Obfuscated encryption
Obfuscating encryption is a common technique used to hide the intent and implementation details of the code, increase the complexity of the code, protect the code with ers ers, ers ers and ers ers ers to analyze and understand the code.
Here are some common steps to analyze and decrypt obfuscated JavaScript code:
- Read and understand the code: Before you begin, read the code carefully and understand its functions and logic. Pay attention to the structure of the code, naming specifications, and the libraries or frameworks used.
- Identification and parsing obfuscation techniques: Try to identify obfuscation techniques used in code. Common obfuscation techniques include variable name replacement, string encryption, function inline, control flow flattening, etc. Understanding these techniques will help you understand your code better.
- Deobfuscation: Try to restore the obfuscated part of the code. This may involve restoring the variable name back to its original name, decrypting the encrypted string, restoring the inlined function, etc. This requires you to reverse engineer based on the specific techniques of obfuscating.
- Debugging and Analysis: Use debuggers and developer tools to step through the code and observe its behavior. This can help you understand the execution flow of your code, the values of variables, and the interaction with other code modules.
This code uses obfuscation techniques to hide its true intentions and implementation details.
Step by step analysis
/*
* The encryption tool has been upgraded to a version, currently .v6, and the encryption algorithm has been updated and the volume has been reduced;
* In addition, .v6 has forced verification, and the comments can be removed, but .v6 cannot be removed, and there is no binding for the others.
* I will never join any backdoor. The mission of encryption is to protect your Javascript.
*/
var a=['.v6','.lv6==','5p+76Zev6aOL6K2W6ICh57Czw59KXsO7woIUw6fCgMKLw5TCqg==','KFXCvcKCJFM=','IWQXKgw=','Gks8Kg==','w4h1w7oOag=='];(function(c,d,e){var f=function(g,h,i,j){h=h>>0x8;if(h<g){while(--g){j=c['shift']();if(h===g){h=j;i=c['shift']();}else if(i['replace'](/[ZglBUDOPlrwEVBpl=]/g,'')===h){c['push'](j);}}c['push'](c['shift']());}return 0x242ed;};return f(++d,e)>>d^e;}(a,0x1eb,0x1eb00));var b=function(c,d){c=~~'0x'['concat'](c);var e=a[c];if(b['gPvZlv']===undefined){(function(){var f=typeof window!=='undefined'?window:typeof process==='object'&&typeof require==='function'&&typeof global==='object'?global:this;var g='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';f['atob']||(f['atob']=function(h){var i=String(h)['replace'](/=+$/,'');for(var j=0x0,k,l,m=0x0,n='';l=i['charAt'](m++);~l&&(k=j%0x4?k*0x40+l:l,j++%0x4)?n+=String['fromCharCode'](0xff&k>>(-0x2*j&0x6)):0x0){l=g['indexOf'](l);}return n;});}());var o=function(p,d){var r=[],s=0x0,t,u='',v='';p=atob(p);for(var w=0x0,x=p['length'];w<x;w++){v+='%'+('00'+p['charCodeAt'](w)['toString'](0x10))['slice'](-0x2);}p=decodeURIComponent(v);for(var y=0x0;y<0x100;y++){r[y]=y;}for(y=0x0;y<0x100;y++){s=(s+r[y]+d['charCodeAt'](y%d['length']))%0x100;t=r[y];r[y]=r[s];r[s]=t;}y=0x0;s=0x0;for(var z=0x0;z<p['length'];z++){y=(y+0x1)%0x100;s=(s+r[y])%0x100;t=r[y];r[y]=r[s];r[s]=t;u+=String['fromCharCode'](p['charCodeAt'](z)^r[(r[y]+r[s])%0x100]);}return u;};b['fuFDUP']=o;b['uzmgkx']={};b['gPvZlv']=!![];}var A=b['uzmgkx'][c];if(A===undefined){if(b['GkZZBA']===undefined){b['GkZZBA']=!![];}e=b['fuFDUP'](e,d);b['uzmgkx'][c]=e;}else{e=A;}return e;};(function(c,d){var e={'RAMoq':'\x32\x30\x31\x39\u5e74\x30\x39\u6708\x31\x32\u65e5\x31\x35\x3a\x32\x34\x3a\x32\x39\u66f4\u65b0','EaZaN':'\u8fd9\u4e2a\u662f\u4e00\u4e2a\u672c\u7ad9\u5bf9\x4a\x61\x76\x61\x53\x63\x72\x69\x70\x74 \u811a\u672c\u7684\u4e00\u4e2a\u6700\u725b\u52a0\u5bc6\uff0c\u517c\u5bb9\u6027\u9002\u4e2d\uff0c\u89e3\u5bc6\u96be\u5ea6\u6781\u5927'};c[b('0','ZdTU')]=e[b('1','FnxY')];d[b('2','FnxY')]=e[b('3','jPNw')];d['feedback']=b('4','fS%!');}(window,document));This line of code defines a name calledaarray containing some obfuscated strings.
var a=['.v6','.lv6==','5p+76Zev6aOL6K2W6ICh57Czw59KXsO7woIUw6fCgMKLw5TCqg==','KFXCvcKCJFM=','IWQXKgw=','Gks8Kg==','w4h1w7oOag=='];
This line of code defines an arraya, which contains some string elements.
(function(c,d,e){
// ...
}(a,0x1eb,0x1eb00));This is an immediate execution function (IIFE) that accepts three parametersc、dande. Do some operations and calculations inside the function.
var b=function(c,d){
// ...
};
(function(c,d){
// ...
}(window,document));This part of the code defines a functionb, accept two parameterscandd. Another function that executes immediately is passedwindowanddocumentAs parametercandd. The specific implementation of these functions is hidden.
The entire code segment uses string decoding, bit operations, and some algorithms, as well as arraysaPerform operations and calculations. Because the code is obfuscated and has poor readability, it is difficult to directly understand its specific functions and logic.
Reveal the source code
(function(w, d) {
= "Updated at 15:24:29 on September 12, 2019";
= "This is one of the most awesome encryption for JavaScript scripts on this site, with moderate compatibility and extremely difficult decryption.";
= "If you have any questions, please contact xxxxx";
})(window, document);If you have different opinions on the content of the article or have questions, please leave a message in the comment area, or send a private message to me or find a customer service number on our official website.
If you don't have a backup after encrypting the source code, you can ask us to solve the problem and solve the source code. Any encryption is OK
The above is the detailed content of jsjiami.v6 analysis of js obfuscation encryption. For more information about js obfuscation encryption, please follow my other related articles!