JS reverse engineering---AST deobfuscation practice-Jiexian verification code


Statement
All content in this article is only for learning and communication, and is not used for any other purpose. The complete code is not provided. The packet capture content, sensitive URLs, data interfaces, etc. have been processed Desensitization is strictly prohibited for commercial and illegal purposes, otherwise the author will have nothing to do with any consequences arising therefrom.
This article is prohibited from being reproduced without permission, and is prohibited from being redistributed after any modification. The author is not responsible for any accidents caused by the unauthorized use of the technology explained in this article. If there is any infringement, please contact the author immediately Delete, please consciously abide by relevant laws and regulations.


JiExperience JS reverse deobfuscation

  • Deobfuscation goal: Jiexian verification code
  • Parameter cracking: w value

Find the data interface and found that the encrypted part of the payload has a w value
Insert image description here
Enter from the launcher and find that the JS part is completely obfuscated
Insert image description here
Searching for the W value after AST deobfuscation will make our subsequent cracking situation much simpler
The effect of the w value after deobfuscation is as follows:
Insert image description here
Follow-up Supplement
The choice is the third generation of Jiexian, and the fourth generation of Jiexuan. There is basically no big difference in logic between the two. The fourth generation has some more encryption parameters, as shown in the figure: Attached below is a picture of the load parameter results after the fourth generation of pole test solution obfuscation: < /span> If you need relevant codes and explanations about Jiexian verification code deobfuscation, please contact me
But we only study the deconfusion part in this chapter, so we will not consider it.
Insert image description here

Insert image description here

Write at the end:
My writing level is limited. If there are any explanations that are not in place or wrong, please give me some advice in the comment area and we can make progress together. If there is any If you need code and explanation communication, you can add me on WeChat 18847868809

Guess you like

Origin blog.csdn.net/m0_52336378/article/details/132366825