WEB逆向—X-Bogus逆向分析(纯算+补环境)

1

2

3

4

5

6

7

8

9

10

11

12

13

import random

def get_ms_token(randomlength=107):

    """

    根据传入长度产生随机字符串

    """

    random_str = ''

    base_str = 'ABCDEFGHIGKLMNOPQRSTUVWXYZabcdefghigklmnopqrstuvwxyz0123456789='

    length = len(base_str) - 1

    for _ in range(randomlength):

        random_str += base_str[random.randint(0, length)]

    return random_str

1

_0x2458f0['apply'](_0xc26b5e, _0x1f1790)==28(xb的长度)

1

2

3

4

5

6

window = global

document = {}

document.addEventListener = function () {}

navigator = {

    "userAgent": 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.366'

}

1

"1", "j>>>", j, "A>>>>", A, "O>>>>>", JSON.stringify(O, function(key, value) {if (value == window) {return undefined} return value})

1

"2","j>>>", j, "A>>>>", A, "O>>>>>", JSON.stringify(O, function(key, value) {if (value == window) {return undefined} return value})

1

2 j>>> 16 A>>>> 716 O>>>>> [null,[null,{},null,null,"ÿ-%.*¯Ë^9õ²&7","s2","=",{"s0":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=","s1":"Dkdpgh4ZKsQB80/Mfvw36XI1R25+WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe=","s2":"Dkdpgh4ZKsQB80/Mfvw36XI1R25-WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe="},"Dkdpgh4ZKsQB80/Mfvw36XI1R25-WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe=","DFSzswVOPSzANro1t-KBsNAwgYo",1214867,21],"DFSzswVOPSzANro1t-KBsNAwgYo","3","Dkdpgh4ZKsQB80/Mfvw36XI1R25-WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe=",[19],63,21]

1

2

"Dkdpgh4ZKsQB80/Mfvw36XI1R25-WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe=".charAt(19)

>> 3

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

str1 = "Dkdpgh4ZKsQB80/Mfvw36XI1R25-WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe="

// 19 = (1214867 & 63) >> 0

str1.charAt((1214867 & 63) >> 0)

//结果:3

// 38 = (1214867 & 4032) >> 6

str1.charAt((1214867 & 4032) >> 6)

// 结果:o

// 40 = (1214867 & 258048) >> 12

str1.charAt((1214867 & 258048) >> 12)

// 结果:Y

// 4 = (1214867 & 16515072) >> 18

str1.charAt((1214867 & 16515072) >> 18)

// 结果:g

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

const encodedString = "ÿ-%.*¯Ë^9õ²&7";

const decodingMap = "Dkdpgh4ZKsQB80/Mfvw36XI1R25-WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe=";

let xb = "";

for (let index = 0; index <= 20; index += 3) {

    const charCode1 = encodedString.charCodeAt(index);

    const charCode2 = encodedString.charCodeAt(index + 1);

    const charCode3 = encodedString.charCodeAt(index + 2);

    const combinedCode = charCode3 | (charCode2 << 8) | (charCode1 << 16);

    const codePart1 = (combinedCode & 16515072) >> 18;

    const codePart2 = (combinedCode & 258048) >> 12;

    const codePart3 = (combinedCode & 4032) >> 6;

    const codePart4 = combinedCode & 63;

    xb += decodingMap[codePart1] + decodingMap[codePart2] + decodingMap[codePart3] + decodingMap[codePart4];

}

console.log(xb);

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

function _0x86cb82(a) {

    return String.fromCharCode(a);

}

function _0x94582(a, b, c) {

    return _0x86cb82(a) + _0x86cb82(b) + c;

}

function _0x25788b(a, b) {

    for (var c, e = [], d = 0, t = "", f = 0; f < 256; f++) {

        e[f] = f;

    }

    for (var r = 0; r < 256; r++) {

        d = (d + e[r] + a.charCodeAt(r % a.length)) % 256, c = e[r], e[r] = e[d], e[d] = c;

    }

    var n = 0;

    d = 0;

    for (var o = 0; o < b.length; o++) {

        d = (d + e[n = (n + 1) % 256]) % 256, c = e[n], e[n] = e[d], e[d] = c, t += String.fromCharCode(b.charCodeAt(o) ^ e[(e[n] + e[d]) % 256]);

    }

    return t;

}

function _0x398111(a, b, c, e, d, t, f, r, n, o, i, _, x, u, s, l, v, h, p) {

    var y = new Uint8Array(19);

    return y[0] = a, y[1] = i, y[2] = b, y[3] = _, y[4] = c, y[5] = x, y[6] = e, y[7] = u,

        y[8] = d, y[9] = s, y[10] = t, y[11] = l, y[12] = f, y[13] = v, y[14] = r, y[15] = h,

        y[16] = n, y[17] = p, y[18] = o, String.fromCharCode.apply(null, y);

};