"test"
,
"5|2|0|4"
,
"endian"
,
"binary"
,
"vnWPy"
,
"9082503wDHZUe"
,
"fpNFL"
,
"ExLNh"
,
"BmKDO"
,
"slice"
,
"Izlkq"
,
"3|6|4|7"
,
"wDmFl"
,
"WzyGE"
,
"lAwpi"
,
"kEjFq"
,
"WMgoB"
,
"enumera"
,
"JiFfc"
,
"u5wPHsO"
,
"YUgHM"
,
"|2|8|0|"
,
"ynYJU"
,
"dKjoH"
,
"charCod"
,
"ABCDEFG"
,
"kmWtQ"
,
"AxAhe"
,
"_ii"
,
"fpHmu"
,
"FlrTz"
,
"get"
,
"gRzQm"
,
"wYjQX"
,
"npUFn"
,
"prototy"
,
"766Zmjnab"
,
"|3|5|7|"
,
"hPODe"
,
"bHRnl"
,
"string"
,
"vsoyz"
,
"JqpwC"
,
"teXIb"
,
"RiLUl"
,
"rTLAS"
,
"ize"
,
"constru"
,
"iamspam"
,
"nJCOz"
,
"zNReR"
,
"guKIL"
,
"JOWCA"
,
"xyz0123"
,
"nSULH"
,
"oFlMR"
];
return
(a0_0x2216
=
function() {
return
e
}
)()
}
|
补上执行，报错：TypeError: (Tr(...) + Tr(...) + Tr(...))[Tr(...)] is not a function
一个大坑，坑在a0_0x2216函数中的e数组，静态中可以看到数组e和扣出来的代码并没有区别：
在sign函数中的Tr函数下断，逐步跟进得：
在函数a0_0x4e04会得到a0_0x2216返回得数组，控制台输出得：
可见和扣下来得数据完全不一样，替换后执行代码，
报错：ReferenceError: webpack_require is not defined
一个window对象，补上：
window = {}
执行，在
|
1
|
var Br
=
(
"undefined"
=
=
typeof window ?
"undefined"
: (
0
, esm_typeof.Z)(window))
=
=
=
_r[Tr(oe,
-
ie)] ? __webpack_require__.g : window
|
报错：ReferenceError: esm_typeof is not defined
源代码调试(0, esm_typeof.Z)(window) 是一个'object'，直接写死，改写代码：
|
1
|
var Br
=
(
"undefined"
=
=
typeof window ?
"undefined"
:
'object'
)
=
=
=
_r[Tr(oe,
-
ie)] ? __webpack_require__.g : window
|
继续执行，在
|
1
2
3
4
|
case
"0"
:
_r[Tr(L,
-
D)]((
0
,
esm_typeof.Z)(Br), _r[Tr(
-
R,
-
N)]) && Br && Br[Tr(
-
j,
-
159
)
+
"or"
] && Br[Tr(
-
189
,
-
F)
+
"or"
][Tr(P, W)
+
"nt"
] && Br[Tr(U,
-
z)] && (Sr
=
_r[Tr(H, Z)]);
continue
;
|
报错：ReferenceError: esm_typeof is not defined
一样的手法，在源代码调试(0,esm_typeof.Z)(Br) 是一个'object'，直接写死，改写代码：
|
1
2
3
|
case
"0"
:
_r[Tr(L,
-
D)](
'object'
, _r[Tr(
-
R,
-
N)]) && Br && Br[Tr(
-
j,
-
159
)
+
"or"
] && Br[Tr(
-
189
,
-
F)
+
"or"
][Tr(P, W)
+
"nt"
] && Br[Tr(U,
-
z)] && (Sr
=
_r[Tr(H, Z)]);
continue
;
|
执行，在
|
1
|
"X-s"
: _r[Tr(
99
,
-
52
)](kr, _r[Tr(
-
J,
-
$)](MD5, [Ir, Sr, e, Or ? JSON[Tr(
-
