[Asm] 纯文本查看 复制代码 import execjs
with open("weixingongzhong.js",'r',encoding="utf-8") as f:
js = f.read()
"""
当js逆向时候，需要的参数太多是把目标函数的上一级的函数全部打包扣下来， 遇到16进制的32位 就猜测是MD5加密 遇到=或者==号结尾的猜测是base64
"""
#实例化node对象
node=execjs.get()
pwd =execjs.compile(js)
pwdword = pwd.call('getword',123456)
print(pwdword)
-----------------------------------------------------------------------------------------------------------------------------------------
var r = {}
function f(t, e) {
var r = (65535 & t) + (65535 & e);
return (t >> 16) + (e >> 16) + (r >> 16) << 16 | 65535 & r
}
function s(t, e, r, n, o, i) {
return f((a = f(f(e, t), f(n, i))) << (s = o) | a >>> 32 - s, r);
var a, s
}
function d(t, e, r, n, o, i, a) {
return s(e & r | ~e & n, t, e, o, i, a)
}
function p(t, e, r, n, o, i, a) {
return s(e & n | r & ~n, t, e, o, i, a)
}
function h(t, e, r, n, o, i, a) {
return s(e ^ r ^ n, t, e, o, i, a)
}
function m(t, e, r, n, o, i, a) {
return s(r ^ (e | ~n), t, e, o, i, a)
}
function c(t, e) {
t[e >> 5] |= 128 << e % 32,
t[14 + (e + 64 >>> 9 << 4)] = e;
var r, n, o, i, a, s = 1732584193,
c = -271733879,
u = -1732584194,
l = 271733878;
for (r = 0; r < t.length; r += 16) s = d(n = s, o = c, i = u, a = l, t[r], 7, -680876936),
l = d(l, s, c, u, t[r + 1], 12, -389564586),
u = d(u, l, s, c, t[r + 2], 17, 606105819),
c = d(c, u, l, s, t[r + 3], 22, -1044525330),
s = d(s, c, u, l, t[r + 4], 7, -176418897),
l = d(l, s, c, u, t[r + 5], 12, 1200080426),
u = d(u, l, s, c, t[r + 6], 17, -1473231341),
c = d(c, u, l, s, t[r + 7], 22, -45705983),
s = d(s, c, u, l, t[r + 8], 7, 1770035416),
l = d(l, s, c, u, t[r + 9], 12, -1958414417),
u = d(u, l, s, c, t[r + 10], 17, -42063),
c = d(c, u, l, s, t[r + 11], 22, -1990404162),
s = d(s, c, u, l, t[r + 12], 7, 1804603682),
l = d(l, s, c, u, t[r + 13], 12, -40341101),
u = d(u, l, s, c, t[r + 14], 17, -1502002290),
s = p(s, c = d(c, u, l, s, t[r + 15], 22, 1236535329), u, l, t[r + 1], 5, -165796510),
l = p(l, s, c, u, t[r + 6], 9, -1069501632),
u = p(u, l, s, c, t[r + 11], 14, 643717713),
c = p(c, u, l, s, t[r], 20, -373897302),
s = p(s, c, u, l, t[r + 5], 5, -701558691),
l = p(l, s, c, u, t[r + 10], 9, 38016083),
u = p(u, l, s, c, t[r + 15], 14, -660478335),
c = p(c, u, l, s, t[r + 4], 20, -405537848),
s = p(s, c, u, l, t[r + 9], 5, 568446438),
l = p(l, s, c, u, t[r + 14], 9, -1019803690),
u = p(u, l, s, c, t[r + 3], 14, -187363961),
c = p(c, u, l, s, t[r + 8], 20, 1163531501),
s = p(s, c, u, l, t[r + 13], 5, -1444681467),
l = p(l, s, c, u, t[r + 2], 9, -51403784),
u = p(u, l, s, c, t[r + 7], 14, 1735328473),
