记录一个非常有趣的js混淆

原文  



var x="9MJbYCmpOgzGeVKF1ZijB@@g@else@onreadystatechange@__jsl_clearance@@@@@addEventListener@@Path@@substr@https@captcha@@23@@split@@@f@d@parseInt@@9@@location@@firstChild@@String@36@chars@match@if@div@new@@8@1500@while@0xFF@length@1523677283@eval@rOm9XFMtA3QKV7nYsPGT4lifyWwkq5vcjH2IdxUoCbhERLaz81DNB6@return@for@@challenge@var@@href@RegExp@@@Array@GMT@attachEvent@@@Apr@@@0xEDB88320@@innerHTML@setTimeout@14@18@@@catch@@@@@@false@@L@@@@document@0@join@T1@toLowerCase@fromCharCode@createElement@@@DOMContentLoaded@charCodeAt@window@Expires@a@@D@04@charAt@@try@JgSe0upZ@@@1@@@@e@replace@Sat@41@cookie@@@@reverse@@@toString@function@241".replace(/@*$/,"").split("@"),y="1q m=4f(){2f('12.20=12.20.44(/[\\?|&]h-1p/,\\'\\')',1f);34.47='6=1j.4g|35|'+(4f(){1q m=24(+[[10]]),i=['30',[(((+!-[])<<(+!-[]))^-~{})],'1',({}+[[]][35]).3l(-~~~''),'37',({}+[[]][35]).3l((-~!{}+[])+(-~{}-~{}+[[]][35])),'%',({}+[]).3l((-~{}-~{}<<-~{}-~{})),'3j'];1n(1q 31=35;31<i.1i;31++){m.4b()[31]=i[31]};1m m.36('')})()+';3g=45, 2g-29-2h 3k:46:j 25;d=/;'};1a((4f(){3n{1m !!3f.b;}2k(43){1m 2q;}})()){34.b('3d',m,2q)}4{34.26('5',m)}",f=function(x,y){var a=0,b=0,c=0;x=x.split("");y=y||99;while((a=x.shift())&&(b=a.charCodeAt(0)-77.5))c=(Math.abs(b)<13?(b+48.5):parseInt(a,36))+y*c;return c},z=f(y.match(/\w/g).sort(function(x,y){return f(x)-f(y)}).pop());while(z++)try{eval(y.replace(/\b\w+\b/g, function(y){return x[f(y,z)-1]||("_"+y)}));break}catch(_){}





正确解后


var _m = function() {
    setTimeout('location.href=location.href.replace(/[\?|&]captcha-challenge/,\'\')', 1500);
    document.cookie = '__jsl_clearance=1523677283.241|0|' + (function() {
        var _m = Array(+[[9]])
          , _i = ['L', [(((+!-[]) << (+!-[])) ^ -~{})], '9MJbYCmpOgzGeVKF1ZijB', ({} + [[]][0]).charAt(-~~~''), 'T1', ({} + [[]][0]).charAt((-~!{} + []) + (-~{} - ~{} + [[]][0])), '%', ({} + []).charAt((-~{} - ~{} << -~{} - ~{})), 'D'];
        for (var _31 = 0; _31 < _i.length; _31++) {
            _m.reverse()[_31] = _i[_31]
        }
        ;return _m.join('')
    })() + ';Expires=Sat, 14-Apr-18 04:41:23 GMT;Path=/;'
}
;
if ((function() {
    try {
        return !!window.addEventListener;
    } catch (e) {
        return false;
    }
})()) {
    document.addEventListener('DOMContentLoaded', _m, false)
} else {
    document.attachEvent('onreadystatechange', _m)
}


www.eweidai.com 上面这段正常 访问频繁会出现同样的混淆js但是解出来的js完全没用 利用了 while特性

猜你喜欢

转载自my.oschina.net/KFS/blog/1801448