ee, te)
+
"fy"
](t) : "
"][Tr(re, ne)]("
"))),
|
报错：ReferenceError: MD5 is not defined
缺少MD5加密库，引入：
const CryptoJS = require('crypto-js')
后改写代码
|
1
|
"X-s"
: _r[Tr(
99
,
-
52
)](kr, _r[Tr(
-
J,
-
$)](CryptoJS.MD5, [Ir, Sr, e, Or ? JSON[Tr(
-
ee, te)
+
"fy"
](t) : "
"][Tr(re, ne)]("
")).toString()),
|
执行得到结果：
{
'X-s': 'ZjqBZgFCOl5+1gZvOlw6OjTi12a6OB9pZYdBsi5K0gv3',
'X-t': 1686727390248
}
给定时间戳后X-s应该和浏览器返回值相同，测试：
时间戳是在：
|
1
2
3
|
case
"5"
:
var Ir
=
(new Date)[Tr(
-
Y,
-
X)]();
continue
;
|
测试数据：
给定Ir后执行代码，得到结果：
{
'X-s': 'Zj9bsYFbZgwJ0YTpZgZvsBVvsi5LOBM+OisKO2avZYM3',
'X-t': 1686727067729
}
应得结果：
OBkUZYqBO2MiOg5KsBvC1laU0gsWsBTGsjTbOiaUsl13
不一致，继续分析！
最终分析得：
|
1
|
"X-s"
: _r[Tr(
99
,
-
52
)](kr, _r[Tr(
-
J,
-
$)](CryptoJS.MD5, [Ir, Sr, e, Or ? JSON[Tr(
-
ee, te)
+
"fy"
](t) : "
"][Tr(re, ne)]("
")).toString()),
|
在X-s生成中Sr在浏览器环境一直为test，而在本地调试时Sr一直为iamspam：
更改后执行：
{
'X-s': 'OBkUZYqBO2MiOg5KsBvC1laU0gsWsBTGsjTbOiaUsl13',
'X-t': 1686727067729
}
多次更改时间戳校验结果无误。
0x05 js还原代码：
测试时间戳有在代码中注释，可自行测试。
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
|
const CryptoJS
=
require(
'crypto-js'
)
window
=
{}
function a0_0x2216() {
var e
=
[
"asStrin"
,
"6421023qDUTlG"
,
"GwcGK"
,
"rbzrd"
,
"ZmserbB"
,
"IuNbm"
,
"horPD"
,
"dlEti"
,
"length"
,
"defineP"
,
"fMQeE"
,
"tucXA"
,
"isBuffe"
,
"Csdwa"
,
"GMnXY"
,
"wXAzc"
,
"hECvuRX"
,
"rNCWZ"
,
"toStrin"
,
"Iqqni"
,
"gMCOT"
,
"mPqBk"
,
"njKvQ"
,
"iVrVM"
,
"BZDgY"
,
"aLEDD"
,
"zqlLt"
,
"A4NjFqY"
,
"qrstuvw"
,
"nlloK"
,
"XoRcW"
,
"PmRiF"
,
"gNPmw"
,
"qfKTl"
,
"size"
,
"hKqxo"
,
"call"
,
"ule"
,
"charAt"
,
"CVGZf"
,
"LApMt"
,
"GIOVd"
,
"FqzNC"
,
"BlYYJ"
,
"iveAI"
,
"0DSfdik"
,
"floor"
,
"AFspt"
,
"nUgYR"
,
"vwKJd"
,
"vvUDs"
,
"functio"
,
"QHyuq"
,
"MVAwP"
,
"getTime"
,
"MMCMk"
,
"sYpSd"
,
"navigat"
,
"lUAFM97"
,
"14166300GRKScn"
,
"_gg"
,
"PTckW"
,
"9828858gDvJWH"
,
"zQHLA"
,
"onGsF"
,
"jYLZN"
,
"LfzDW"
,
"fXyCY"
,
"pMnQF"
,
"KXVXf"
,
"tYPHy"
,
"xjGie"
,
"Bvk6/7="
,
"default"
,
"q42KWYj"
,
"uLaUm"
,
"qQEvx"
