第二题:js 混淆 - 动态cookie 1
更新解法
时隔一年,最近学了ast解混淆以后,把第二题重做了一遍
解混淆思路:
解混淆后js代码如下:
var document= {
};
function _0x112208(_0x5b69d8, _0x3de4a1) {
_0x448c2f = (65535 & _0x5b69d8) + (65535 & _0x3de4a1);
return (_0x5b69d8 >> 16) + (_0x3de4a1 >> 16) + (_0x448c2f >> 16) << 16 | 65535 & _0x448c2f;
}
function _0x101700(_0x19c5f2, _0x40c04f) {
return _0x19c5f2 << _0x40c04f | _0x19c5f2 >>> 32 - _0x40c04f;
}
function _0x4d9052(_0x2ad611, _0x12667c, _0x4e5444, _0x21c32c, _0x2ca7da, _0x44626f) {
return _0x112208(_0x101700(_0x112208(_0x112208(_0x12667c, _0x2ad611), _0x112208(_0x21c32c, _0x44626f)), _0x2ca7da), _0x4e5444);
}
function _0x5624ba(_0x173d50, _0x1eb601, _0x3e80e6, _0x27ae79, _0x196272, _0x352dd6, _0x315a43) {
return _0x4d9052(_0x1eb601 & _0x3e80e6 | ~_0x1eb601 & _0x27ae79, _0x173d50, _0x1eb601, _0x196272, _0x352dd6, _0x315a43);
}
function _0x2d8b1d(_0x32a9d0, _0x585bb5, _0x19b9f2, _0x53bbfb, _0x1cbfed, _0x34200c, _0x5135ca) {
return _0x4d9052(_0x585bb5 & _0x53bbfb | _0x19b9f2 & ~_0x53bbfb, _0x32a9d0, _0x585bb5, _0x1cbfed, _0x34200c, _0x5135ca);
}
function _0x21cf21(_0x5f0db4, _0x560b61) {
_0x45ae5c = [99, 111, 110, 115, 111, 108, 101];
_0x7cdad8 = '';
for (_0x5d58e6 = 0; _0x5d58e6 < _0x45ae5c["length"]; _0x5d58e6++) {
_0x7cdad8 += String["fromCharCode"](_0x45ae5c[_0x5d58e6]);
}
return _0x7cdad8;
}
function _0x3316ae(_0x5c1f3b, _0xdee360, _0x251700, _0x2a047e, _0x4ea0af, _0x62d9e8, _0x1edd4c) {
var _0x22f2aa = {
"QsHTs": function (_0x30fee6, _0x19ec21) {
return _0x30fee6(_0x19ec21);
}
};
_0x5b9921 = _0x22f2aa;
return _0x4d9052(_0xdee360 ^ _0x251700 ^ _0x2a047e, _0x5c1f3b, _0xdee360, _0x4ea0af, _0x62d9e8, _0x1edd4c);
}
function _0x160619(_0x2afda5, _0x4cf1da, _0x354d4e, _0x2c2702, _0x4b938d, _0x58d9fb, _0x5b82c0) {
return _0x4d9052(_0x354d4e ^ (_0x4cf1da | ~_0x2c2702), _0x2afda5, _0x4cf1da, _0x4b938d, _0x58d9fb, _0x5b82c0);
}
function _0x3e1bdb(_0xff9c5c, _0x57e0a7) {
if (_0x57e0a7) {
return _0x160619(_0xff9c5c);
}
return _0x21cf21(_0xff9c5c);
}
function _0x2eb2ce(_0x9ccead, _0x5d659e) {
_0x245e09 = '';
for (_0x332a56 = 0; _0x332a56 < _0x9ccead["length"]; _0x332a56++) {
_0x245e09 += String["fromCharCode"](_0x9ccead[_0x332a56]);
}
return _0x245e09;
}
function _0x3c9ca8(_0x46f74d, _0x1bb9bf) {
_0x3e1bdb();
qz = [10, 99, 111, 110, 115, 111, 108, 101, 32, 61, 32, 110, 101, 119, 32, 79, 98, 106, 101, 99, 116, 40, 41, 10, 99, 111, 110, 115, 111, 108, 101, 46, 108, 111, 103, 32, 61, 32, 102, 117, 110, 99, 116, 105, 111, 110, 32, 40, 115, 41, 32, 123, 10, 32, 32, 32, 32, 119, 104, 105, 108, 101, 32, 40, 49, 41, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 102, 111, 114, 40, 105, 61, 48, 59, 105, 60, 49, 49, 48, 48, 48, 48, 48, 59, 105, 43, 43, 41, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 104, 105, 115, 116, 111, 114, 121, 46, 112, 117, 115, 104, 83, 116, 97, 116, 101, 40, 48, 44, 48, 44, 105, 41, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 125, 10, 32, 32, 32, 32, 125, 10, 10, 125, 10, 99, 111, 110, 115, 111, 108, 101, 46, 116, 111, 83, 116, 114, 105, 110, 103, 32, 61, 32, 39, 91, 111, 98, 106, 101, 99, 116, 32, 79, 98,</