猿人学 web第二题混淆对抗 2021-10-18

漁滒发表于 2021-10-19 21:00

在2021年10月18日，猿人学第二题的代码混淆进行了升级，因为之前已经扣过代码了，所以这次主要是做混淆的对抗
首先获取一下反混淆前的代码

```python
url = 'https://match.yuanrenxue.com/match/2'
response = requests.get(url)

with open('02.js', 'wb') as f:
   f.write(response.content)
```

![在这里插入图片描述](https://img-blog.csdnimg.cn/229077e9fa62408abef7f4576bf4c88a.jpg?)

主要分成六个部分

| 序号 | 作用 |
|--|--|
|1 | 大数组 |
| 2 | 自执行还原大数组 |
|3 | 解密函数组 |
|4 | 原函数体 |
|5 | 检测函数 |
|6 | 定时启动检测函数 |

大致上来看是一种ob混淆的变形，通过分析如下图
![在这里插入图片描述](https://img-blog.csdnimg.cn/60d6721ff9dd44dc81d64e5cf7950223.jpg?)
在函数调用还原前，字符串被提取了出来，所以相对于ob混淆多了一个步骤

1.字符串与数字回填
2.函数调用还原
3.对象调用还原
4.分支流程判断
5.控制流平坦化

根据上面5步还原后的代码如下

```javascript
(function $dbsm_0x37d29a(_0x4643a3, _0x4ef084, _0x496327, _0x3c6bd1, _0x4fad9d, _0x41576a, _0x448c2f, _0x45ae5c, _0x7cdad8, _0x5d58e6, _0x24362f, _0x18d4aa, _0x630f0, _0x4d24a7, _0xd26743, _0x5da9b5, _0x1548fd, _0x54f778) {
function _0x112208(_0x5b69d8, _0x3de4a1) {
_0x448c2f = (65535 & _0x5b69d8) + (65535 & _0x3de4a1);
return (_0x5b69d8 >> 16) + (_0x3de4a1 >> 16) + (_0x448c2f >> 16) << 16 | 65535 & _0x448c2f;
}

function _0x101700(_0x19c5f2, _0x40c04f) {
return _0x19c5f2 << _0x40c04f | _0x19c5f2 >>> 32 - _0x40c04f;
}

function _0x4d9052(_0x2ad611, _0x12667c, _0x4e5444, _0x21c32c, _0x2ca7da, _0x44626f) {
return _0x112208(_0x101700(_0x112208(_0x112208(_0x12667c, _0x2ad611), _0x112208(_0x21c32c, _0x44626f)), _0x2ca7da), _0x4e5444);
}

function _0x5624ba(_0x173d50, _0x1eb601, _0x3e80e6, _0x27ae79, _0x196272, _0x352dd6, _0x315a43) {
return _0x4d9052(_0x1eb601 & _0x3e80e6 | ~_0x1eb601 & _0x27ae79, _0x173d50, _0x1eb601, _0x196272, _0x352dd6, _0x315a43);
}

function _0x2d8b1d(_0x32a9d0, _0x585bb5, _0x19b9f2, _0x53bbfb, _0x1cbfed, _0x34200c, _0x5135ca) {
return _0x4d9052(_0x585bb5 & _0x53bbfb | _0x19b9f2 & ~_0x53bbfb, _0x32a9d0, _0x585bb5, _0x1cbfed, _0x34200c, _0x5135ca);
}

function _0x21cf21() {
_0x45ae5c = , _0x7cdad8 = "";

for (_0x5d58e6 = 0; _0x5d58e6 < _0x45ae5c["length"]; _0x5d58e6++) {
   _0x7cdad8 += String["fromCharCode"](_0x45ae5c);
}

return _0x7cdad8;
}

function _0x3316ae(_0x5c1f3b, _0xdee360, _0x251700, _0x2a047e, _0x4ea0af, _0x62d9e8, _0x1edd4c) {
return _0x4d9052(_0xdee360 ^ _0x251700 ^ _0x2a047e, _0x5c1f3b, _0xdee360, _0x4ea0af, _0x62d9e8, _0x1edd4c);
}

function _0x160619(_0x2afda5, _0x4cf1da, _0x354d4e, _0x2c2702, _0x4b938d, _0x58d9fb, _0x5b82c0) {
return _0x4d9052(_0x354d4e ^ (_0x4cf1da | ~_0x2c2702), _0x2afda5, _0x4cf1da, _0x4b938d, _0x58d9fb, _0x5b82c0);
}

function _0x1a8c0e(_0x4b49f3, _0x31923d, _0xbd3204, _0x693550, _0x540797, _0x5dacc8, _0x22f03d, _0x5b3e7f, _0x2ee10b, _0x30b068, _0x3a35a4) {
_0x4b49f3 |= 128 << _0x31923d % 32, _0x4b49f3 = _0x31923d;
_0x5b3e7f = 1732584193, _0x2ee10b = -271733879, _0x30b068 = -1732584194, _0x3a35a4 = _0x5b3e7f - 1460850315;