,
"WhtXq"
,
"bytesTo"
,
"pow"
,
"JfMBq"
,
"asBytes"
,
"CSkFe"
,
"oVSCj"
,
"zxlnG"
,
"YfWLP"
,
"isArray"
,
"vKozY"
,
"oGIPg"
,
"_hh"
,
"alert"
,
"WGYNO"
,
"qKVdC"
,
"XIyHu"
,
"35gJWoke"
,
"qHhcm"
,
"JAJSl"
,
"SiQnD"
,
"rGcjO"
,
"iAdEk"
,
"hasOwnP"
,
"jkBcl"
,
"qRUYU"
,
"LmgEU"
,
"indexOf"
,
"jklmnop"
,
"oBytes"
,
"pWkTP"
,
"mzbVd"
,
"ZConF"
,
"SybVD"
,
"giCxm"
,
"DKJgG"
,
"0XTdDgM"
,
"ZKOQP"
,
"jlpEd"
,
"atLE"
,
"HInoH"
,
"xvACd"
,
"UUpXV"
,
"xZKow"
,
"iiDsP"
,
"zDWFE"
,
"WDznH"
,
"1510EVYxDf"
,
"encodin"
,
"_isBuff"
,
"ewsiq"
,
"nypTe"
,
"JGiLO"
,
"JPvwn"
,
"dLkrl"
,
"GVKTc"
,
"maGnI"
,
" argume"
,
"QZCeF"
,
"LpEPK"
,
"ndbxf"
,
"HIJKLMN"
,
"zpXoh"
,
"yzFgN"
,
"LQzcw"
,
"mVqpt"
,
"EsNua"
,
"fMLzk"
,
"[object"
,
"JzsgP"
,
"exports"
,
"sUVZX"
,
"random"
,
"a2r1ZQo"
,
"iXIuP"
,
"JXCdt"
,
"OgZjF"
,
"ZyrdF"
,
"ZPSxl"
,
"cVte9UJ"
,
"gsXZX"
,
"AyuWg"
,
"jpgNW"
,
"fhBCN"
,
"7|4"
,
"undefin"
,
"iEbrz"
,
"ijPny"
,
"vQLRG"
,
"wOcza/L"
,
"0|9|6"
,
"roANW"
,
"gHrQO"
,
"lImSF"
,
"__esMod"
,
"xjwrk"
,
"yrsxt"
,
"split"
,
"ble"
,
"wrQPO"
,
"ckmlP"
,
"stringT"
,
"IIbJk"
,
"wQkPs"
,
"substr"
,
"Hex"
,
"FcvYN"
,
"rVTGu"
,
"CJhpg"
,
"GPKgf"
,
"VWXYZab"
,
"GEFbL"
,
"lnMXU"
,
"ytRAA"
,
"sscMP"
,
"YYwTi"
,
"fdXbs"
,
"pBIon"
,
"HahEp"
,
"epseL"
,
"FFGBs"
,
"dGTfa"
,
"oHQtNP+"
,
"nt "
,
"|2|5|0|"
,
"1|8|2|4"
,
"ofNul"
,
"roperty"
,
"ctor"
,
"configu"
,
"FUmrx"
,
"Words"
,
"Bytes"
,
"3|6|5|1"
,
"zNDxq"
,
"MziVH"
,
"Illegal"
,
"PjFzZ"
,
"wFbRI"
,
"AgtoL"
,
"ulmju"
,
"eMMmS"
,
"pBQVD"
,
"OXCLS"
,
"pZJmk"
,
"JLuYf"
,
"pngG8yJ"
,
"test"
,
"5|2|0|4"
,
"endian"
,
"binary"
,
"vnWPy"
,
"9082503wDHZUe"
,
"fpNFL"
,
"ExLNh"
,
"BmKDO"
,
"slice"
,
"Izlkq"
,
"3|6|4|7"
,
"wDmFl"
,
"WzyGE"
,
"lAwpi"
,
"kEjFq"
,
"WMgoB"
,
"enumera"
,
"JiFfc"
,
"u5wPHsO"
,
"YUgHM"
,
"|2|8|0|"
,
"ynYJU"
,
"dKjoH"
,
"charCod"
,
"ABCDEFG"
,
"kmWtQ"
,
"AxAhe"
,
"_ii"
,
"fpHmu"
,
"FlrTz"
,
"get"
,
"gRzQm"
,
"wYjQX"
,
"npUFn"
,
"prototy"
,
"766Zmjnab"
,
"|3|5|7|"
,
"hPODe"
,
"bHRnl"
,