s = h(s, c = p(c, u, l, s, t[r + 12], 20, -1926607734), u, l, t[r + 5], 4, -378558),
l = h(l, s, c, u, t[r + 8], 11, -2022574463),
u = h(u, l, s, c, t[r + 11], 16, 1839030562),
c = h(c, u, l, s, t[r + 14], 23, -35309556),
s = h(s, c, u, l, t[r + 1], 4, -1530992060),
l = h(l, s, c, u, t[r + 4], 11, 1272893353),
u = h(u, l, s, c, t[r + 7], 16, -155497632),
c = h(c, u, l, s, t[r + 10], 23, -1094730640),
s = h(s, c, u, l, t[r + 13], 4, 681279174),
l = h(l, s, c, u, t[r], 11, -358537222),
u = h(u, l, s, c, t[r + 3], 16, -722521979),
c = h(c, u, l, s, t[r + 6], 23, 76029189),
s = h(s, c, u, l, t[r + 9], 4, -640364487),
l = h(l, s, c, u, t[r + 12], 11, -421815835),
u = h(u, l, s, c, t[r + 15], 16, 530742520),
s = m(s, c = h(c, u, l, s, t[r + 2], 23, -995338651), u, l, t[r], 6, -198630844),
l = m(l, s, c, u, t[r + 7], 10, 1126891415),
u = m(u, l, s, c, t[r + 14], 15, -1416354905),
c = m(c, u, l, s, t[r + 5], 21, -57434055),
s = m(s, c, u, l, t[r + 12], 6, 1700485571),
l = m(l, s, c, u, t[r + 3], 10, -1894986606),
u = m(u, l, s, c, t[r + 10], 15, -1051523),
c = m(c, u, l, s, t[r + 1], 21, -2054922799),
s = m(s, c, u, l, t[r + 8], 6, 1873313359),
l = m(l, s, c, u, t[r + 15], 10, -30611744),
u = m(u, l, s, c, t[r + 6], 15, -1560198380),
c = m(c, u, l, s, t[r + 13], 21, 1309151649),
s = m(s, c, u, l, t[r + 4], 6, -145523070),
l = m(l, s, c, u, t[r + 11], 10, -1120210379),
u = m(u, l, s, c, t[r + 2], 15, 718787259),
c = m(c, u, l, s, t[r + 9], 21, -343485551),
s = f(s, n),
c = f(c, o),
u = f(u, i),
l = f(l, a);
return [s, c, u, l]
}
function u(t) {
var e, r = "";
for (e = 0; e < 32 * t.length; e += 8) r += String.fromCharCode(t[e >> 5] >>> e % 32 & 255);
return r
}
function l(t) {
var e, r = [];
for (r[(t.length >> 2) - 1] = void 0, e = 0; e < r.length; e += 1) r[e] = 0;
for (e = 0; e < 8 * t.length; e += 8) r[e >> 5] |= (255 & t.charCodeAt(e / 8)) << e % 32;
return r
}
function n(t) {
var e, r, n = "0123456789abcdef",
o = "";
for (r = 0; r < t.length; r += 1) e = t.charCodeAt(r),
o += n.charAt(e >>> 4 & 15) + n.charAt(15 & e);
return o
}
function o(t) {
return unescape(encodeURIComponent(t))
}
function i(t) {
return u(c(l(e = o(t)), 8 * e.length));
var e
}
function a(t, e) {
return function(t, e) {
var r, n, o = l(t),
i = [],
a = [];
for (i[15] = a[15] = void 0, 16 < o.length && (o = c(o, 8 * t.length)), r = 0; r < 16; r += 1) i[r] = 909522486 ^ o[r],
a[r] = 1549556828 ^ o[r];
return n = c(i.concat(l(e)), 512 + 8 * e.length),
u(c(a.concat(n), 640))
} (o(t), o(e))
}
function getword(t, e, r) {
return e ? r ? a(e, t) : n(a(e, t)) : r ? i(t) : n(i(t))
} |
发表于 2021-6-22 21:49
|
发表于 2021-6-22 23:03