for (_0xbd3204 = 0; _0xbd3204 < _0x4b49f3["length"]; _0xbd3204 += 16) _0x693550 = _0x5b3e7f, _0x540797 = _0x2ee10b, _0x5dacc8 = _0x30b068, _0x22f03d = _0x3a35a4, _0x5b3e7f = _0x5624ba(_0x5b3e7f, _0x2ee10b, _0x30b068, _0x3a35a4, _0x4b49f3, 7, -680876936), _0x3a35a4 = _0x5624ba(_0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x30b068, _0x4b49f3, 12, -389564586), _0x30b068 = _0x5624ba(_0x30b068, _0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x4b49f3, 17, 606105819), _0x2ee10b = _0x5624ba(_0x2ee10b, _0x30b068, _0x3a35a4, _0x5b3e7f, _0x4b49f3, 22, -1044525330), _0x5b3e7f = _0x5624ba(_0x5b3e7f, _0x2ee10b, _0x30b068, _0x3a35a4, _0x4b49f3, 7, -176418897), _0x3a35a4 = _0x5624ba(_0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x30b068, _0x4b49f3, 12, 1200080426), _0x30b068 = _0x5624ba(_0x30b068, _0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x4b49f3, 17, -1473231341), _0x2ee10b = _0x5624ba(_0x2ee10b, _0x30b068, _0x3a35a4, _0x5b3e7f, _0x4b49f3, 22, -45705983), _0x5b3e7f = _0x5624ba(_0x5b3e7f, _0x2ee10b, _0x30b068, _0x3a35a4, _0x4b49f3, 7, 1770010416), _0x3a35a4 = _0x5624ba(_0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x30b068, _0x4b49f3, 12, -1958414417), _0x30b068 = _0x5624ba(_0x30b068, _0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x4b49f3, 17, -42063), _0x2ee10b = _0x5624ba(_0x2ee10b, _0x30b068, _0x3a35a4, _0x5b3e7f, _0x4b49f3, 22, -1990404162), _0x5b3e7f = _0x5624ba(_0x5b3e7f, _0x2ee10b, _0x30b068, _0x3a35a4, _0x4b49f3, 7, 1804603682), _0x3a35a4 = _0x5624ba(_0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x30b068, _0x4b49f3, 12, -40341101), _0x30b068 = _0x5624ba(_0x30b068, _0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x4b49f3, 17, -1502882290), _0x2ee10b = _0x5624ba(_0x2ee10b, _0x30b068, _0x3a35a4, _0x5b3e7f, _0x4b49f3, 22, 1236535329), _0x5b3e7f = _0x2d8b1d(_0x5b3e7f, _0x2ee10b, _0x30b068, _0x3a35a4, _0x4b49f3, 5, -165796510), _0x3a35a4 = _0x2d8b1d(_0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x30b068, _0x4b49f3, 9, -1069501632), _0x30b068 = _0x2d8b1d(_0x30b068, _0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x4b49f3, 14, 643717713), _0x2ee10b = _0x2d8b1d(_0x2ee10b, _0x30b068, _0x3a35a4, _0x5b3e7f, _0x4b49f3, 20, -373897302), _0x5b3e7f = _0x2d8b1d(_0x5b3e7f, _0x2ee10b, _0x30b068, _0x3a35a4, _0x4b49f3, 5, -701558691), _0x3a35a4 = _0x2d8b1d(_0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x30b068, _0x4b49f3, 9, 38016083), _0x30b068 = _0x2d8b1d(_0x30b068, _0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x4b49f3, 14, -660478335), _0x2ee10b = _0x2d8b1d(_0x2ee10b, _0x30b068, _0x3a35a4, _0x5b3e7f, _0x4b49f3, 20, -405537848), _0x5b3e7f = _0x2d8b1d(_0x5b3e7f, _0x2ee10b, _0x30b068, _0x3a35a4, _0x4b49f3, 5, 568446438), _0x3a35a4 = _0x2d8b1d(_0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x30b068, _0x4b49f3, 9, -1019803690), _0x30b068 = _0x2d8b1d(_0x30b068, _0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x4b49f3, 