"string"
,
"vsoyz"
,
"JqpwC"
,
"teXIb"
,
"RiLUl"
,
"rTLAS"
,
"ize"
,
"constru"
,
"iamspam"
,
"nJCOz"
,
"zNReR"
,
"guKIL"
,
"JOWCA"
,
"xyz0123"
,
"nSULH"
,
"oFlMR"
,
" Array]"
,
"BKlTG"
,
"bKzCF"
,
"QEjqG"
,
"MIBDd"
,
"lTzWN"
,
"456789+"
,
"rable"
,
"TWqcu"
,
"AbucO"
,
"KVFmX"
,
"eAt"
,
"yRnhISG"
,
"_ff"
,
"VTbZO"
,
"Ebvdl"
,
"xbNCz"
,
"XZJYH"
,
"aDKZQ"
,
"PImcW"
,
"qbsfA"
,
"XELvr"
,
"fromCha"
,
"hhpmz"
,
"KblCWi+"
,
"bVwGo"
,
"userAge"
,
"replace"
,
"x3VT16I"
,
"gJOmQ"
,
"xkufh"
,
"1423755YoONuB"
,
"OcKoU"
,
"UwDmp"
,
" Object"
,
"tRIaN"
,
"utf8"
,
"fOtaQ"
,
"String"
,
"pPTeX"
,
"FtpSe"
,
"HLigX"
,
"ivzJu"
,
"uyiOy"
,
"BWpCW"
,
"ULPBW"
,
"_digest"
,
"kptIO"
,
"LpfE8xz"
,
"ayXCW"
,
"readFlo"
,
"FsSjC"
,
"stringi"
,
"Zymkz"
,
"bin"
,
"QCmLq"
,
"URzpu"
,
"bJXmh"
,
"|3|1"
,
"ZuXog"
,
"QWgdM"
,
"join"
,
"dlvDl"
,
"push"
,
"_blocks"
,
"XyCSd"
,
"VvVIb"
,
"LjQYx"
,
"ajtxP"
,
"yWXJR"
,
"zCWHZ"
,
"rotl"
,
"ZyeCw"
,
"wordsTo"
,
"jnBeR"
,
"pAnrE"
,
"NdIIp"
,
"8lYxANC"
,
"XGsUl"
,
"rCode"
,
"pUeGA"
,
"zGNlp"
,
"cdefghi"
,
"wsVCK"
,
"IPplF"
,
"kUMTd"
,
"JHZDn"
,
"tkLYM"
,
"rXWku"
,
"wOKuD"
,
"701812dHtSeL"
,
"RhoIX"
,
"GfZNv"
,
"Qdnej"
,
"FjgPK"
,
"OPQRSTU"
];
return
(a0_0x2216
=
function() {
return
e
}
)()
}
function a0_0x4e04(e, t) {
var r
=
a0_0x2216();
return
(a0_0x4e04
=
function(e, t) {
return
r[e
-
=
157
]
}
)(e, t)
}
function a0_0x5bf4a2(e, t) {
return
a0_0x4e04(e
-
975
, t)
}
function sign(e, t) {
var r
=
1
,n
=
82
,o
=
9
,i
=
57
,a
=
122
,s
=
40
,u
=
6
,c
=
46
,l
=
300
,p
=
189
,f
=
8
,d
=
27
,g
=
254
,A
=
103
,h
=
34
,v
=
66
,y
=
91
,m
=
240
,_
=
77
,b
=
59
,w
=
139
,T
=
56
,x
=
71
,E
=
268
,S
=
98
,k
=
82
,I
=
64
,B
=
70
,C
=
45
,O
=
112
,M
=
49
,L
=
30
,D
=
128
,R
=
62
,N
=
13
,j
=
201
,F
=
159
,P
=
196
,W
=
90
,U
=
39
,z
=
126
,H
=
67
,Z
=
28
,V
=
348
,G
=
160
,q
=
39
,Q
=
181
,K
=
47
,Y
=
278
,X
=
162
,J
=
239
,$
=
185
,ee
=
35
,te
=
116
,re
=
223
,ne
=
125
,oe
=
131
,ie
=
13
,ae
=
0
,se
=
43
,ue
=
151
,ce
=
198
,le
=
8
,pe
