【逆向】tb解析function(_0x457ace, _0x349832) 即random出处

function(_0x457ace, _0x349832) {
	_0x457ace = _0x457ace - 0x18a;
	var _0x4c6e1a = _0x19971f[_0x457ace];
	if (a0_0x457a['pIaRKj'] === undefined) {
		var _0x2a073e = function(_0x3f86c9) {
			var _0x153ef8 = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';
			var _0x6873a5 = '',
			_0x41c8da = '';
			for (var _0x5c7b8d = 0x0,
			_0x27fa83, _0x3f32c6, _0xef38ce = 0x0; _0x3f32c6 = _0x3f86c9['charAt'](_0xef38ce++);~_0x3f32c6 && (_0x27fa83 = _0x5c7b8d % 0x4 ? _0x27fa83 * 0x40 + _0x3f32c6: _0x3f32c6, _0x5c7b8d++%0x4) ? _0x6873a5 += String['fromCharCode'](0xff & _0x27fa83 >> ( - 0x2 * _0x5c7b8d & 0x6)) : 0x0) {
				_0x3f32c6 = _0x153ef8['indexOf'](_0x3f32c6);
			}
			for (var _0x56ffc6 = 0x0,
			_0x2026b1 = _0x6873a5['length']; _0x56ffc6 < _0x2026b1; _0x56ffc6++) {
				_0x41c8da += '%' + ('00' + _0x6873a5['charCodeAt'](_0x56ffc6)['toString'](0x10))['slice']( - 0x2);
			}
			return decodeURIComponent(_0x41c8da);
		};
		var _0x384326 = function(_0x5a7df8, _0x68a587) {
			var _0x46b693 = [],
			_0xb659b6 = 0x0,
			_0x38697a,
			_0x299539 = '';
			_0x5a7df8 = _0x2a073e(_0x5a7df8);
			var _0x3b9660;
			for (_0x3b9660 = 0x0; _0x3b9660 < 0x100; _0x3b9660++) {
				_0x46b693[_0x3b9660] = _0x3b9660;
			}
			for (_0x3b9660 = 0x0; _0x3b9660 < 0x100; _0x3b9660++) {
				_0xb659b6 = (_0xb659b6 + _0x46b693[_0x3b9660] + _0x68a587['charCodeAt'](_0x3b9660 % _0x68a587['length'])) % 0x100,
				_0x38697a = _0x46b693[_0x3b9660],
				_0x46b693[_0x3b9660] = _0x46b693[_0xb659b6],
				_0x46b693[_0xb659b6] = _0x38697a;
			}
			_0x3b9660 = 0x0,
			_0xb659b6 = 0x0;
			for (var _0x271a01 = 0x0; _0x271a01 < _0x5a7df8['length']; _0x271a01++) {
				_0x3b9660 = (_0x3b9660 + 0x1) % 0x100,
				_0xb659b6 = (_0xb659b6 + _0x46b693[_0x3b9660]) % 0x100,
				_0x38697a = _0x46b693[_0x3b9660],
				_0x46b693[_0x3b9660] = _0x46b693[_0xb659b6],
				_0x46b693[_0xb659b6] = _0x38697a,
				_0x299539 += String['fromCharCode'](_0x5a7df8['charCodeAt'](_0x271a01) ^ _0x46b693[(_0x46b693[_0x3b9660] + _0x46b693[_0xb659b6]) % 0x100]);
			}
			return _0x299539;
		};
		a0_0x457a['mlzgZn'] = _0x384326,
		_0x348322 = arguments,
		a0_0x457a['pIaRKj'] = !![];
	}
	var _0x2a2c40 = _0x19971f[0x0],
	_0x17806e = _0x457ace + _0x2a2c40,
	_0x4fed40 = _0x348322[_0x17806e];
	return ! _0x4fed40 ? (a0_0x457a['kveOFi'] === undefined && (a0_0x457a['kveOFi'] = !![]), _0x4c6e1a = a0_0x457a['mlzgZn'](_0x4c6e1a, _0x349832), _0x348322[_0x17806e] = _0x4c6e1a) : _0x4c6e1a = _0x4fed40,
	_0x4c6e1a;
}

调试入口:
image

测试Date_0x36c5d3(0x37b, 'aO!D'),生成一个时间戳
image

验证得到这是一个时间戳
image

解出时间戳为

const _0x4085c6 = ''.concat(Date.now());

验证 _0xbae138[_0x36c5d3(0x5fd, 't[mc')])()

image
得到
_0xbae138.getRandom()
最终得到
const _0x48393f = _0xbae138.getRandom();

作者:Gim

出处:https://www.cnblogs.com/Gimm/p/18674826

版权:本作品采用「署名-非商业性使用-相同方式共享 4.0 国际」许可协议进行许可。

posted @   踩坑大王  阅读(7)  评论(0编辑  收藏  举报
相关博文:
阅读排行:
· 震惊!C++程序真的从main开始吗?99%的程序员都答错了
· winform 绘制太阳,地球,月球 运作规律
· 【硬核科普】Trae如何「偷看」你的代码?零基础破解AI编程运行原理
· 上周热点回顾(3.3-3.9)
· 超详细:普通电脑也行Windows部署deepseek R1训练数据并当服务器共享给他人
more_horiz
keyboard_arrow_up light_mode palette
选择主题
点击右上角即可分享
微信分享提示