14, -187363961), _0x2ee10b = _0x2d8b1d(_0x2ee10b, _0x30b068, _0x3a35a4, _0x5b3e7f, _0x4b49f3, 20, 1163531501), _0x5b3e7f = _0x2d8b1d(_0x5b3e7f, _0x2ee10b, _0x30b068, _0x3a35a4, _0x4b49f3, 5, -1444681467), _0x3a35a4 = _0x2d8b1d(_0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x30b068, _0x4b49f3, 9, -51403784), _0x30b068 = _0x2d8b1d(_0x30b068, _0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x4b49f3, 14, 1735328473), _0x2ee10b = _0x2d8b1d(_0x2ee10b, _0x30b068, _0x3a35a4, _0x5b3e7f, _0x4b49f3, 20, -1926607734), _0x5b3e7f = _0x3316ae(_0x5b3e7f, _0x2ee10b, _0x30b068, _0x3a35a4, _0x4b49f3, 4, -378558), _0x3a35a4 = _0x3316ae(_0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x30b068, _0x4b49f3, 11, -2022574463), _0x30b068 = _0x3316ae(_0x30b068, _0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x4b49f3, 16, 1839030562), _0x2ee10b = _0x3316ae(_0x2ee10b, _0x30b068, _0x3a35a4, _0x5b3e7f, _0x4b49f3, 23, -35309556), _0x5b3e7f = _0x3316ae(_0x5b3e7f, _0x2ee10b, _0x30b068, _0x3a35a4, _0x4b49f3, 4, -1530992060), _0x3a35a4 = _0x3316ae(_0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x30b068, _0x4b49f3, 11, 1272893353), _0x30b068 = _0x3316ae(_0x30b068, _0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x4b49f3, 16, -155497632), _0x2ee10b = _0x3316ae(_0x2ee10b, _0x30b068, _0x3a35a4, _0x5b3e7f, _0x4b49f3, 23, -1094730640), _0x5b3e7f = _0x3316ae(_0x5b3e7f, _0x2ee10b, _0x30b068, _0x3a35a4, _0x4b49f3, 4, 681279174), _0x3a35a4 = _0x3316ae(_0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x30b068, _0x4b49f3, 11, -358537222), _0x30b068 = _0x3316ae(_0x30b068, _0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x4b49f3, 16, -722521979), _0x2ee10b = _0x3316ae(_0x2ee10b, _0x30b068, _0x3a35a4, _0x5b3e7f, _0x4b49f3, 23, 76029189), _0x5b3e7f = _0x3316ae(_0x5b3e7f, _0x2ee10b, _0x30b068, _0x3a35a4, _0x4b49f3, 4, -640364487), _0x3a35a4 = _0x3316ae(_0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x30b068, _0x4b49f3, 11, -421815835), _0x30b068 = _0x3316ae(_0x30b068, _0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x4b49f3, 16, 530742520), _0x2ee10b = _0x3316ae(_0x2ee10b, _0x30b068, _0x3a35a4, _0x5b3e7f, _0x4b49f3, 23, -995338651), _0x5b3e7f = _0x160619(_0x5b3e7f, _0x2ee10b, _0x30b068, _0x3a35a4, _0x4b49f3, 6, -198630844), _0x3a35a4 = _0x160619(_0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x30b068, _0x4b49f3, 10, 1126891415), _0x30b068 = _0x160619(_0x30b068, _0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x4b49f3, 15, -1416354905), _0x2ee10b = _0x160619(_0x2ee10b, _0x30b068, _0x3a35a4, _0x5b3e7f, _0x4b49f3, 21, -57434055), _0x5b3e7f = _0x160619(_0x5b3e7f, _0x2ee10b, _0x30b068, _0x3a35a4, _0x4b49f3, 6, 1700485571), _0x3a35a4 = _0x160619(_0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x30b068, _0x4b49f3, 10, -1894986606), _0x30b068 = _0x160619(_0x30b068, _0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x4b49f3, 15, -1051523), _0x2ee10b = _0x160619(_0x2ee10b, _0x30b068, _0x3a35a4, _0x5b3e7f, _0x4b49f3, 21, -2054922799), _0x5b3e7f = _0x160619(_0x5b3e7f, _0x2ee10b, _0x30b068, _0x3a35a4, _0x4b49f3, 6, 1873313359), _0x3a35a4 = _0x160619(_0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x30b068, _0x4b49f3, 10, -30611744), _0x30b068 = _0x160619(_0x30b068, _0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x4b49f3, 15, -1560198380), _0x2ee10b = _0x160619(_0x2ee10b, _0x30b068, _0x3a35a4, _0x5b3e7f, _0x4b49f3, 21, 1309151649), _0x5b3e7f = _0x160619(_0x5b3e7f, _0x2ee10b, _0x30b068, _0x3a35a4, _0x4b49f3, 6, -145523070), _0x3a35a4 = _0x160619(_0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x30b068, _0x4b49f3, 10, -1120210379), _0x30b068 = _0x160619(_0x30b068, _0x3a35a4, _0x5b3e7f, _0x2ee10b, _0x4b49f3, 15, 718787259), _0x2ee10b = _0x160619(_0x2ee10b, _0x30b068, _0x3a35a4, _0x5b3e7f, _0x4b49f3, 21, -343485441), _0x5b3e7f = _0x112208(_0x5b3e7f, _0x693550), _0x2ee10b = _0x112208(_0x2ee10b, _0x540797), _0x30b068 = _0x112208(_0x30b068, _0x5dacc8), _0x3a35a4 = _0x112208(_0x3a35a4, _0x22f03d);

return ;
}

function _0xb8fd83(_0x28b0d4) {
_0x18d4aa = "", _0x630f0 = 32 * _0x28b0d4["length"];

for (_0x24362f = 0; _0x24362f < _0x630f0; _0x24362f += 8) _0x18d4aa += String["fromCharCode"](_0x28b0d4 >>> _0x24362f % 32 & 255);

return _0x18d4aa;
}

function _0x44ecf2(_0x12f7d8) {
var _0x4a27a3 = [];

for (_0x4a27a3[(_0x12f7d8["length"] >> 2) - 1] = void 0, _0x4d24a7 = 0; _0x4d24a7 < _0x4a27a3["length"]; _0x4d24a7 += 1) _0x4a27a3 = 0;

var _0x4fa8f0 = 8 * _0x12f7d8["length"];

for (_0x4d24a7 = 0; _0x4d24a7 < _0x4fa8f0; _0x4d24a7 += 8) _0x4a27a3 |= (255 & _0x12f7d8["charCodeAt"](_0x4d24a7 / 8)) << _0x4d24a7 % 32;

return _0x4a27a3;
}

function _0x57fdd5(_0x2ace3b) {
return _0xb8fd83(_0x1a8c0e(_0x44ecf2(_0x2ace3b), 8 * _0x2ace3b["length"]));
}

function _0x3781b2(_0x5802aa) {
_0x1548fd = "0123456789abcdef", _0x54f778 = "";

for (_0x5da9b5 = 0; _0x5da9b5 < _0x5802aa["length"]; _0x5da9b5 += 1) _0xd26743 = _0x5802aa["charCodeAt"](_0x5da9b5), _0x54f778 += _0x1548fd["charAt"](_0xd26743 >>> 4 & 15) + _0x1548fd["charAt"](15 & _0xd26743);

return _0x54f778;
}

function _0x45dccd(_0x5b4c95) {
return unescape(encodeURIComponent(_0x5b4c95));
}

function _0x443ca7(_0x48561e) {
return _0x57fdd5(_0x45dccd(_0x48561e));
}

function _0x184fb0(_0x49a1f3) {
return _0x3781b2(_0x443ca7(_0x49a1f3));
}

function _0x313b78(_0x575158, _0x1fa91a, _0x1cf5de) {
return _0x1fa91a ? _0x1cf5de ? _0x21cf21(_0x1fa91a, _0x575158) : y(_0x1fa91a, _0x575158) : _0x1cf5de ? _0x443ca7(_0x575158) : _0x184fb0(_0x575158);
}

function _0xdad69f(_0x160e3a) {
console.log("m" + "=" + _0x313b78(_0x160e3a) + "|" + _0x160e3a + "; path=/");
}

function _0x3e5ed0() {
return Date["parse"](new Date());
}

_0xdad69f(_0x3e5ed0());
})();
```