=
301
,fe
=
180
,de
=
47
,ge
=
210
,Ae
=
509
,he
=
344
,ve
=
353
,ye
=
392
,me
=
44
,_e
=
45
,be
=
161
,we
=
285
,Te
=
192
,xe
=
328
,Ee
=
521
,Se
=
392
,ke
=
522
,Ie
=
339
,Be
=
365
,Ce
=
396
,Oe
=
159
,Me
=
225
,Le
=
473
,De
=
542
,Re
=
396
,Ne
=
166
,je
=
154
,Fe
=
203
,Pe
=
56
,We
=
339
,Ue
=
396
,ze
=
342
,He
=
483
,Ze
=
396
,Ve
=
221
,Ge
=
54
,qe
=
143
,Qe
=
72
,Ke
=
312
,Ye
=
339
,Xe
=
419
,Je
=
396
,$e
=
400
,et
=
102
,tt
=
234
,rt
=
180
,nt
=
85
,ot
=
241
,it
=
319
,at
=
359
,st
=
754
,ut
=
624
,ct
=
416
,lt
=
458
,pt
=
355
,ft
=
327
,dt
=
272
,gt
=
558
,At
=
590
,ht
=
407
,vt
=
292
,yt
=
543
,mt
=
552
,_t
=
309
,bt
=
323
,wt
=
384
,Tt
=
500
,xt
=
341
,Et
=
472
,St
=
547
,kt
=
534
,It
=
141
,Bt
=
293
,Ct
=
659
,Ot
=
594
,Mt
=
517
,Lt
=
551
,Dt
=
594
,Rt
=
281
,Nt
=
341
,jt
=
351
,Ft
=
384
,Pt
=
383
,Wt
=
632
,Ut
=
629
,zt
=
401
,Ht
=
538
,Zt
=
550
,Vt
=
640
,Gt
=
416
,qt
=
1036
,Qt
=
238
,Kt
=
58
,Yt
=
299
,Xt
=
270
,Jt
=
396
,$t
=
1350
,er
=
1447
,tr
=
169
,rr
=
340
,nr
=
811
,
or
=
625
,ir
=
603
,ar
=
1
,sr
=
13
,ur
=
145
,cr
=
69
,lr
=
224
,pr
=
495
,fr
=
557
,dr
=
399
,gr
=
391
,Ar
=
537
,hr
=
278
,vr
=
644
,yr
=
601
,mr
=
1348
, _r
=
{
oGIPg: function(e, t) {
return
e !
=
=
t
},
ofNul: Tr(
-
158
,
-
54
)
+
"ed"
,
YUgHM: Tr(r,
8
),
fdXbs: function(e, t) {
return
e < t
},
LmgEU: function(e, t) {
return
e > t
},
FjgPK: function(e, t) {
return
e >> t
},
rVTGu: function(e, t) {
return
e | t
},
pBIon: function(e, t) {
return
e | t
},
sYpSd: Tr(n, o)
+
Tr(i, a),
vnWPy: Tr(
-
s,
-
u)
+
Tr(
58
,
29
)
+
Tr(
-
c,
-
55
),
ckmlP: function(e, t) {
return
e << t
},
njKvQ: function(e, t) {
return
e & t
},
ZyeCw: function(e, t) {
return
e
+
t
},
ijPny: function(e, t) {
return
e(t)
},
bHRnl: Tr(
-
l,
-
p)
+
Tr(
-
f, d)
+
Tr(
-
g,
-
A)
+
Tr(h,
-
v)
+
Tr(
-
y,
-
60
)
+
Tr(
-
m,
-
144
)
+
Tr(_,
76
)
+
Tr(
-
b,
88
)
+
Tr(w,
112
)
+
"m3"
,
kEjFq: Tr(
139
, T),
PmRiF: function(e, t) {
return
e(t)
},
AgtoL: function(e, t) {
return
e
=
=
=
t
},
pBQVD: Tr(
-
80
,
-
x)
+
Tr(E, S)
+
"]"
,
horPD: Tr(
-
146
,
-
x)
+
Tr(k, I)
}
, br
=
(Tr(
-
x,
-
14
)
+
Tr(B, C)
+
Tr(O,
-
M))[Tr(
27
,
-
42
)](
"|"
)
, wr
=
0
;
function Tr(e, t) {
return
a0_0x5bf4a2(t
-
-
mr, e)
}
for
(; ; ) {
switch (br[wr
+
+
]) {
case
"0"
:
_r[Tr(L,
-
D)](
'object'
, _r[Tr(
-
R,
-
N)]) && Br && Br[Tr(
-
j,
-
159
)
+
"or"
] && Br[Tr(
-
189
,
-
F)
+
"or"
][Tr(P, W)
+
"nt"
] && Br[Tr(U,
-
z)] && (Sr
=
_r[Tr(H, Z)]);
continue
;
case
"1"
:
var xr
=
{
pAnrE: function(e, t) {
var r, n;
return
_r[(r
=
vr,
n
=
yr,
Tr(n, r
-
667
))](e, t)
},
GEFbL: function(e, t) {
return
_r[(r
=
-
gr,
n
=
-
Ar,
Tr(n, r
-
-
hr))](e, t);
var r, n
},
HInoH: function(e, t) {
return
e | t
},
Iqqni: function(e, t) {
return
_r[(r
=
pr,
n
=
fr,
Tr(r, n
-
dr))](e, t);
var r, n
},
bVwGo: function(e, t) {
return
e & t
},
rNCWZ: function(e, t) {
return
e | t
},
hKqxo: function(e, t) {
return
e >> t
},
wsVCK: function(e, t) {
var r, n;
return
_r[(r
=
lr,
n
=
242
,
Tr(r, n
-
274
))](e, t)
},
FFGBs: function(e, t) {
return
e >> t
},
nUgYR: function(e, t) {
return
_r[(r
=
244
,
n
=
cr,
Tr(n, r
-
266
))](e, t);
var r, n
},
UwDmp: _r[Tr(
-
V,
-
G)],
uyiOy: _r[Tr(q,
12
)],
pUeGA: function(e, t) {
return
_r[(r
=
ar,
n
=
sr,
Tr(r, n
-
-
ur))](e, t);
var r, n
},
FqzNC: function(e, t) {
return
_r[(r
=
-
nr,
n
=
-
or
,
Tr(r, n
-
-
ir))](e, t);
var r, n
},
QWgdM: function(e, t) {
return
_r[(r
=
277
,
n
=
rr,
Tr(n, r
-
316
))](e, t);
var r, n
},
JfMBq: function(e, t) {
var r, n;
return
_r[(r
=
183
,
n
=
tr,
Tr(n, r
-
377
))](e, t)
},
gJOmQ: function(e, t) {
var r, n;
return
_r[(r
=
$t,
n
=
er,
Tr(n, r
-
1192
))](e, t)
},
AyuWg: function(e, t) {
return
_r[(r
=
-
349
,
n
=
-
Jt,
Tr(r, n
-
-
532
))](e, t);
var r, n
},
rGcjO: function(e, t) {
return
e
+
t
},
ZuXog: function(e, t) {
return
_r[(r
=
Yt,
n
=
Xt,
Tr(r, n
-
134
))](e, t);
var r, n
},
rbzrd: function(e, t) {
return
_r[(r
=
-
Qt,
n
=
-
Kt,
Tr(r, n
-
-
6
))](e, t);
var r, n
},