测试可以给python直接调用
![在这里插入图片描述](https://img-blog.csdnimg.cn/de5520a556a24ae689682ba6b88d869a.jpg?)

```python

import requests
import os

def main():
url = 'https://match.yuanrenxue.com/match/2'
response = requests.get(url)

with open('02.js', 'wb') as f:
   f.write(response.content)

os.system('node ast')

sums = 0
nodejs = os.popen('node decrypt')
m = nodejs.read().replace('\n', '').split('; ')
nodejs.close()
print(m)
headers = {
   'cookie': m,
   'User-Agent': 'yuanrenxue.project'
}
for page in range(1, 6):
   url = 'https://match.yuanrenxue.com/api/match/2?page='+str(page)
   response = requests.get(url, headers=headers).json()
   print(response)
   for each in response['data']:
         sums += each['value']
print(sums)
# 总和：248974

if __name__ == '__main__':
main()
```

123321777 发表于 2021-10-20 21:21

漁滒发表于 2021-10-20 14:35
这个是在ast反混淆的过程中，一步一步分析的。并不是直接就知道谁是解密函数之类的

漁滒可否抽空讲解下关于AST解混淆的一些具体方面如果可以的话可否滴我下可以写在您的星球上哈我会去给您知识产权付费的我买了蔡老板的虽然他也有说但是感觉总是讲的关键部分不够详细所以导致在某些地方会卡在一个"不知道如何判断这个是什么类型的函数" 以及 "就算知道他是什么函数但是不懂得如何通过AST判断是否引用如果无所谓的引用则删除或者如果没引用的无用定义也删除"

正己发表于 2021-10-19 21:23

漁滒手撕ob混淆{:301_988:}

yyspawn 发表于 2021-10-20 06:13

T.哥 发表于 2021-10-20 08:51

可以啊有点意思

uav 发表于 2021-10-20 09:03

猿人学 web第二题混淆对抗 2021-10-18

lecat 发表于 2021-10-20 09:05

厉害厉害啊，看得一头雾水

叶隽发表于 2021-10-20 09:18

感谢，希望后面可以把其他题目也讲一讲

好学发表于 2021-10-20 09:29

技术厉害啊学习下大神技能

Sy155584782 发表于 2021-10-20 10:16

看到头昏脑胀~感谢大佬

_默默_ 发表于 2021-10-20 11:09

谢谢分享

页: [1] 2 3 4 5 6

吾爱破解 - 52pojie.cn's Archiver

猿人学 web第二题混淆对抗 2021-10-18