ExLNh: function(e, t) {
return
e & t
},
CSkFe: function(e, t) {
var r, n;
return
_r[(r
=
1002
,
n
=
qt,
Tr(n, r
-
844
))](e, t)
}
};
continue
;
case
"2"
:
var Er
=
_r[Tr(Q, K)];
continue
;
case
"3"
:
var Sr
=
_r[Tr(
111
,
23
)];
continue
;
case
"4"
:
var kr
=
function(e) {
function t(e, t) {
return
Tr(e, t
-
-
Gt)
}
for
(var r
=
xr[t(
-
344
,
-
it)][t(
-
298
,
-
458
)](
"|"
), n
=
0
; ; ) {
switch (r[n
+
+
]) {
case
"0"
:
var o
=
0
;
continue
;
case
"1"
:
return
g;
case
"2"
:
var i, a, s, u, c, l, p;
continue
;
case
"3"
:
for
(; xr[t(
-
at,
-
277
)](o, e[t(
-
st,
-
ut)]); )
for
(var f
=
xr[t(
-
ct,
-
309
)][t(
-
448
,
-
lt)](
"|"
), d
=
0
; ; ) {
switch (f[d
+
+
]) {
case
"0"
:
p
=
xr[t(
-
pt,
-
ft)](s,
63
);
continue
;
case
"1"
:
u
=
xr[t(
-
dt,
-
dt)](i,
2
);
continue
;
case
"2"
:
c
=
xr[t(
-
gt,
-
At)](xr[t(
-
ht,
-
vt)](xr[t(
-
yt,
-
mt)](i,
3
),
4
), xr[t(
-
_t,
-
bt)](a,
4
));
continue
;
case
"3"
:
i
=
e[t(
-
256
,
-
wt)
+
t(
-
Tt,
-
xt)](o
+
+
);
continue
;
case
"4"
:
g
=
xr[t(
-
Et,
-
474
)](xr[t(
-
St,
-
kt)](xr[t(
-
It,
-
Bt)](g
+
Er[t(
-
Ct,
-
Ot)](u), Er[t(
-
Mt,
-
594
)](c)), Er[t(
-
548
,
-
594
)](l)), Er[t(
-
Lt,
-
Dt)](p));
continue
;
case
"5"
:
s
=
e[t(
-
472
,
-
wt)
+
t(
-
Rt,
-
Nt)](o
+
+
);
continue
;
case
"6"
:
a
=
e[t(
-
jt,
-
Ft)
+
t(
-
Pt,
-
Nt)](o
+
+
);
continue
;
case
"7"
:
isNaN(a) ? l
=
p
=
64
: xr[t(
-
Wt,
-
Ut)](isNaN, s) && (p
=
64
);
continue
;
case
"8"
:
l
=
xr[t(
-
161
,
-
vt)](xr[t(
-
497
,
-
zt)](a,
15
),
2
) | xr[t(
-
Ht,
-
Zt)](s,
6
);
continue
}
break
}
continue
;
case
"4"
:
e
=
xr[t(
-
Vt,
-
629
)](Cr, e);
continue
;
case
"5"
:
var g
=
"";
continue
}
break
}
};
continue
;
case
"5"
:
var Ir
=
(new Date)[Tr(
-
Y,
-
X)]();
/
/
测试时间戳：
1686727067729
continue
;
case
"6"
:
return
{
"X-s"
: _r[Tr(
99
,
-
52
)](kr, _r[Tr(
-
J,
-
$)](CryptoJS.MD5, [Ir,
'test'
, e, Or ? JSON[Tr(
-
ee, te)
+
"fy"
](t) : "
"][Tr(re, ne)]("
")).toString()),
"X-t"
: Ir
};
case
"7"
:
var Br
=
(
"undefined"
=
=
typeof window ?
"undefined"
:
'object'
)
=
=
=
_r[Tr(oe,
-
ie)] ? __webpack_require__.g : window;
continue
;
case
"8"
:
var Cr
=
function(e) {
function t(e, t) {
return
Tr(e, t
-
253
)
}
e
=
e[t(Ae, he)](
/
\r\n
/
g,
"\n"
);
for
(var r
=
"", n
=
0
; xr[t(ve, ye)](n, e[t(
-
me, _e)]); n
+
+
) {
var o
=
e[t(be, we)
+
t(Te, xe)](n);
xr[t(Ee, Se)](o,
128
) ? r
+
=
String[t(ke, Ie)
+
t(Be, Ce)](o) : xr[t(Oe, Me)](o,
127
) && xr[t(Le, Se)](o,
2048
) ? (r
+
=
String[t(
226
, Ie)
+
t(De, Re)](xr[t(Ne, je)](xr[t(Fe, Pe)](o,
6
),
192
)),
r
+
=
String[t(
208
, We)
+
t(
268
, Ue)](
128
| xr[t(
511
, ze)](o,
63
))) : (r
+
=
String[t(
292
,
339
)
+
t(He, Ze)](xr[t(Ve, Ge)](xr[t(qe, Qe)](o,
12
),
224
)),
r
+
=
String[t(Ke, Ye)
+
t(Xe, Je)](xr[t(
496
, $e)](
63
& xr[t(et, tt)](o,
6
),
128
)),
r
+
=
String[t(
332
, Ye)
+
t(Je, Je)](xr[t(rt, nt)](xr[t(ot,
342
)](o,
63
),
128
)))
}
return
r
};
continue
;
case
"9"
:
var Or
=
_r[Tr(
-
63
, ae)](
Object
[Tr(
170
, se)
+
"pe"
][Tr(
-
ue,
-
ce)
+
"g"
][Tr(le,
-
180
)](t), _r[Tr(
-
99
,
3
)]) ||
Object
[Tr(
-
ne, se)
+
"pe"
][Tr(
-
10
,
-
198
)
+
"g"
][Tr(
-
pe,
-
fe)](t)
=
=
=
_r[Tr(
-
de,
-
ge)];
continue
}
break
}
}
var e
=
'/api/sns/web/v2/comment/page?note_id=64704e5d00000000130003c5&cursor='
var t
=
''
console.log(sign(e, t));
|
更多【xhs sign算法生成X-s】相关视频教程：www.yxfzedu.com
相关文章推荐
- Android安全- 安卓协议逆向 cxdx 分析与实现 - Android安全 CTF对抗 IOS安全
- Android安全-HoneyBadger系列二 Android App全量监控也来了 - Android安全 CTF对抗 IOS安全
- Android安全-HoneyBadger系列一 开篇,虚拟机调试器来了 - Android安全 CTF对抗 IOS安全
- 编程技术-为无源码的DLL增加接口功能 - Android安全 CTF对抗 IOS安全
- CTF对抗-Realworld CTF 2023 ChatUWU 详解 - Android安全 CTF对抗 IOS安全
- Android安全-frida源码编译详解 - Android安全 CTF对抗 IOS安全
- 软件逆向- PE格式：新建节并插入代码 - Android安全 CTF对抗 IOS安全
- 加壳脱壳- UPX源码学习和简单修改 - Android安全 CTF对抗 IOS安全
- 二进制漏洞-win越界写漏洞分析 CVE-2020-1054 - Android安全 CTF对抗 IOS安全
- Pwn-2022长城杯决赛pwn - Android安全 CTF对抗 IOS安全
- 软件逆向-Wibu Codemeter 7.3学习笔记——Codemeter服务端 - Android安全 CTF对抗 IOS安全
- Pwn-沙箱逃逸之google ctf 2019 Monochromatic writeup - Android安全 CTF对抗 IOS安全
- 软件逆向-Wibu Codemeter 7.3学习笔记——AxProtector壳初探 - Android安全 CTF对抗 IOS安全
- 企业安全-学习Kubernetes笔记——暴露站点服务（Ingress） - Android安全 CTF对抗 IOS安全
- 企业安全-学习Kubernetes笔记——部署数据库站点（MySql） - Android安全 CTF对抗 IOS安全
- 企业安全-学习Kubernetes笔记——部署web站点环境（PHP+Nginx） - Android安全 CTF对抗 IOS安全
- 企业安全-学习Kubernetes笔记——安装NFS驱动 - Android安全 CTF对抗 IOS安全
- 企业安全-学习Kubernetes笔记——kubeadm安装Kubernetes - Android安全 CTF对抗 IOS安全
- 软件逆向-wibu软授权(四) - Android安全 CTF对抗 IOS安全
- 软件逆向-使用IDAPython开发复制RVA的插件 - Android安全 CTF对抗 IOS安全
记录自己的技术轨迹
文章规则：
1)：文章标题请尽量与文章内容相符
2)：严禁色情、血腥、暴力
3)：严禁发布任何形式的广告贴
4)：严禁发表关于中国的政治类话题
5)：严格遵守中国互联网法律法规
6)：有侵权,疑问可发邮件至service@yxfzedu.com
近期原创 更多
